@profullstack/threatcrush 0.11.3 → 0.11.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/daemon.js +95 -16
  2. package/dist/daemon.js.map +1 -1
  3. package/dist/index.js +4941 -649
  4. package/dist/index.js.map +1 -1
  5. package/package.json +3 -9
package/dist/daemon.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/lib/parser.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/lib/create-datetime.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/lib/format-num.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/lib/create-datetime-float.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/lib/create-date.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/lib/create-time.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/lib/toml-parser.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/parse-pretty-error.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/parse-string.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/parse-async.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/parse-stream.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/parse.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/stringify.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/toml.js","../src/daemon/index.ts","../src/daemon/paths.ts","../src/daemon/pidfile.ts","../src/daemon/ipc-server.ts","../src/daemon/control-token.ts","../src/daemon/event-bus.ts","../src/core/state.ts","../src/daemon/module-host.ts","../src/daemon/module-trust.ts","../src/daemon/watchers/log-watcher.ts","../src/core/log-parser.ts","../src/daemon/watchers/journal-watcher.ts","../src/modules/network-monitor/index.ts","../src/modules/dns-monitor/index.ts","../src/core/config.ts","../src/daemon/alerts/smtp.ts","../src/daemon/alerts/discord.ts","../src/daemon/alerts/pagerduty.ts","../src/daemon/alerts/index.ts","../src/core/cli-config.ts","../src/commands/scan.ts","../../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js","../../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/vendor/supports-color/index.js","../../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/utilities.js","../../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/index.js","../src/core/logger.ts","../src/core/run-result.ts","../../../packages/scan/src/node-rules.ts","../../../packages/scan/src/types.ts","../../../packages/scan/src/code-rules.ts","../../../packages/scan/src/template-rules.ts","../../../packages/scan/src/controls.ts","../../../packages/scan/src/manifest-rules.ts","../../../packages/scan/src/secret-rules.ts","../../../packages/scan/src/text.ts","../../../packages/scan/src/node/walk.ts","../../../packages/scan/src/node/dependencies.ts","../../../packages/scan/src/node/sarif.ts","../src/commands/pentest.ts","../src/daemon/workers/runs-worker.ts","../src/daemon/rules/engine.ts","../src/daemon/rules/loader.ts","../src/daemon/rules/default-rules.ts","../src/daemon/firewall/adapters.ts","../src/daemon/firewall/remediation.ts","../src/core/telemetry.ts","../src/daemon-entry.ts"],"sourcesContent":["'use strict'\nconst ParserEND = 0x110000\nclass ParserError extends Error {\n /* istanbul ignore next */\n constructor (msg, filename, linenumber) {\n super('[ParserError] ' + msg, filename, linenumber)\n this.name = 'ParserError'\n this.code = 'ParserError'\n if (Error.captureStackTrace) Error.captureStackTrace(this, ParserError)\n }\n}\nclass State {\n constructor (parser) {\n this.parser = parser\n this.buf = ''\n this.returned = null\n this.result = null\n this.resultTable = null\n this.resultArr = null\n }\n}\nclass Parser {\n constructor () {\n this.pos = 0\n this.col = 0\n this.line = 0\n this.obj = {}\n this.ctx = this.obj\n this.stack = []\n this._buf = ''\n this.char = null\n this.ii = 0\n this.state = new State(this.parseStart)\n }\n\n parse (str) {\n /* istanbul ignore next */\n if (str.length === 0 || str.length == null) return\n\n this._buf = String(str)\n this.ii = -1\n this.char = -1\n let getNext\n while (getNext === false || this.nextChar()) {\n getNext = this.runOne()\n }\n this._buf = null\n }\n nextChar () {\n if (this.char === 0x0A) {\n ++this.line\n this.col = -1\n }\n ++this.ii\n this.char = this._buf.codePointAt(this.ii)\n ++this.pos\n ++this.col\n return this.haveBuffer()\n }\n haveBuffer () {\n return this.ii < this._buf.length\n }\n runOne () {\n return this.state.parser.call(this, this.state.returned)\n }\n finish () {\n this.char = ParserEND\n let last\n do {\n last = this.state.parser\n this.runOne()\n } while (this.state.parser !== last)\n\n this.ctx = null\n this.state = null\n this._buf = null\n\n return this.obj\n }\n next (fn) {\n /* istanbul ignore next */\n if (typeof fn !== 'function') throw new ParserError('Tried to set state to non-existent state: ' + JSON.stringify(fn))\n this.state.parser = fn\n }\n goto (fn) {\n this.next(fn)\n return this.runOne()\n }\n call (fn, returnWith) {\n if (returnWith) this.next(returnWith)\n this.stack.push(this.state)\n this.state = new State(fn)\n }\n callNow (fn, returnWith) {\n this.call(fn, returnWith)\n return this.runOne()\n }\n return (value) {\n /* istanbul ignore next */\n if (this.stack.length === 0) throw this.error(new ParserError('Stack underflow'))\n if (value === undefined) value = this.state.buf\n this.state = this.stack.pop()\n this.state.returned = value\n }\n returnNow (value) {\n this.return(value)\n return this.runOne()\n }\n consume () {\n /* istanbul ignore next */\n if (this.char === ParserEND) throw this.error(new ParserError('Unexpected end-of-buffer'))\n this.state.buf += this._buf[this.ii]\n }\n error (err) {\n err.line = this.line\n err.col = this.col\n err.pos = this.pos\n return err\n }\n /* istanbul ignore next */\n parseStart () {\n throw new ParserError('Must declare a parseStart method')\n }\n}\nParser.END = ParserEND\nParser.Error = ParserError\nmodule.exports = Parser\n","'use strict'\nmodule.exports = value => {\n const date = new Date(value)\n /* istanbul ignore if */\n if (isNaN(date)) {\n throw new TypeError('Invalid Datetime')\n } else {\n return date\n }\n}\n","'use strict'\nmodule.exports = (d, num) => {\n num = String(num)\n while (num.length < d) num = '0' + num\n return num\n}\n","'use strict'\nconst f = require('./format-num.js')\n\nclass FloatingDateTime extends Date {\n constructor (value) {\n super(value + 'Z')\n this.isFloating = true\n }\n toISOString () {\n const date = `${this.getUTCFullYear()}-${f(2, this.getUTCMonth() + 1)}-${f(2, this.getUTCDate())}`\n const time = `${f(2, this.getUTCHours())}:${f(2, this.getUTCMinutes())}:${f(2, this.getUTCSeconds())}.${f(3, this.getUTCMilliseconds())}`\n return `${date}T${time}`\n }\n}\n\nmodule.exports = value => {\n const date = new FloatingDateTime(value)\n /* istanbul ignore if */\n if (isNaN(date)) {\n throw new TypeError('Invalid Datetime')\n } else {\n return date\n }\n}\n","'use strict'\nconst f = require('./format-num.js')\nconst DateTime = global.Date\n\nclass Date extends DateTime {\n constructor (value) {\n super(value)\n this.isDate = true\n }\n toISOString () {\n return `${this.getUTCFullYear()}-${f(2, this.getUTCMonth() + 1)}-${f(2, this.getUTCDate())}`\n }\n}\n\nmodule.exports = value => {\n const date = new Date(value)\n /* istanbul ignore if */\n if (isNaN(date)) {\n throw new TypeError('Invalid Datetime')\n } else {\n return date\n }\n}\n","'use strict'\nconst f = require('./format-num.js')\n\nclass Time extends Date {\n constructor (value) {\n super(`0000-01-01T${value}Z`)\n this.isTime = true\n }\n toISOString () {\n return `${f(2, this.getUTCHours())}:${f(2, this.getUTCMinutes())}:${f(2, this.getUTCSeconds())}.${f(3, this.getUTCMilliseconds())}`\n }\n}\n\nmodule.exports = value => {\n const date = new Time(value)\n /* istanbul ignore if */\n if (isNaN(date)) {\n throw new TypeError('Invalid Datetime')\n } else {\n return date\n }\n}\n","'use strict'\n/* eslint-disable no-new-wrappers, no-eval, camelcase, operator-linebreak */\nmodule.exports = makeParserClass(require('./parser.js'))\nmodule.exports.makeParserClass = makeParserClass\n\nclass TomlError extends Error {\n constructor (msg) {\n super(msg)\n this.name = 'TomlError'\n /* istanbul ignore next */\n if (Error.captureStackTrace) Error.captureStackTrace(this, TomlError)\n this.fromTOML = true\n this.wrapped = null\n }\n}\nTomlError.wrap = err => {\n const terr = new TomlError(err.message)\n terr.code = err.code\n terr.wrapped = err\n return terr\n}\nmodule.exports.TomlError = TomlError\n\nconst createDateTime = require('./create-datetime.js')\nconst createDateTimeFloat = require('./create-datetime-float.js')\nconst createDate = require('./create-date.js')\nconst createTime = require('./create-time.js')\n\nconst CTRL_I = 0x09\nconst CTRL_J = 0x0A\nconst CTRL_M = 0x0D\nconst CTRL_CHAR_BOUNDARY = 0x1F // the last non-character in the latin1 region of unicode, except DEL\nconst CHAR_SP = 0x20\nconst CHAR_QUOT = 0x22\nconst CHAR_NUM = 0x23\nconst CHAR_APOS = 0x27\nconst CHAR_PLUS = 0x2B\nconst CHAR_COMMA = 0x2C\nconst CHAR_HYPHEN = 0x2D\nconst CHAR_PERIOD = 0x2E\nconst CHAR_0 = 0x30\nconst CHAR_1 = 0x31\nconst CHAR_7 = 0x37\nconst CHAR_9 = 0x39\nconst CHAR_COLON = 0x3A\nconst CHAR_EQUALS = 0x3D\nconst CHAR_A = 0x41\nconst CHAR_E = 0x45\nconst CHAR_F = 0x46\nconst CHAR_T = 0x54\nconst CHAR_U = 0x55\nconst CHAR_Z = 0x5A\nconst CHAR_LOWBAR = 0x5F\nconst CHAR_a = 0x61\nconst CHAR_b = 0x62\nconst CHAR_e = 0x65\nconst CHAR_f = 0x66\nconst CHAR_i = 0x69\nconst CHAR_l = 0x6C\nconst CHAR_n = 0x6E\nconst CHAR_o = 0x6F\nconst CHAR_r = 0x72\nconst CHAR_s = 0x73\nconst CHAR_t = 0x74\nconst CHAR_u = 0x75\nconst CHAR_x = 0x78\nconst CHAR_z = 0x7A\nconst CHAR_LCUB = 0x7B\nconst CHAR_RCUB = 0x7D\nconst CHAR_LSQB = 0x5B\nconst CHAR_BSOL = 0x5C\nconst CHAR_RSQB = 0x5D\nconst CHAR_DEL = 0x7F\nconst SURROGATE_FIRST = 0xD800\nconst SURROGATE_LAST = 0xDFFF\n\nconst escapes = {\n [CHAR_b]: '\\u0008',\n [CHAR_t]: '\\u0009',\n [CHAR_n]: '\\u000A',\n [CHAR_f]: '\\u000C',\n [CHAR_r]: '\\u000D',\n [CHAR_QUOT]: '\\u0022',\n [CHAR_BSOL]: '\\u005C'\n}\n\nfunction isDigit (cp) {\n return cp >= CHAR_0 && cp <= CHAR_9\n}\nfunction isHexit (cp) {\n return (cp >= CHAR_A && cp <= CHAR_F) || (cp >= CHAR_a && cp <= CHAR_f) || (cp >= CHAR_0 && cp <= CHAR_9)\n}\nfunction isBit (cp) {\n return cp === CHAR_1 || cp === CHAR_0\n}\nfunction isOctit (cp) {\n return (cp >= CHAR_0 && cp <= CHAR_7)\n}\nfunction isAlphaNumQuoteHyphen (cp) {\n return (cp >= CHAR_A && cp <= CHAR_Z)\n || (cp >= CHAR_a && cp <= CHAR_z)\n || (cp >= CHAR_0 && cp <= CHAR_9)\n || cp === CHAR_APOS\n || cp === CHAR_QUOT\n || cp === CHAR_LOWBAR\n || cp === CHAR_HYPHEN\n}\nfunction isAlphaNumHyphen (cp) {\n return (cp >= CHAR_A && cp <= CHAR_Z)\n || (cp >= CHAR_a && cp <= CHAR_z)\n || (cp >= CHAR_0 && cp <= CHAR_9)\n || cp === CHAR_LOWBAR\n || cp === CHAR_HYPHEN\n}\nconst _type = Symbol('type')\nconst _declared = Symbol('declared')\n\nconst hasOwnProperty = Object.prototype.hasOwnProperty\nconst defineProperty = Object.defineProperty\nconst descriptor = {configurable: true, enumerable: true, writable: true, value: undefined}\n\nfunction hasKey (obj, key) {\n if (hasOwnProperty.call(obj, key)) return true\n if (key === '__proto__') defineProperty(obj, '__proto__', descriptor)\n return false\n}\n\nconst INLINE_TABLE = Symbol('inline-table')\nfunction InlineTable () {\n return Object.defineProperties({}, {\n [_type]: {value: INLINE_TABLE}\n })\n}\nfunction isInlineTable (obj) {\n if (obj === null || typeof (obj) !== 'object') return false\n return obj[_type] === INLINE_TABLE\n}\n\nconst TABLE = Symbol('table')\nfunction Table () {\n return Object.defineProperties({}, {\n [_type]: {value: TABLE},\n [_declared]: {value: false, writable: true}\n })\n}\nfunction isTable (obj) {\n if (obj === null || typeof (obj) !== 'object') return false\n return obj[_type] === TABLE\n}\n\nconst _contentType = Symbol('content-type')\nconst INLINE_LIST = Symbol('inline-list')\nfunction InlineList (type) {\n return Object.defineProperties([], {\n [_type]: {value: INLINE_LIST},\n [_contentType]: {value: type}\n })\n}\nfunction isInlineList (obj) {\n if (obj === null || typeof (obj) !== 'object') return false\n return obj[_type] === INLINE_LIST\n}\n\nconst LIST = Symbol('list')\nfunction List () {\n return Object.defineProperties([], {\n [_type]: {value: LIST}\n })\n}\nfunction isList (obj) {\n if (obj === null || typeof (obj) !== 'object') return false\n return obj[_type] === LIST\n}\n\n// in an eval, to let bundlers not slurp in a util proxy\nlet _custom\ntry {\n const utilInspect = eval(\"require('util').inspect\")\n _custom = utilInspect.custom\n} catch (_) {\n /* eval require not available in transpiled bundle */\n}\n/* istanbul ignore next */\nconst _inspect = _custom || 'inspect'\n\nclass BoxedBigInt {\n constructor (value) {\n try {\n this.value = global.BigInt.asIntN(64, value)\n } catch (_) {\n /* istanbul ignore next */\n this.value = null\n }\n Object.defineProperty(this, _type, {value: INTEGER})\n }\n isNaN () {\n return this.value === null\n }\n /* istanbul ignore next */\n toString () {\n return String(this.value)\n }\n /* istanbul ignore next */\n [_inspect] () {\n return `[BigInt: ${this.toString()}]}`\n }\n valueOf () {\n return this.value\n }\n}\n\nconst INTEGER = Symbol('integer')\nfunction Integer (value) {\n let num = Number(value)\n // -0 is a float thing, not an int thing\n if (Object.is(num, -0)) num = 0\n /* istanbul ignore else */\n if (global.BigInt && !Number.isSafeInteger(num)) {\n return new BoxedBigInt(value)\n } else {\n /* istanbul ignore next */\n return Object.defineProperties(new Number(num), {\n isNaN: {value: function () { return isNaN(this) }},\n [_type]: {value: INTEGER},\n [_inspect]: {value: () => `[Integer: ${value}]`}\n })\n }\n}\nfunction isInteger (obj) {\n if (obj === null || typeof (obj) !== 'object') return false\n return obj[_type] === INTEGER\n}\n\nconst FLOAT = Symbol('float')\nfunction Float (value) {\n /* istanbul ignore next */\n return Object.defineProperties(new Number(value), {\n [_type]: {value: FLOAT},\n [_inspect]: {value: () => `[Float: ${value}]`}\n })\n}\nfunction isFloat (obj) {\n if (obj === null || typeof (obj) !== 'object') return false\n return obj[_type] === FLOAT\n}\n\nfunction tomlType (value) {\n const type = typeof value\n if (type === 'object') {\n /* istanbul ignore if */\n if (value === null) return 'null'\n if (value instanceof Date) return 'datetime'\n /* istanbul ignore else */\n if (_type in value) {\n switch (value[_type]) {\n case INLINE_TABLE: return 'inline-table'\n case INLINE_LIST: return 'inline-list'\n /* istanbul ignore next */\n case TABLE: return 'table'\n /* istanbul ignore next */\n case LIST: return 'list'\n case FLOAT: return 'float'\n case INTEGER: return 'integer'\n }\n }\n }\n return type\n}\n\nfunction makeParserClass (Parser) {\n class TOMLParser extends Parser {\n constructor () {\n super()\n this.ctx = this.obj = Table()\n }\n\n /* MATCH HELPER */\n atEndOfWord () {\n return this.char === CHAR_NUM || this.char === CTRL_I || this.char === CHAR_SP || this.atEndOfLine()\n }\n atEndOfLine () {\n return this.char === Parser.END || this.char === CTRL_J || this.char === CTRL_M\n }\n\n parseStart () {\n if (this.char === Parser.END) {\n return null\n } else if (this.char === CHAR_LSQB) {\n return this.call(this.parseTableOrList)\n } else if (this.char === CHAR_NUM) {\n return this.call(this.parseComment)\n } else if (this.char === CTRL_J || this.char === CHAR_SP || this.char === CTRL_I || this.char === CTRL_M) {\n return null\n } else if (isAlphaNumQuoteHyphen(this.char)) {\n return this.callNow(this.parseAssignStatement)\n } else {\n throw this.error(new TomlError(`Unknown character \"${this.char}\"`))\n }\n }\n\n // HELPER, this strips any whitespace and comments to the end of the line\n // then RETURNS. Last state in a production.\n parseWhitespaceToEOL () {\n if (this.char === CHAR_SP || this.char === CTRL_I || this.char === CTRL_M) {\n return null\n } else if (this.char === CHAR_NUM) {\n return this.goto(this.parseComment)\n } else if (this.char === Parser.END || this.char === CTRL_J) {\n return this.return()\n } else {\n throw this.error(new TomlError('Unexpected character, expected only whitespace or comments till end of line'))\n }\n }\n\n /* ASSIGNMENT: key = value */\n parseAssignStatement () {\n return this.callNow(this.parseAssign, this.recordAssignStatement)\n }\n recordAssignStatement (kv) {\n let target = this.ctx\n let finalKey = kv.key.pop()\n for (let kw of kv.key) {\n if (hasKey(target, kw) && (!isTable(target[kw]) || target[kw][_declared])) {\n throw this.error(new TomlError(\"Can't redefine existing key\"))\n }\n target = target[kw] = target[kw] || Table()\n }\n if (hasKey(target, finalKey)) {\n throw this.error(new TomlError(\"Can't redefine existing key\"))\n }\n // unbox our numbers\n if (isInteger(kv.value) || isFloat(kv.value)) {\n target[finalKey] = kv.value.valueOf()\n } else {\n target[finalKey] = kv.value\n }\n return this.goto(this.parseWhitespaceToEOL)\n }\n\n /* ASSSIGNMENT expression, key = value possibly inside an inline table */\n parseAssign () {\n return this.callNow(this.parseKeyword, this.recordAssignKeyword)\n }\n recordAssignKeyword (key) {\n if (this.state.resultTable) {\n this.state.resultTable.push(key)\n } else {\n this.state.resultTable = [key]\n }\n return this.goto(this.parseAssignKeywordPreDot)\n }\n parseAssignKeywordPreDot () {\n if (this.char === CHAR_PERIOD) {\n return this.next(this.parseAssignKeywordPostDot)\n } else if (this.char !== CHAR_SP && this.char !== CTRL_I) {\n return this.goto(this.parseAssignEqual)\n }\n }\n parseAssignKeywordPostDot () {\n if (this.char !== CHAR_SP && this.char !== CTRL_I) {\n return this.callNow(this.parseKeyword, this.recordAssignKeyword)\n }\n }\n\n parseAssignEqual () {\n if (this.char === CHAR_EQUALS) {\n return this.next(this.parseAssignPreValue)\n } else {\n throw this.error(new TomlError('Invalid character, expected \"=\"'))\n }\n }\n parseAssignPreValue () {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else {\n return this.callNow(this.parseValue, this.recordAssignValue)\n }\n }\n recordAssignValue (value) {\n return this.returnNow({key: this.state.resultTable, value: value})\n }\n\n /* COMMENTS: #...eol */\n parseComment () {\n do {\n if (this.char === Parser.END || this.char === CTRL_J) {\n return this.return()\n }\n } while (this.nextChar())\n }\n\n /* TABLES AND LISTS, [foo] and [[foo]] */\n parseTableOrList () {\n if (this.char === CHAR_LSQB) {\n this.next(this.parseList)\n } else {\n return this.goto(this.parseTable)\n }\n }\n\n /* TABLE [foo.bar.baz] */\n parseTable () {\n this.ctx = this.obj\n return this.goto(this.parseTableNext)\n }\n parseTableNext () {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else {\n return this.callNow(this.parseKeyword, this.parseTableMore)\n }\n }\n parseTableMore (keyword) {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else if (this.char === CHAR_RSQB) {\n if (hasKey(this.ctx, keyword) && (!isTable(this.ctx[keyword]) || this.ctx[keyword][_declared])) {\n throw this.error(new TomlError(\"Can't redefine existing key\"))\n } else {\n this.ctx = this.ctx[keyword] = this.ctx[keyword] || Table()\n this.ctx[_declared] = true\n }\n return this.next(this.parseWhitespaceToEOL)\n } else if (this.char === CHAR_PERIOD) {\n if (!hasKey(this.ctx, keyword)) {\n this.ctx = this.ctx[keyword] = Table()\n } else if (isTable(this.ctx[keyword])) {\n this.ctx = this.ctx[keyword]\n } else if (isList(this.ctx[keyword])) {\n this.ctx = this.ctx[keyword][this.ctx[keyword].length - 1]\n } else {\n throw this.error(new TomlError(\"Can't redefine existing key\"))\n }\n return this.next(this.parseTableNext)\n } else {\n throw this.error(new TomlError('Unexpected character, expected whitespace, . or ]'))\n }\n }\n\n /* LIST [[a.b.c]] */\n parseList () {\n this.ctx = this.obj\n return this.goto(this.parseListNext)\n }\n parseListNext () {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else {\n return this.callNow(this.parseKeyword, this.parseListMore)\n }\n }\n parseListMore (keyword) {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else if (this.char === CHAR_RSQB) {\n if (!hasKey(this.ctx, keyword)) {\n this.ctx[keyword] = List()\n }\n if (isInlineList(this.ctx[keyword])) {\n throw this.error(new TomlError(\"Can't extend an inline array\"))\n } else if (isList(this.ctx[keyword])) {\n const next = Table()\n this.ctx[keyword].push(next)\n this.ctx = next\n } else {\n throw this.error(new TomlError(\"Can't redefine an existing key\"))\n }\n return this.next(this.parseListEnd)\n } else if (this.char === CHAR_PERIOD) {\n if (!hasKey(this.ctx, keyword)) {\n this.ctx = this.ctx[keyword] = Table()\n } else if (isInlineList(this.ctx[keyword])) {\n throw this.error(new TomlError(\"Can't extend an inline array\"))\n } else if (isInlineTable(this.ctx[keyword])) {\n throw this.error(new TomlError(\"Can't extend an inline table\"))\n } else if (isList(this.ctx[keyword])) {\n this.ctx = this.ctx[keyword][this.ctx[keyword].length - 1]\n } else if (isTable(this.ctx[keyword])) {\n this.ctx = this.ctx[keyword]\n } else {\n throw this.error(new TomlError(\"Can't redefine an existing key\"))\n }\n return this.next(this.parseListNext)\n } else {\n throw this.error(new TomlError('Unexpected character, expected whitespace, . or ]'))\n }\n }\n parseListEnd (keyword) {\n if (this.char === CHAR_RSQB) {\n return this.next(this.parseWhitespaceToEOL)\n } else {\n throw this.error(new TomlError('Unexpected character, expected whitespace, . or ]'))\n }\n }\n\n /* VALUE string, number, boolean, inline list, inline object */\n parseValue () {\n if (this.char === Parser.END) {\n throw this.error(new TomlError('Key without value'))\n } else if (this.char === CHAR_QUOT) {\n return this.next(this.parseDoubleString)\n } if (this.char === CHAR_APOS) {\n return this.next(this.parseSingleString)\n } else if (this.char === CHAR_HYPHEN || this.char === CHAR_PLUS) {\n return this.goto(this.parseNumberSign)\n } else if (this.char === CHAR_i) {\n return this.next(this.parseInf)\n } else if (this.char === CHAR_n) {\n return this.next(this.parseNan)\n } else if (isDigit(this.char)) {\n return this.goto(this.parseNumberOrDateTime)\n } else if (this.char === CHAR_t || this.char === CHAR_f) {\n return this.goto(this.parseBoolean)\n } else if (this.char === CHAR_LSQB) {\n return this.call(this.parseInlineList, this.recordValue)\n } else if (this.char === CHAR_LCUB) {\n return this.call(this.parseInlineTable, this.recordValue)\n } else {\n throw this.error(new TomlError('Unexpected character, expecting string, number, datetime, boolean, inline array or inline table'))\n }\n }\n recordValue (value) {\n return this.returnNow(value)\n }\n\n parseInf () {\n if (this.char === CHAR_n) {\n return this.next(this.parseInf2)\n } else {\n throw this.error(new TomlError('Unexpected character, expected \"inf\", \"+inf\" or \"-inf\"'))\n }\n }\n parseInf2 () {\n if (this.char === CHAR_f) {\n if (this.state.buf === '-') {\n return this.return(-Infinity)\n } else {\n return this.return(Infinity)\n }\n } else {\n throw this.error(new TomlError('Unexpected character, expected \"inf\", \"+inf\" or \"-inf\"'))\n }\n }\n\n parseNan () {\n if (this.char === CHAR_a) {\n return this.next(this.parseNan2)\n } else {\n throw this.error(new TomlError('Unexpected character, expected \"nan\"'))\n }\n }\n parseNan2 () {\n if (this.char === CHAR_n) {\n return this.return(NaN)\n } else {\n throw this.error(new TomlError('Unexpected character, expected \"nan\"'))\n }\n }\n\n /* KEYS, barewords or basic, literal, or dotted */\n parseKeyword () {\n if (this.char === CHAR_QUOT) {\n return this.next(this.parseBasicString)\n } else if (this.char === CHAR_APOS) {\n return this.next(this.parseLiteralString)\n } else {\n return this.goto(this.parseBareKey)\n }\n }\n\n /* KEYS: barewords */\n parseBareKey () {\n do {\n if (this.char === Parser.END) {\n throw this.error(new TomlError('Key ended without value'))\n } else if (isAlphaNumHyphen(this.char)) {\n this.consume()\n } else if (this.state.buf.length === 0) {\n throw this.error(new TomlError('Empty bare keys are not allowed'))\n } else {\n return this.returnNow()\n }\n } while (this.nextChar())\n }\n\n /* STRINGS, single quoted (literal) */\n parseSingleString () {\n if (this.char === CHAR_APOS) {\n return this.next(this.parseLiteralMultiStringMaybe)\n } else {\n return this.goto(this.parseLiteralString)\n }\n }\n parseLiteralString () {\n do {\n if (this.char === CHAR_APOS) {\n return this.return()\n } else if (this.atEndOfLine()) {\n throw this.error(new TomlError('Unterminated string'))\n } else if (this.char === CHAR_DEL || (this.char <= CTRL_CHAR_BOUNDARY && this.char !== CTRL_I)) {\n throw this.errorControlCharInString()\n } else {\n this.consume()\n }\n } while (this.nextChar())\n }\n parseLiteralMultiStringMaybe () {\n if (this.char === CHAR_APOS) {\n return this.next(this.parseLiteralMultiString)\n } else {\n return this.returnNow()\n }\n }\n parseLiteralMultiString () {\n if (this.char === CTRL_M) {\n return null\n } else if (this.char === CTRL_J) {\n return this.next(this.parseLiteralMultiStringContent)\n } else {\n return this.goto(this.parseLiteralMultiStringContent)\n }\n }\n parseLiteralMultiStringContent () {\n do {\n if (this.char === CHAR_APOS) {\n return this.next(this.parseLiteralMultiEnd)\n } else if (this.char === Parser.END) {\n throw this.error(new TomlError('Unterminated multi-line string'))\n } else if (this.char === CHAR_DEL || (this.char <= CTRL_CHAR_BOUNDARY && this.char !== CTRL_I && this.char !== CTRL_J && this.char !== CTRL_M)) {\n throw this.errorControlCharInString()\n } else {\n this.consume()\n }\n } while (this.nextChar())\n }\n parseLiteralMultiEnd () {\n if (this.char === CHAR_APOS) {\n return this.next(this.parseLiteralMultiEnd2)\n } else {\n this.state.buf += \"'\"\n return this.goto(this.parseLiteralMultiStringContent)\n }\n }\n parseLiteralMultiEnd2 () {\n if (this.char === CHAR_APOS) {\n return this.return()\n } else {\n this.state.buf += \"''\"\n return this.goto(this.parseLiteralMultiStringContent)\n }\n }\n\n /* STRINGS double quoted */\n parseDoubleString () {\n if (this.char === CHAR_QUOT) {\n return this.next(this.parseMultiStringMaybe)\n } else {\n return this.goto(this.parseBasicString)\n }\n }\n parseBasicString () {\n do {\n if (this.char === CHAR_BSOL) {\n return this.call(this.parseEscape, this.recordEscapeReplacement)\n } else if (this.char === CHAR_QUOT) {\n return this.return()\n } else if (this.atEndOfLine()) {\n throw this.error(new TomlError('Unterminated string'))\n } else if (this.char === CHAR_DEL || (this.char <= CTRL_CHAR_BOUNDARY && this.char !== CTRL_I)) {\n throw this.errorControlCharInString()\n } else {\n this.consume()\n }\n } while (this.nextChar())\n }\n recordEscapeReplacement (replacement) {\n this.state.buf += replacement\n return this.goto(this.parseBasicString)\n }\n parseMultiStringMaybe () {\n if (this.char === CHAR_QUOT) {\n return this.next(this.parseMultiString)\n } else {\n return this.returnNow()\n }\n }\n parseMultiString () {\n if (this.char === CTRL_M) {\n return null\n } else if (this.char === CTRL_J) {\n return this.next(this.parseMultiStringContent)\n } else {\n return this.goto(this.parseMultiStringContent)\n }\n }\n parseMultiStringContent () {\n do {\n if (this.char === CHAR_BSOL) {\n return this.call(this.parseMultiEscape, this.recordMultiEscapeReplacement)\n } else if (this.char === CHAR_QUOT) {\n return this.next(this.parseMultiEnd)\n } else if (this.char === Parser.END) {\n throw this.error(new TomlError('Unterminated multi-line string'))\n } else if (this.char === CHAR_DEL || (this.char <= CTRL_CHAR_BOUNDARY && this.char !== CTRL_I && this.char !== CTRL_J && this.char !== CTRL_M)) {\n throw this.errorControlCharInString()\n } else {\n this.consume()\n }\n } while (this.nextChar())\n }\n errorControlCharInString () {\n let displayCode = '\\\\u00'\n if (this.char < 16) {\n displayCode += '0'\n }\n displayCode += this.char.toString(16)\n\n return this.error(new TomlError(`Control characters (codes < 0x1f and 0x7f) are not allowed in strings, use ${displayCode} instead`))\n }\n recordMultiEscapeReplacement (replacement) {\n this.state.buf += replacement\n return this.goto(this.parseMultiStringContent)\n }\n parseMultiEnd () {\n if (this.char === CHAR_QUOT) {\n return this.next(this.parseMultiEnd2)\n } else {\n this.state.buf += '\"'\n return this.goto(this.parseMultiStringContent)\n }\n }\n parseMultiEnd2 () {\n if (this.char === CHAR_QUOT) {\n return this.return()\n } else {\n this.state.buf += '\"\"'\n return this.goto(this.parseMultiStringContent)\n }\n }\n parseMultiEscape () {\n if (this.char === CTRL_M || this.char === CTRL_J) {\n return this.next(this.parseMultiTrim)\n } else if (this.char === CHAR_SP || this.char === CTRL_I) {\n return this.next(this.parsePreMultiTrim)\n } else {\n return this.goto(this.parseEscape)\n }\n }\n parsePreMultiTrim () {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else if (this.char === CTRL_M || this.char === CTRL_J) {\n return this.next(this.parseMultiTrim)\n } else {\n throw this.error(new TomlError(\"Can't escape whitespace\"))\n }\n }\n parseMultiTrim () {\n // explicitly whitespace here, END should follow the same path as chars\n if (this.char === CTRL_J || this.char === CHAR_SP || this.char === CTRL_I || this.char === CTRL_M) {\n return null\n } else {\n return this.returnNow()\n }\n }\n parseEscape () {\n if (this.char in escapes) {\n return this.return(escapes[this.char])\n } else if (this.char === CHAR_u) {\n return this.call(this.parseSmallUnicode, this.parseUnicodeReturn)\n } else if (this.char === CHAR_U) {\n return this.call(this.parseLargeUnicode, this.parseUnicodeReturn)\n } else {\n throw this.error(new TomlError('Unknown escape character: ' + this.char))\n }\n }\n parseUnicodeReturn (char) {\n try {\n const codePoint = parseInt(char, 16)\n if (codePoint >= SURROGATE_FIRST && codePoint <= SURROGATE_LAST) {\n throw this.error(new TomlError('Invalid unicode, character in range 0xD800 - 0xDFFF is reserved'))\n }\n return this.returnNow(String.fromCodePoint(codePoint))\n } catch (err) {\n throw this.error(TomlError.wrap(err))\n }\n }\n parseSmallUnicode () {\n if (!isHexit(this.char)) {\n throw this.error(new TomlError('Invalid character in unicode sequence, expected hex'))\n } else {\n this.consume()\n if (this.state.buf.length >= 4) return this.return()\n }\n }\n parseLargeUnicode () {\n if (!isHexit(this.char)) {\n throw this.error(new TomlError('Invalid character in unicode sequence, expected hex'))\n } else {\n this.consume()\n if (this.state.buf.length >= 8) return this.return()\n }\n }\n\n /* NUMBERS */\n parseNumberSign () {\n this.consume()\n return this.next(this.parseMaybeSignedInfOrNan)\n }\n parseMaybeSignedInfOrNan () {\n if (this.char === CHAR_i) {\n return this.next(this.parseInf)\n } else if (this.char === CHAR_n) {\n return this.next(this.parseNan)\n } else {\n return this.callNow(this.parseNoUnder, this.parseNumberIntegerStart)\n }\n }\n parseNumberIntegerStart () {\n if (this.char === CHAR_0) {\n this.consume()\n return this.next(this.parseNumberIntegerExponentOrDecimal)\n } else {\n return this.goto(this.parseNumberInteger)\n }\n }\n parseNumberIntegerExponentOrDecimal () {\n if (this.char === CHAR_PERIOD) {\n this.consume()\n return this.call(this.parseNoUnder, this.parseNumberFloat)\n } else if (this.char === CHAR_E || this.char === CHAR_e) {\n this.consume()\n return this.next(this.parseNumberExponentSign)\n } else {\n return this.returnNow(Integer(this.state.buf))\n }\n }\n parseNumberInteger () {\n if (isDigit(this.char)) {\n this.consume()\n } else if (this.char === CHAR_LOWBAR) {\n return this.call(this.parseNoUnder)\n } else if (this.char === CHAR_E || this.char === CHAR_e) {\n this.consume()\n return this.next(this.parseNumberExponentSign)\n } else if (this.char === CHAR_PERIOD) {\n this.consume()\n return this.call(this.parseNoUnder, this.parseNumberFloat)\n } else {\n const result = Integer(this.state.buf)\n /* istanbul ignore if */\n if (result.isNaN()) {\n throw this.error(new TomlError('Invalid number'))\n } else {\n return this.returnNow(result)\n }\n }\n }\n parseNoUnder () {\n if (this.char === CHAR_LOWBAR || this.char === CHAR_PERIOD || this.char === CHAR_E || this.char === CHAR_e) {\n throw this.error(new TomlError('Unexpected character, expected digit'))\n } else if (this.atEndOfWord()) {\n throw this.error(new TomlError('Incomplete number'))\n }\n return this.returnNow()\n }\n parseNoUnderHexOctBinLiteral () {\n if (this.char === CHAR_LOWBAR || this.char === CHAR_PERIOD) {\n throw this.error(new TomlError('Unexpected character, expected digit'))\n } else if (this.atEndOfWord()) {\n throw this.error(new TomlError('Incomplete number'))\n }\n return this.returnNow()\n }\n parseNumberFloat () {\n if (this.char === CHAR_LOWBAR) {\n return this.call(this.parseNoUnder, this.parseNumberFloat)\n } else if (isDigit(this.char)) {\n this.consume()\n } else if (this.char === CHAR_E || this.char === CHAR_e) {\n this.consume()\n return this.next(this.parseNumberExponentSign)\n } else {\n return this.returnNow(Float(this.state.buf))\n }\n }\n parseNumberExponentSign () {\n if (isDigit(this.char)) {\n return this.goto(this.parseNumberExponent)\n } else if (this.char === CHAR_HYPHEN || this.char === CHAR_PLUS) {\n this.consume()\n this.call(this.parseNoUnder, this.parseNumberExponent)\n } else {\n throw this.error(new TomlError('Unexpected character, expected -, + or digit'))\n }\n }\n parseNumberExponent () {\n if (isDigit(this.char)) {\n this.consume()\n } else if (this.char === CHAR_LOWBAR) {\n return this.call(this.parseNoUnder)\n } else {\n return this.returnNow(Float(this.state.buf))\n }\n }\n\n /* NUMBERS or DATETIMES */\n parseNumberOrDateTime () {\n if (this.char === CHAR_0) {\n this.consume()\n return this.next(this.parseNumberBaseOrDateTime)\n } else {\n return this.goto(this.parseNumberOrDateTimeOnly)\n }\n }\n parseNumberOrDateTimeOnly () {\n // note, if two zeros are in a row then it MUST be a date\n if (this.char === CHAR_LOWBAR) {\n return this.call(this.parseNoUnder, this.parseNumberInteger)\n } else if (isDigit(this.char)) {\n this.consume()\n if (this.state.buf.length > 4) this.next(this.parseNumberInteger)\n } else if (this.char === CHAR_E || this.char === CHAR_e) {\n this.consume()\n return this.next(this.parseNumberExponentSign)\n } else if (this.char === CHAR_PERIOD) {\n this.consume()\n return this.call(this.parseNoUnder, this.parseNumberFloat)\n } else if (this.char === CHAR_HYPHEN) {\n return this.goto(this.parseDateTime)\n } else if (this.char === CHAR_COLON) {\n return this.goto(this.parseOnlyTimeHour)\n } else {\n return this.returnNow(Integer(this.state.buf))\n }\n }\n parseDateTimeOnly () {\n if (this.state.buf.length < 4) {\n if (isDigit(this.char)) {\n return this.consume()\n } else if (this.char === CHAR_COLON) {\n return this.goto(this.parseOnlyTimeHour)\n } else {\n throw this.error(new TomlError('Expected digit while parsing year part of a date'))\n }\n } else {\n if (this.char === CHAR_HYPHEN) {\n return this.goto(this.parseDateTime)\n } else {\n throw this.error(new TomlError('Expected hyphen (-) while parsing year part of date'))\n }\n }\n }\n parseNumberBaseOrDateTime () {\n if (this.char === CHAR_b) {\n this.consume()\n return this.call(this.parseNoUnderHexOctBinLiteral, this.parseIntegerBin)\n } else if (this.char === CHAR_o) {\n this.consume()\n return this.call(this.parseNoUnderHexOctBinLiteral, this.parseIntegerOct)\n } else if (this.char === CHAR_x) {\n this.consume()\n return this.call(this.parseNoUnderHexOctBinLiteral, this.parseIntegerHex)\n } else if (this.char === CHAR_PERIOD) {\n return this.goto(this.parseNumberInteger)\n } else if (isDigit(this.char)) {\n return this.goto(this.parseDateTimeOnly)\n } else {\n return this.returnNow(Integer(this.state.buf))\n }\n }\n parseIntegerHex () {\n if (isHexit(this.char)) {\n this.consume()\n } else if (this.char === CHAR_LOWBAR) {\n return this.call(this.parseNoUnderHexOctBinLiteral)\n } else {\n const result = Integer(this.state.buf)\n /* istanbul ignore if */\n if (result.isNaN()) {\n throw this.error(new TomlError('Invalid number'))\n } else {\n return this.returnNow(result)\n }\n }\n }\n parseIntegerOct () {\n if (isOctit(this.char)) {\n this.consume()\n } else if (this.char === CHAR_LOWBAR) {\n return this.call(this.parseNoUnderHexOctBinLiteral)\n } else {\n const result = Integer(this.state.buf)\n /* istanbul ignore if */\n if (result.isNaN()) {\n throw this.error(new TomlError('Invalid number'))\n } else {\n return this.returnNow(result)\n }\n }\n }\n parseIntegerBin () {\n if (isBit(this.char)) {\n this.consume()\n } else if (this.char === CHAR_LOWBAR) {\n return this.call(this.parseNoUnderHexOctBinLiteral)\n } else {\n const result = Integer(this.state.buf)\n /* istanbul ignore if */\n if (result.isNaN()) {\n throw this.error(new TomlError('Invalid number'))\n } else {\n return this.returnNow(result)\n }\n }\n }\n\n /* DATETIME */\n parseDateTime () {\n // we enter here having just consumed the year and about to consume the hyphen\n if (this.state.buf.length < 4) {\n throw this.error(new TomlError('Years less than 1000 must be zero padded to four characters'))\n }\n this.state.result = this.state.buf\n this.state.buf = ''\n return this.next(this.parseDateMonth)\n }\n parseDateMonth () {\n if (this.char === CHAR_HYPHEN) {\n if (this.state.buf.length < 2) {\n throw this.error(new TomlError('Months less than 10 must be zero padded to two characters'))\n }\n this.state.result += '-' + this.state.buf\n this.state.buf = ''\n return this.next(this.parseDateDay)\n } else if (isDigit(this.char)) {\n this.consume()\n } else {\n throw this.error(new TomlError('Incomplete datetime'))\n }\n }\n parseDateDay () {\n if (this.char === CHAR_T || this.char === CHAR_SP) {\n if (this.state.buf.length < 2) {\n throw this.error(new TomlError('Days less than 10 must be zero padded to two characters'))\n }\n this.state.result += '-' + this.state.buf\n this.state.buf = ''\n return this.next(this.parseStartTimeHour)\n } else if (this.atEndOfWord()) {\n return this.returnNow(createDate(this.state.result + '-' + this.state.buf))\n } else if (isDigit(this.char)) {\n this.consume()\n } else {\n throw this.error(new TomlError('Incomplete datetime'))\n }\n }\n parseStartTimeHour () {\n if (this.atEndOfWord()) {\n return this.returnNow(createDate(this.state.result))\n } else {\n return this.goto(this.parseTimeHour)\n }\n }\n parseTimeHour () {\n if (this.char === CHAR_COLON) {\n if (this.state.buf.length < 2) {\n throw this.error(new TomlError('Hours less than 10 must be zero padded to two characters'))\n }\n this.state.result += 'T' + this.state.buf\n this.state.buf = ''\n return this.next(this.parseTimeMin)\n } else if (isDigit(this.char)) {\n this.consume()\n } else {\n throw this.error(new TomlError('Incomplete datetime'))\n }\n }\n parseTimeMin () {\n if (this.state.buf.length < 2 && isDigit(this.char)) {\n this.consume()\n } else if (this.state.buf.length === 2 && this.char === CHAR_COLON) {\n this.state.result += ':' + this.state.buf\n this.state.buf = ''\n return this.next(this.parseTimeSec)\n } else {\n throw this.error(new TomlError('Incomplete datetime'))\n }\n }\n parseTimeSec () {\n if (isDigit(this.char)) {\n this.consume()\n if (this.state.buf.length === 2) {\n this.state.result += ':' + this.state.buf\n this.state.buf = ''\n return this.next(this.parseTimeZoneOrFraction)\n }\n } else {\n throw this.error(new TomlError('Incomplete datetime'))\n }\n }\n\n parseOnlyTimeHour () {\n /* istanbul ignore else */\n if (this.char === CHAR_COLON) {\n if (this.state.buf.length < 2) {\n throw this.error(new TomlError('Hours less than 10 must be zero padded to two characters'))\n }\n this.state.result = this.state.buf\n this.state.buf = ''\n return this.next(this.parseOnlyTimeMin)\n } else {\n throw this.error(new TomlError('Incomplete time'))\n }\n }\n parseOnlyTimeMin () {\n if (this.state.buf.length < 2 && isDigit(this.char)) {\n this.consume()\n } else if (this.state.buf.length === 2 && this.char === CHAR_COLON) {\n this.state.result += ':' + this.state.buf\n this.state.buf = ''\n return this.next(this.parseOnlyTimeSec)\n } else {\n throw this.error(new TomlError('Incomplete time'))\n }\n }\n parseOnlyTimeSec () {\n if (isDigit(this.char)) {\n this.consume()\n if (this.state.buf.length === 2) {\n return this.next(this.parseOnlyTimeFractionMaybe)\n }\n } else {\n throw this.error(new TomlError('Incomplete time'))\n }\n }\n parseOnlyTimeFractionMaybe () {\n this.state.result += ':' + this.state.buf\n if (this.char === CHAR_PERIOD) {\n this.state.buf = ''\n this.next(this.parseOnlyTimeFraction)\n } else {\n return this.return(createTime(this.state.result))\n }\n }\n parseOnlyTimeFraction () {\n if (isDigit(this.char)) {\n this.consume()\n } else if (this.atEndOfWord()) {\n if (this.state.buf.length === 0) throw this.error(new TomlError('Expected digit in milliseconds'))\n return this.returnNow(createTime(this.state.result + '.' + this.state.buf))\n } else {\n throw this.error(new TomlError('Unexpected character in datetime, expected period (.), minus (-), plus (+) or Z'))\n }\n }\n\n parseTimeZoneOrFraction () {\n if (this.char === CHAR_PERIOD) {\n this.consume()\n this.next(this.parseDateTimeFraction)\n } else if (this.char === CHAR_HYPHEN || this.char === CHAR_PLUS) {\n this.consume()\n this.next(this.parseTimeZoneHour)\n } else if (this.char === CHAR_Z) {\n this.consume()\n return this.return(createDateTime(this.state.result + this.state.buf))\n } else if (this.atEndOfWord()) {\n return this.returnNow(createDateTimeFloat(this.state.result + this.state.buf))\n } else {\n throw this.error(new TomlError('Unexpected character in datetime, expected period (.), minus (-), plus (+) or Z'))\n }\n }\n parseDateTimeFraction () {\n if (isDigit(this.char)) {\n this.consume()\n } else if (this.state.buf.length === 1) {\n throw this.error(new TomlError('Expected digit in milliseconds'))\n } else if (this.char === CHAR_HYPHEN || this.char === CHAR_PLUS) {\n this.consume()\n this.next(this.parseTimeZoneHour)\n } else if (this.char === CHAR_Z) {\n this.consume()\n return this.return(createDateTime(this.state.result + this.state.buf))\n } else if (this.atEndOfWord()) {\n return this.returnNow(createDateTimeFloat(this.state.result + this.state.buf))\n } else {\n throw this.error(new TomlError('Unexpected character in datetime, expected period (.), minus (-), plus (+) or Z'))\n }\n }\n parseTimeZoneHour () {\n if (isDigit(this.char)) {\n this.consume()\n // FIXME: No more regexps\n if (/\\d\\d$/.test(this.state.buf)) return this.next(this.parseTimeZoneSep)\n } else {\n throw this.error(new TomlError('Unexpected character in datetime, expected digit'))\n }\n }\n parseTimeZoneSep () {\n if (this.char === CHAR_COLON) {\n this.consume()\n this.next(this.parseTimeZoneMin)\n } else {\n throw this.error(new TomlError('Unexpected character in datetime, expected colon'))\n }\n }\n parseTimeZoneMin () {\n if (isDigit(this.char)) {\n this.consume()\n if (/\\d\\d$/.test(this.state.buf)) return this.return(createDateTime(this.state.result + this.state.buf))\n } else {\n throw this.error(new TomlError('Unexpected character in datetime, expected digit'))\n }\n }\n\n /* BOOLEAN */\n parseBoolean () {\n /* istanbul ignore else */\n if (this.char === CHAR_t) {\n this.consume()\n return this.next(this.parseTrue_r)\n } else if (this.char === CHAR_f) {\n this.consume()\n return this.next(this.parseFalse_a)\n }\n }\n parseTrue_r () {\n if (this.char === CHAR_r) {\n this.consume()\n return this.next(this.parseTrue_u)\n } else {\n throw this.error(new TomlError('Invalid boolean, expected true or false'))\n }\n }\n parseTrue_u () {\n if (this.char === CHAR_u) {\n this.consume()\n return this.next(this.parseTrue_e)\n } else {\n throw this.error(new TomlError('Invalid boolean, expected true or false'))\n }\n }\n parseTrue_e () {\n if (this.char === CHAR_e) {\n return this.return(true)\n } else {\n throw this.error(new TomlError('Invalid boolean, expected true or false'))\n }\n }\n\n parseFalse_a () {\n if (this.char === CHAR_a) {\n this.consume()\n return this.next(this.parseFalse_l)\n } else {\n throw this.error(new TomlError('Invalid boolean, expected true or false'))\n }\n }\n\n parseFalse_l () {\n if (this.char === CHAR_l) {\n this.consume()\n return this.next(this.parseFalse_s)\n } else {\n throw this.error(new TomlError('Invalid boolean, expected true or false'))\n }\n }\n\n parseFalse_s () {\n if (this.char === CHAR_s) {\n this.consume()\n return this.next(this.parseFalse_e)\n } else {\n throw this.error(new TomlError('Invalid boolean, expected true or false'))\n }\n }\n\n parseFalse_e () {\n if (this.char === CHAR_e) {\n return this.return(false)\n } else {\n throw this.error(new TomlError('Invalid boolean, expected true or false'))\n }\n }\n\n /* INLINE LISTS */\n parseInlineList () {\n if (this.char === CHAR_SP || this.char === CTRL_I || this.char === CTRL_M || this.char === CTRL_J) {\n return null\n } else if (this.char === Parser.END) {\n throw this.error(new TomlError('Unterminated inline array'))\n } else if (this.char === CHAR_NUM) {\n return this.call(this.parseComment)\n } else if (this.char === CHAR_RSQB) {\n return this.return(this.state.resultArr || InlineList())\n } else {\n return this.callNow(this.parseValue, this.recordInlineListValue)\n }\n }\n recordInlineListValue (value) {\n if (this.state.resultArr) {\n const listType = this.state.resultArr[_contentType]\n const valueType = tomlType(value)\n if (listType !== valueType) {\n throw this.error(new TomlError(`Inline lists must be a single type, not a mix of ${listType} and ${valueType}`))\n }\n } else {\n this.state.resultArr = InlineList(tomlType(value))\n }\n if (isFloat(value) || isInteger(value)) {\n // unbox now that we've verified they're ok\n this.state.resultArr.push(value.valueOf())\n } else {\n this.state.resultArr.push(value)\n }\n return this.goto(this.parseInlineListNext)\n }\n parseInlineListNext () {\n if (this.char === CHAR_SP || this.char === CTRL_I || this.char === CTRL_M || this.char === CTRL_J) {\n return null\n } else if (this.char === CHAR_NUM) {\n return this.call(this.parseComment)\n } else if (this.char === CHAR_COMMA) {\n return this.next(this.parseInlineList)\n } else if (this.char === CHAR_RSQB) {\n return this.goto(this.parseInlineList)\n } else {\n throw this.error(new TomlError('Invalid character, expected whitespace, comma (,) or close bracket (])'))\n }\n }\n\n /* INLINE TABLE */\n parseInlineTable () {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else if (this.char === Parser.END || this.char === CHAR_NUM || this.char === CTRL_J || this.char === CTRL_M) {\n throw this.error(new TomlError('Unterminated inline array'))\n } else if (this.char === CHAR_RCUB) {\n return this.return(this.state.resultTable || InlineTable())\n } else {\n if (!this.state.resultTable) this.state.resultTable = InlineTable()\n return this.callNow(this.parseAssign, this.recordInlineTableValue)\n }\n }\n recordInlineTableValue (kv) {\n let target = this.state.resultTable\n let finalKey = kv.key.pop()\n for (let kw of kv.key) {\n if (hasKey(target, kw) && (!isTable(target[kw]) || target[kw][_declared])) {\n throw this.error(new TomlError(\"Can't redefine existing key\"))\n }\n target = target[kw] = target[kw] || Table()\n }\n if (hasKey(target, finalKey)) {\n throw this.error(new TomlError(\"Can't redefine existing key\"))\n }\n if (isInteger(kv.value) || isFloat(kv.value)) {\n target[finalKey] = kv.value.valueOf()\n } else {\n target[finalKey] = kv.value\n }\n return this.goto(this.parseInlineTableNext)\n }\n parseInlineTableNext () {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else if (this.char === Parser.END || this.char === CHAR_NUM || this.char === CTRL_J || this.char === CTRL_M) {\n throw this.error(new TomlError('Unterminated inline array'))\n } else if (this.char === CHAR_COMMA) {\n return this.next(this.parseInlineTable)\n } else if (this.char === CHAR_RCUB) {\n return this.goto(this.parseInlineTable)\n } else {\n throw this.error(new TomlError('Invalid character, expected whitespace, comma (,) or close bracket (])'))\n }\n }\n }\n return TOMLParser\n}\n","'use strict'\nmodule.exports = prettyError\n\nfunction prettyError (err, buf) {\n /* istanbul ignore if */\n if (err.pos == null || err.line == null) return err\n let msg = err.message\n msg += ` at row ${err.line + 1}, col ${err.col + 1}, pos ${err.pos}:\\n`\n\n /* istanbul ignore else */\n if (buf && buf.split) {\n const lines = buf.split(/\\n/)\n const lineNumWidth = String(Math.min(lines.length, err.line + 3)).length\n let linePadding = ' '\n while (linePadding.length < lineNumWidth) linePadding += ' '\n for (let ii = Math.max(0, err.line - 1); ii < Math.min(lines.length, err.line + 2); ++ii) {\n let lineNum = String(ii + 1)\n if (lineNum.length < lineNumWidth) lineNum = ' ' + lineNum\n if (err.line === ii) {\n msg += lineNum + '> ' + lines[ii] + '\\n'\n msg += linePadding + ' '\n for (let hh = 0; hh < err.col; ++hh) {\n msg += ' '\n }\n msg += '^\\n'\n } else {\n msg += lineNum + ': ' + lines[ii] + '\\n'\n }\n }\n }\n err.message = msg + '\\n'\n return err\n}\n","'use strict'\nmodule.exports = parseString\n\nconst TOMLParser = require('./lib/toml-parser.js')\nconst prettyError = require('./parse-pretty-error.js')\n\nfunction parseString (str) {\n if (global.Buffer && global.Buffer.isBuffer(str)) {\n str = str.toString('utf8')\n }\n const parser = new TOMLParser()\n try {\n parser.parse(str)\n return parser.finish()\n } catch (err) {\n throw prettyError(err, str)\n }\n}\n","'use strict'\nmodule.exports = parseAsync\n\nconst TOMLParser = require('./lib/toml-parser.js')\nconst prettyError = require('./parse-pretty-error.js')\n\nfunction parseAsync (str, opts) {\n if (!opts) opts = {}\n const index = 0\n const blocksize = opts.blocksize || 40960\n const parser = new TOMLParser()\n return new Promise((resolve, reject) => {\n setImmediate(parseAsyncNext, index, blocksize, resolve, reject)\n })\n function parseAsyncNext (index, blocksize, resolve, reject) {\n if (index >= str.length) {\n try {\n return resolve(parser.finish())\n } catch (err) {\n return reject(prettyError(err, str))\n }\n }\n try {\n parser.parse(str.slice(index, index + blocksize))\n setImmediate(parseAsyncNext, index + blocksize, blocksize, resolve, reject)\n } catch (err) {\n reject(prettyError(err, str))\n }\n }\n}\n","'use strict'\nmodule.exports = parseStream\n\nconst stream = require('stream')\nconst TOMLParser = require('./lib/toml-parser.js')\n\nfunction parseStream (stm) {\n if (stm) {\n return parseReadable(stm)\n } else {\n return parseTransform(stm)\n }\n}\n\nfunction parseReadable (stm) {\n const parser = new TOMLParser()\n stm.setEncoding('utf8')\n return new Promise((resolve, reject) => {\n let readable\n let ended = false\n let errored = false\n function finish () {\n ended = true\n if (readable) return\n try {\n resolve(parser.finish())\n } catch (err) {\n reject(err)\n }\n }\n function error (err) {\n errored = true\n reject(err)\n }\n stm.once('end', finish)\n stm.once('error', error)\n readNext()\n\n function readNext () {\n readable = true\n let data\n while ((data = stm.read()) !== null) {\n try {\n parser.parse(data)\n } catch (err) {\n return error(err)\n }\n }\n readable = false\n /* istanbul ignore if */\n if (ended) return finish()\n /* istanbul ignore if */\n if (errored) return\n stm.once('readable', readNext)\n }\n })\n}\n\nfunction parseTransform () {\n const parser = new TOMLParser()\n return new stream.Transform({\n objectMode: true,\n transform (chunk, encoding, cb) {\n try {\n parser.parse(chunk.toString(encoding))\n } catch (err) {\n this.emit('error', err)\n }\n cb()\n },\n flush (cb) {\n try {\n this.push(parser.finish())\n } catch (err) {\n this.emit('error', err)\n }\n cb()\n }\n })\n}\n","'use strict'\nmodule.exports = require('./parse-string.js')\nmodule.exports.async = require('./parse-async.js')\nmodule.exports.stream = require('./parse-stream.js')\nmodule.exports.prettyError = require('./parse-pretty-error.js')\n","'use strict'\nmodule.exports = stringify\nmodule.exports.value = stringifyInline\n\nfunction stringify (obj) {\n if (obj === null) throw typeError('null')\n if (obj === void (0)) throw typeError('undefined')\n if (typeof obj !== 'object') throw typeError(typeof obj)\n\n if (typeof obj.toJSON === 'function') obj = obj.toJSON()\n if (obj == null) return null\n const type = tomlType(obj)\n if (type !== 'table') throw typeError(type)\n return stringifyObject('', '', obj)\n}\n\nfunction typeError (type) {\n return new Error('Can only stringify objects, not ' + type)\n}\n\nfunction arrayOneTypeError () {\n return new Error(\"Array values can't have mixed types\")\n}\n\nfunction getInlineKeys (obj) {\n return Object.keys(obj).filter(key => isInline(obj[key]))\n}\nfunction getComplexKeys (obj) {\n return Object.keys(obj).filter(key => !isInline(obj[key]))\n}\n\nfunction toJSON (obj) {\n let nobj = Array.isArray(obj) ? [] : Object.prototype.hasOwnProperty.call(obj, '__proto__') ? {['__proto__']: undefined} : {}\n for (let prop of Object.keys(obj)) {\n if (obj[prop] && typeof obj[prop].toJSON === 'function' && !('toISOString' in obj[prop])) {\n nobj[prop] = obj[prop].toJSON()\n } else {\n nobj[prop] = obj[prop]\n }\n }\n return nobj\n}\n\nfunction stringifyObject (prefix, indent, obj) {\n obj = toJSON(obj)\n var inlineKeys\n var complexKeys\n inlineKeys = getInlineKeys(obj)\n complexKeys = getComplexKeys(obj)\n var result = []\n var inlineIndent = indent || ''\n inlineKeys.forEach(key => {\n var type = tomlType(obj[key])\n if (type !== 'undefined' && type !== 'null') {\n result.push(inlineIndent + stringifyKey(key) + ' = ' + stringifyAnyInline(obj[key], true))\n }\n })\n if (result.length > 0) result.push('')\n var complexIndent = prefix && inlineKeys.length > 0 ? indent + ' ' : ''\n complexKeys.forEach(key => {\n result.push(stringifyComplex(prefix, complexIndent, key, obj[key]))\n })\n return result.join('\\n')\n}\n\nfunction isInline (value) {\n switch (tomlType(value)) {\n case 'undefined':\n case 'null':\n case 'integer':\n case 'nan':\n case 'float':\n case 'boolean':\n case 'string':\n case 'datetime':\n return true\n case 'array':\n return value.length === 0 || tomlType(value[0]) !== 'table'\n case 'table':\n return Object.keys(value).length === 0\n /* istanbul ignore next */\n default:\n return false\n }\n}\n\nfunction tomlType (value) {\n if (value === undefined) {\n return 'undefined'\n } else if (value === null) {\n return 'null'\n /* eslint-disable valid-typeof */\n } else if (typeof value === 'bigint' || (Number.isInteger(value) && !Object.is(value, -0))) {\n return 'integer'\n } else if (typeof value === 'number') {\n return 'float'\n } else if (typeof value === 'boolean') {\n return 'boolean'\n } else if (typeof value === 'string') {\n return 'string'\n } else if ('toISOString' in value) {\n return isNaN(value) ? 'undefined' : 'datetime'\n } else if (Array.isArray(value)) {\n return 'array'\n } else {\n return 'table'\n }\n}\n\nfunction stringifyKey (key) {\n var keyStr = String(key)\n if (/^[-A-Za-z0-9_]+$/.test(keyStr)) {\n return keyStr\n } else {\n return stringifyBasicString(keyStr)\n }\n}\n\nfunction stringifyBasicString (str) {\n return '\"' + escapeString(str).replace(/\"/g, '\\\\\"') + '\"'\n}\n\nfunction stringifyLiteralString (str) {\n return \"'\" + str + \"'\"\n}\n\nfunction numpad (num, str) {\n while (str.length < num) str = '0' + str\n return str\n}\n\nfunction escapeString (str) {\n return str.replace(/\\\\/g, '\\\\\\\\')\n .replace(/[\\b]/g, '\\\\b')\n .replace(/\\t/g, '\\\\t')\n .replace(/\\n/g, '\\\\n')\n .replace(/\\f/g, '\\\\f')\n .replace(/\\r/g, '\\\\r')\n /* eslint-disable no-control-regex */\n .replace(/([\\u0000-\\u001f\\u007f])/, c => '\\\\u' + numpad(4, c.codePointAt(0).toString(16)))\n /* eslint-enable no-control-regex */\n}\n\nfunction stringifyMultilineString (str) {\n let escaped = str.split(/\\n/).map(str => {\n return escapeString(str).replace(/\"(?=\"\")/g, '\\\\\"')\n }).join('\\n')\n if (escaped.slice(-1) === '\"') escaped += '\\\\\\n'\n return '\"\"\"\\n' + escaped + '\"\"\"'\n}\n\nfunction stringifyAnyInline (value, multilineOk) {\n let type = tomlType(value)\n if (type === 'string') {\n if (multilineOk && /\\n/.test(value)) {\n type = 'string-multiline'\n } else if (!/[\\b\\t\\n\\f\\r']/.test(value) && /\"/.test(value)) {\n type = 'string-literal'\n }\n }\n return stringifyInline(value, type)\n}\n\nfunction stringifyInline (value, type) {\n /* istanbul ignore if */\n if (!type) type = tomlType(value)\n switch (type) {\n case 'string-multiline':\n return stringifyMultilineString(value)\n case 'string':\n return stringifyBasicString(value)\n case 'string-literal':\n return stringifyLiteralString(value)\n case 'integer':\n return stringifyInteger(value)\n case 'float':\n return stringifyFloat(value)\n case 'boolean':\n return stringifyBoolean(value)\n case 'datetime':\n return stringifyDatetime(value)\n case 'array':\n return stringifyInlineArray(value.filter(_ => tomlType(_) !== 'null' && tomlType(_) !== 'undefined' && tomlType(_) !== 'nan'))\n case 'table':\n return stringifyInlineTable(value)\n /* istanbul ignore next */\n default:\n throw typeError(type)\n }\n}\n\nfunction stringifyInteger (value) {\n /* eslint-disable security/detect-unsafe-regex */\n return String(value).replace(/\\B(?=(\\d{3})+(?!\\d))/g, '_')\n}\n\nfunction stringifyFloat (value) {\n if (value === Infinity) {\n return 'inf'\n } else if (value === -Infinity) {\n return '-inf'\n } else if (Object.is(value, NaN)) {\n return 'nan'\n } else if (Object.is(value, -0)) {\n return '-0.0'\n }\n var chunks = String(value).split('.')\n var int = chunks[0]\n var dec = chunks[1] || 0\n return stringifyInteger(int) + '.' + dec\n}\n\nfunction stringifyBoolean (value) {\n return String(value)\n}\n\nfunction stringifyDatetime (value) {\n return value.toISOString()\n}\n\nfunction isNumber (type) {\n return type === 'float' || type === 'integer'\n}\nfunction arrayType (values) {\n var contentType = tomlType(values[0])\n if (values.every(_ => tomlType(_) === contentType)) return contentType\n // mixed integer/float, emit as floats\n if (values.every(_ => isNumber(tomlType(_)))) return 'float'\n return 'mixed'\n}\nfunction validateArray (values) {\n const type = arrayType(values)\n if (type === 'mixed') {\n throw arrayOneTypeError()\n }\n return type\n}\n\nfunction stringifyInlineArray (values) {\n values = toJSON(values)\n const type = validateArray(values)\n var result = '['\n var stringified = values.map(_ => stringifyInline(_, type))\n if (stringified.join(', ').length > 60 || /\\n/.test(stringified)) {\n result += '\\n ' + stringified.join(',\\n ') + '\\n'\n } else {\n result += ' ' + stringified.join(', ') + (stringified.length > 0 ? ' ' : '')\n }\n return result + ']'\n}\n\nfunction stringifyInlineTable (value) {\n value = toJSON(value)\n var result = []\n Object.keys(value).forEach(key => {\n result.push(stringifyKey(key) + ' = ' + stringifyAnyInline(value[key], false))\n })\n return '{ ' + result.join(', ') + (result.length > 0 ? ' ' : '') + '}'\n}\n\nfunction stringifyComplex (prefix, indent, key, value) {\n var valueType = tomlType(value)\n /* istanbul ignore else */\n if (valueType === 'array') {\n return stringifyArrayOfTables(prefix, indent, key, value)\n } else if (valueType === 'table') {\n return stringifyComplexTable(prefix, indent, key, value)\n } else {\n throw typeError(valueType)\n }\n}\n\nfunction stringifyArrayOfTables (prefix, indent, key, values) {\n values = toJSON(values)\n validateArray(values)\n var firstValueType = tomlType(values[0])\n /* istanbul ignore if */\n if (firstValueType !== 'table') throw typeError(firstValueType)\n var fullKey = prefix + stringifyKey(key)\n var result = ''\n values.forEach(table => {\n if (result.length > 0) result += '\\n'\n result += indent + '[[' + fullKey + ']]\\n'\n result += stringifyObject(fullKey + '.', indent, table)\n })\n return result\n}\n\nfunction stringifyComplexTable (prefix, indent, key, value) {\n var fullKey = prefix + stringifyKey(key)\n var result = ''\n if (getInlineKeys(value).length > 0) {\n result += indent + '[' + fullKey + ']\\n'\n }\n return result + stringifyObject(fullKey + '.', indent, value)\n}\n","'use strict'\nexports.parse = require('./parse.js')\nexports.stringify = require('./stringify.js')\n","import { appendFileSync, existsSync, readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { PATHS, ensureRuntimeDirs } from './paths.js';\nimport { findRunningDaemon, removePidFile, writePidFile } from './pidfile.js';\nimport { IpcServer } from './ipc-server.js';\nimport { ModuleHost } from './module-host.js';\nimport { AlertDispatcher } from './alerts/index.js';\nimport { RunsWorker } from './workers/runs-worker.js';\nimport { RuleEngine } from './rules/engine.js';\nimport { loadAllRules } from './rules/loader.js';\nimport { detectFirewallAdapter } from './firewall/adapters.js';\nimport { RemediationManager } from './firewall/remediation.js';\nimport { bus } from './event-bus.js';\nimport { initStateDB, closeDB } from '../core/state.js';\nimport { loadConfig } from '../core/config.js';\nimport { captureException, flushTelemetry, initTelemetry } from '../core/telemetry.js';\nimport type { ThreatEvent } from '../types/events.js';\n\nfunction readVersion(): string {\n try {\n const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf-8'));\n return pkg.version || '0.0.0';\n } catch {\n return '0.0.0';\n }\n}\n\nfunction logLine(line: string): void {\n try {\n appendFileSync(PATHS.logFile, `${new Date().toISOString()} ${line}\\n`);\n } catch {\n // best-effort\n }\n}\n\nexport async function runDaemon(): Promise<void> {\n if (findRunningDaemon()) {\n console.error(`threatcrushd already running (pid file at ${PATHS.pidFile}).`);\n process.exit(1);\n }\n\n ensureRuntimeDirs();\n writePidFile();\n\n await initTelemetry('daemon');\n process.on('uncaughtException', (err) => {\n logLine(`[daemon] uncaughtException: ${err.message}`);\n captureException(err);\n });\n process.on('unhandledRejection', (reason) => {\n logLine(`[daemon] unhandledRejection: ${String(reason)}`);\n captureException(reason);\n });\n\n const version = readVersion();\n logLine(`[daemon] starting threatcrushd v${version} mode=${PATHS.mode}`);\n\n try {\n initStateDB(PATHS.stateDb);\n } catch (err) {\n logLine(`[daemon] state db unavailable: ${(err as Error).message}`);\n }\n\n const config = loadConfig(existsSync(PATHS.configFile) ? PATHS.configFile : undefined);\n\n bus.on('event', (event: ThreatEvent) => {\n logLine(`[event] ${event.severity} ${event.module} ${event.message}`);\n });\n\n const moduleHost = new ModuleHost(bus);\n await moduleHost.start();\n\n // Detection rule engine (PRD 01)\n const ruleEngine = new RuleEngine((detection) => {\n const event: ThreatEvent = {\n timestamp: new Date(),\n module: 'rule-engine',\n category: (detection.raw_metadata?.category as any) || 'system',\n severity: detection.severity,\n message: `[DETECTION] ${detection.title}`,\n source_ip: detection.source_ip,\n details: {\n rule_id: detection.rule_id,\n username: detection.username,\n ...detection.raw_metadata,\n },\n };\n bus.publish(event);\n });\n ruleEngine.loadRules(loadAllRules());\n bus.on('event', (event) => {\n if (event.module !== 'rule-engine') ruleEngine.evaluate(event);\n });\n logLine(`[daemon] rule engine loaded ${ruleEngine.getRules().length} rules`);\n setInterval(() => ruleEngine.cleanup(), 300_000);\n\n // Firewall auto-remediation (PRD 02)\n const firewallAdapter = detectFirewallAdapter();\n const remediation = new RemediationManager(firewallAdapter, bus, (config as any).remediation);\n bus.on('event', (event) => {\n if (event.module !== 'firewall-rules') {\n void remediation.handleDetection(event);\n }\n });\n logLine(`[daemon] firewall remediation active (backend=${firewallAdapter.name}, dry_run=${(config as any).remediation?.dry_run ?? true})`);\n\n new AlertDispatcher(bus, config);\n\n const runsWorker = new RunsWorker(bus);\n try {\n await runsWorker.start();\n } catch (err) {\n logLine(`[daemon] runs-worker failed to start: ${(err as Error).message}`);\n }\n\n const ipc = new IpcServer(version, moduleHost);\n await ipc.start();\n logLine(`[daemon] ipc listening on ${PATHS.socket}`);\n\n const shutdown = async (signal: string) => {\n logLine(`[daemon] received ${signal}, shutting down`);\n try { remediation.stop(); } catch {}\n try { runsWorker.stop(); } catch {}\n try { await moduleHost.stop(); } catch {}\n try { await ipc.stop(); } catch {}\n try { closeDB(); } catch {}\n try { await flushTelemetry(); } catch {}\n removePidFile();\n process.exit(0);\n };\n\n process.on('SIGINT', () => { void shutdown('SIGINT'); });\n process.on('SIGTERM', () => { void shutdown('SIGTERM'); });\n process.on('SIGHUP', () => { void shutdown('SIGHUP'); });\n\n // keep-alive\n setInterval(() => {}, 1 << 30);\n}\n\n// Note: auto-boot is handled by `src/daemon-entry.ts` so that importing this\n// module from the CLI bundle never accidentally starts a daemon.\n","import { existsSync, mkdirSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\n\nfunction isRoot(): boolean {\n return (\n process.platform === 'linux' &&\n typeof process.getuid === 'function' &&\n process.getuid() === 0\n );\n}\n\nconst userBase = join(homedir(), '.threatcrush');\n\nconst SYSTEM_PATHS = {\n mode: 'system' as const,\n configDir: '/etc/threatcrush',\n configFile: '/etc/threatcrush/threatcrushd.conf',\n confD: '/etc/threatcrush/threatcrushd.conf.d',\n moduleDir: '/etc/threatcrush/modules',\n logDir: '/var/log/threatcrush',\n logFile: '/var/log/threatcrush/threatcrushd.log',\n stateDir: '/var/lib/threatcrush',\n stateDb: '/var/lib/threatcrush/state.db',\n runDir: '/var/run/threatcrush',\n pidFile: '/var/run/threatcrush/threatcrushd.pid',\n socket: '/var/run/threatcrush/threatcrushd.sock',\n};\n\nconst USER_PATHS = {\n mode: 'user' as const,\n configDir: userBase,\n configFile: join(userBase, 'threatcrushd.conf'),\n confD: join(userBase, 'threatcrushd.conf.d'),\n moduleDir: join(userBase, 'modules'),\n logDir: join(userBase, 'logs'),\n logFile: join(userBase, 'logs', 'threatcrushd.log'),\n stateDir: join(userBase, 'state'),\n stateDb: join(userBase, 'state', 'state.db'),\n runDir: join(userBase, 'run'),\n pidFile: join(userBase, 'run', 'threatcrushd.pid'),\n socket: join(userBase, 'run', 'threatcrushd.sock'),\n};\n\n// System paths (config/log/state/run under /etc and /var) are root-owned, so we\n// only run in system mode when actually root. Choosing system mode because\n// /etc/threatcrush happened to be writable, or because a stale system socket\n// existed, made `threatcrush start` as a normal user crash with EACCES trying\n// to open /var/log/threatcrush/threatcrushd.log. A non-root user always runs a\n// self-contained daemon under ~/.threatcrush instead.\nexport const PATHS = isRoot() ? SYSTEM_PATHS : USER_PATHS;\n\n// A non-root client command (status/stop/logs/tail) should still be able to\n// reach a daemon that root started. Prefer this process's own socket, but fall\n// back to the other mode's socket when only that one is present.\nexport function resolveClientSocket(): string {\n if (existsSync(PATHS.socket)) return PATHS.socket;\n const other = PATHS.mode === 'system' ? USER_PATHS.socket : SYSTEM_PATHS.socket;\n if (existsSync(other)) return other;\n return PATHS.socket;\n}\n\nexport function ensureRuntimeDirs(): void {\n for (const dir of [PATHS.configDir, PATHS.confD, PATHS.moduleDir, PATHS.logDir, PATHS.stateDir, PATHS.runDir]) {\n try {\n mkdirSync(dir, { recursive: true });\n } catch {\n // best-effort\n }\n }\n}\n","import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';\nimport { PATHS, ensureRuntimeDirs } from './paths.js';\n\nexport function writePidFile(): void {\n ensureRuntimeDirs();\n writeFileSync(PATHS.pidFile, String(process.pid), 'utf-8');\n}\n\nexport function readPidFile(): number | null {\n if (!existsSync(PATHS.pidFile)) return null;\n const raw = readFileSync(PATHS.pidFile, 'utf-8').trim();\n const pid = parseInt(raw, 10);\n return Number.isFinite(pid) ? pid : null;\n}\n\nexport function removePidFile(): void {\n try {\n if (existsSync(PATHS.pidFile)) unlinkSync(PATHS.pidFile);\n } catch {\n // ignore\n }\n}\n\nexport function isProcessAlive(pid: number): boolean {\n try {\n process.kill(pid, 0);\n return true;\n } catch (err) {\n // EPERM means the process exists but the current user can't signal it\n // (common: a non-root client checking on a system-mode daemon running as\n // root). Only ESRCH means the process is actually gone.\n const code = (err as NodeJS.ErrnoException).code;\n return code === 'EPERM';\n }\n}\n\nexport function findRunningDaemon(): number | null {\n const pid = readPidFile();\n if (pid && isProcessAlive(pid)) return pid;\n if (pid) removePidFile();\n return null;\n}\n","import { createServer, Server, Socket } from 'node:net';\nimport { existsSync, unlinkSync } from 'node:fs';\nimport type { ThreatEvent } from '../types/events.js';\nimport { PATHS } from './paths.js';\nimport { issueControlToken, tokensMatch } from './control-token.js';\nimport { bus } from './event-bus.js';\nimport { getRecentEvents, getTopSources, getEventCount, getThreatCount } from '../core/state.js';\nimport type {\n IpcRequest,\n IpcResponse,\n IpcPush,\n DaemonStatusReply,\n} from './ipc-protocol.js';\nimport type { ModuleHost } from './module-host.js';\n\ninterface ClientState {\n id: number;\n socket: Socket;\n buffer: string;\n subscriptions: Set<'event' | 'module'>;\n}\n\nexport class IpcServer {\n private server: Server | null = null;\n private clients = new Map<number, ClientState>();\n private nextClientId = 1;\n private startedAt = new Date();\n private counters = { events: 0, threats: 0, alerts: 0 };\n private controlToken = '';\n\n constructor(\n private version: string,\n private moduleHost: ModuleHost,\n ) {\n bus.on('event', (event: ThreatEvent) => {\n this.counters.events++;\n if (event.severity === 'medium' || event.severity === 'high' || event.severity === 'critical') {\n this.counters.threats++;\n }\n this.broadcast({ push: 'event', payload: event }, 'event');\n });\n bus.on('alert', () => {\n this.counters.alerts++;\n });\n bus.on('module', (info) => {\n this.broadcast({ push: 'module', payload: info }, 'module');\n });\n }\n\n async start(): Promise<void> {\n // Rotated per start, so a token leaked from a previous run is useless.\n this.controlToken = issueControlToken();\n\n if (existsSync(PATHS.socket)) {\n try { unlinkSync(PATHS.socket); } catch {}\n }\n return new Promise((resolve, reject) => {\n this.server = createServer((sock) => this.handleClient(sock));\n this.server.on('error', reject);\n this.server.listen(PATHS.socket, () => {\n const nodeFs = require('node:fs') as typeof import('node:fs');\n try { nodeFs.chmodSync(PATHS.socket, 0o660); } catch {}\n // When the daemon runs as root (system mode under systemd), regroup\n // the socket to `adm` so users in that group can talk to the daemon\n // without sudo. We use this group because it's the same one that\n // already governs read access to /var/log/{auth,syslog,nginx} — the\n // intent is \"people who can already inspect logs can talk to the\n // agent that watches them.\"\n const isRoot = process.platform === 'linux'\n && typeof process.getuid === 'function'\n && process.getuid() === 0;\n if (isRoot) {\n try {\n const { gid } = nodeFs.statSync('/var/log/auth.log');\n nodeFs.chownSync(PATHS.socket, 0, gid);\n } catch {\n // adm group not present, or /var/log/auth.log missing — leave as root:root\n }\n }\n resolve();\n });\n });\n }\n\n async stop(): Promise<void> {\n for (const c of this.clients.values()) {\n try { c.socket.destroy(); } catch {}\n }\n this.clients.clear();\n return new Promise((resolve) => {\n if (!this.server) {\n try { if (existsSync(PATHS.socket)) unlinkSync(PATHS.socket); } catch {}\n return resolve();\n }\n this.server.close(() => {\n try { if (existsSync(PATHS.socket)) unlinkSync(PATHS.socket); } catch {}\n resolve();\n });\n });\n }\n\n private handleClient(socket: Socket): void {\n const id = this.nextClientId++;\n const state: ClientState = { id, socket, buffer: '', subscriptions: new Set() };\n this.clients.set(id, state);\n\n socket.setEncoding('utf-8');\n socket.on('data', (chunk) => {\n state.buffer += chunk.toString();\n let idx;\n while ((idx = state.buffer.indexOf('\\n')) >= 0) {\n const line = state.buffer.slice(0, idx);\n state.buffer = state.buffer.slice(idx + 1);\n if (!line.trim()) continue;\n this.handleLine(state, line).catch((err) => {\n this.send(state, { id: 0, ok: false, error: String(err?.message || err) });\n });\n }\n });\n\n socket.on('close', () => { this.clients.delete(id); });\n socket.on('error', () => { this.clients.delete(id); });\n }\n\n private async handleLine(client: ClientState, line: string): Promise<void> {\n let req: IpcRequest;\n try {\n req = JSON.parse(line) as IpcRequest;\n } catch {\n return this.send(client, { id: 0, ok: false, error: 'invalid json' });\n }\n\n switch (req.method) {\n case 'ping':\n return this.send(client, { id: req.id, ok: true, result: 'pong' });\n\n case 'status': {\n const status: DaemonStatusReply = {\n pid: process.pid,\n startedAt: this.startedAt.toISOString(),\n uptimeSeconds: Math.floor((Date.now() - this.startedAt.getTime()) / 1000),\n version: this.version,\n mode: PATHS.mode,\n paths: {\n config: PATHS.configFile,\n log: PATHS.logFile,\n state: PATHS.stateDb,\n socket: PATHS.socket,\n },\n modules: this.moduleHost.summary(),\n counters: { ...this.counters },\n };\n return this.send(client, { id: req.id, ok: true, result: status });\n }\n\n case 'recent_events': {\n const limit = req.params?.limit ?? 50;\n const events = getRecentEvents(limit);\n return this.send(client, { id: req.id, ok: true, result: events });\n }\n\n case 'top_sources': {\n const limit = req.params?.limit ?? 10;\n return this.send(client, { id: req.id, ok: true, result: getTopSources(limit) });\n }\n\n case 'counters': {\n return this.send(client, {\n id: req.id,\n ok: true,\n result: {\n total: getEventCount(),\n threats: getThreatCount(),\n last24h: getEventCount(new Date(Date.now() - 86400000)),\n threats24h: getThreatCount(new Date(Date.now() - 86400000)),\n },\n });\n }\n\n case 'module_list':\n return this.send(client, { id: req.id, ok: true, result: this.moduleHost.summary() });\n\n case 'subscribe':\n for (const ch of req.params.channels) client.subscriptions.add(ch);\n return this.send(client, { id: req.id, ok: true, result: { subscribed: [...client.subscriptions] } });\n\n case 'shutdown':\n // TC-33: reads are open to the adm group by design; stopping the\n // security daemon is not. Requires the root-only control token.\n if (!tokensMatch(this.controlToken, (req as { params?: { token?: unknown } }).params?.token)) {\n return this.send(client, {\n id: req.id,\n ok: false,\n error: 'shutdown requires the daemon control token (run as root, or use systemctl)',\n });\n }\n this.send(client, { id: req.id, ok: true, result: 'shutting down' });\n setTimeout(() => process.emit('SIGTERM' as NodeJS.Signals), 50);\n return;\n }\n }\n\n private send(client: ClientState, msg: IpcResponse | IpcPush): void {\n try {\n client.socket.write(JSON.stringify(msg) + '\\n');\n } catch {\n // client gone\n }\n }\n\n private broadcast(msg: IpcPush, channel: 'event' | 'module'): void {\n for (const client of this.clients.values()) {\n if (!client.subscriptions.has(channel)) continue;\n this.send(client, msg);\n }\n }\n}\n","import { randomBytes, timingSafeEqual } from 'node:crypto';\nimport { chmodSync, existsSync, readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { PATHS } from './paths.js';\n\n/**\n * TC-33: the IPC socket is 0660 root:adm so log-reading users can query the\n * daemon without sudo. That is the intended boundary for *reads* — but it also\n * let any adm member send {\"method\":\"shutdown\"} and kill the security daemon.\n *\n * Control methods now need a token the daemon writes at startup, 0600 and\n * root-owned, inside a runtime directory that is no longer group-writable. Read\n * methods are unchanged, so the convenience the group buys is preserved.\n *\n * In user mode everything under ~/.threatcrush already belongs to the user\n * running the daemon, so the token is theirs to read — which is correct.\n */\n\nexport const CONTROL_TOKEN_FILE = join(PATHS.runDir, 'control.token');\n\n/** Called by the daemon at startup. Rotates on every start. */\nexport function issueControlToken(): string {\n const token = randomBytes(32).toString('hex');\n writeFileSync(CONTROL_TOKEN_FILE, token, { mode: 0o600 });\n try {\n chmodSync(CONTROL_TOKEN_FILE, 0o600);\n } catch {\n // best-effort\n }\n return token;\n}\n\n/** Called by the CLI. Returns null when the caller cannot read the file. */\nexport function readControlToken(): string | null {\n if (!existsSync(CONTROL_TOKEN_FILE)) return null;\n try {\n const token = readFileSync(CONTROL_TOKEN_FILE, 'utf-8').trim();\n return token || null;\n } catch {\n // EACCES: the caller is not privileged enough to control the daemon.\n return null;\n }\n}\n\nexport function tokensMatch(expected: string, provided: unknown): boolean {\n if (typeof provided !== 'string' || !provided) return false;\n const a = Buffer.from(expected);\n const b = Buffer.from(provided);\n return a.length === b.length && timingSafeEqual(a, b);\n}\n","import { EventEmitter } from 'node:events';\nimport type { ThreatEvent } from '../types/events.js';\n\nexport interface DaemonEvents {\n event: (event: ThreatEvent) => void;\n alert: (event: ThreatEvent) => void;\n module: (info: { name: string; status: string; detail?: string }) => void;\n}\n\nexport class EventBus extends EventEmitter {\n publish(event: ThreatEvent): void {\n this.emit('event', event);\n if (event.severity === 'high' || event.severity === 'critical') {\n this.emit('alert', event);\n }\n }\n\n announceModule(name: string, status: string, detail?: string): void {\n this.emit('module', { name, status, detail });\n }\n}\n\nexport const bus = new EventBus();\nbus.setMaxListeners(50);\n","import Database from 'better-sqlite3';\nimport type { ThreatEvent } from '../types/events.js';\n\nlet db: Database.Database | null = null;\nlet dbUnavailable = false;\n\nexport function isStateDbAvailable(): boolean {\n return db !== null;\n}\n\nexport function initStateDB(dbPath: string = '/var/lib/threatcrush/state.db'): Database.Database {\n if (db) return db;\n if (dbUnavailable) {\n throw new Error('state db unavailable (previous init failed)');\n }\n\n try {\n try {\n db = new Database(dbPath);\n } catch {\n // Fall back to in-memory if we can't write to the path\n db = new Database(':memory:');\n }\n } catch (err) {\n // Native binding missing or unloadable — mark DB unavailable so callers\n // can degrade gracefully instead of throwing on every IPC request.\n dbUnavailable = true;\n throw err;\n }\n\n db.pragma('journal_mode = WAL');\n\n db.exec(`\n CREATE TABLE IF NOT EXISTS events (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n timestamp TEXT NOT NULL,\n module TEXT NOT NULL,\n category TEXT NOT NULL,\n severity TEXT NOT NULL,\n message TEXT NOT NULL,\n source_ip TEXT,\n details TEXT\n );\n\n CREATE TABLE IF NOT EXISTS module_state (\n module TEXT NOT NULL,\n key TEXT NOT NULL,\n value TEXT,\n PRIMARY KEY (module, key)\n );\n\n CREATE TABLE IF NOT EXISTS stats (\n key TEXT PRIMARY KEY,\n value TEXT NOT NULL,\n updated_at TEXT NOT NULL\n );\n\n CREATE INDEX IF NOT EXISTS idx_events_timestamp ON events(timestamp);\n CREATE INDEX IF NOT EXISTS idx_events_module ON events(module);\n CREATE INDEX IF NOT EXISTS idx_events_severity ON events(severity);\n CREATE INDEX IF NOT EXISTS idx_events_source_ip ON events(source_ip);\n `);\n\n return db;\n}\n\nexport function insertEvent(event: ThreatEvent): number {\n const database = tryDb();\n if (!database) return -1;\n const stmt = database.prepare(`\n INSERT INTO events (timestamp, module, category, severity, message, source_ip, details)\n VALUES (?, ?, ?, ?, ?, ?, ?)\n `);\n const result = stmt.run(\n event.timestamp.toISOString(),\n event.module,\n event.category,\n event.severity,\n event.message,\n event.source_ip || null,\n event.details ? JSON.stringify(event.details) : null,\n );\n return result.lastInsertRowid as number;\n}\n\nfunction tryDb(): Database.Database | null {\n if (db) return db;\n if (dbUnavailable) return null;\n try {\n return initStateDB();\n } catch {\n return null;\n }\n}\n\nexport function getRecentEvents(limit: number = 50): ThreatEvent[] {\n const database = tryDb();\n if (!database) return [];\n const rows = database.prepare(`\n SELECT * FROM events ORDER BY timestamp DESC LIMIT ?\n `).all(limit) as any[];\n return rows.map(rowToEvent);\n}\n\nexport function getEventCount(since?: Date): number {\n const database = tryDb();\n if (!database) return 0;\n if (since) {\n return (database.prepare(`SELECT COUNT(*) as count FROM events WHERE timestamp >= ?`)\n .get(since.toISOString()) as any).count;\n }\n return (database.prepare(`SELECT COUNT(*) as count FROM events`).get() as any).count;\n}\n\nexport function getThreatCount(since?: Date): number {\n const database = tryDb();\n if (!database) return 0;\n const severities = \"('medium','high','critical')\";\n if (since) {\n return (database.prepare(\n `SELECT COUNT(*) as count FROM events WHERE severity IN ${severities} AND timestamp >= ?`\n ).get(since.toISOString()) as any).count;\n }\n return (database.prepare(\n `SELECT COUNT(*) as count FROM events WHERE severity IN ${severities}`\n ).get() as any).count;\n}\n\nexport function getTopSources(limit: number = 10): Array<{ ip: string; count: number }> {\n const database = tryDb();\n if (!database) return [];\n return database.prepare(`\n SELECT source_ip as ip, COUNT(*) as count FROM events\n WHERE source_ip IS NOT NULL\n GROUP BY source_ip ORDER BY count DESC LIMIT ?\n `).all(limit) as any[];\n}\n\nexport function getModuleState(module: string, key: string): unknown {\n const database = db || initStateDB();\n const row = database.prepare(`SELECT value FROM module_state WHERE module = ? AND key = ?`)\n .get(module, key) as any;\n if (!row) return undefined;\n try {\n return JSON.parse(row.value);\n } catch {\n return row.value;\n }\n}\n\nexport function setModuleState(module: string, key: string, value: unknown): void {\n const database = db || initStateDB();\n database.prepare(`\n INSERT OR REPLACE INTO module_state (module, key, value) VALUES (?, ?, ?)\n `).run(module, key, JSON.stringify(value));\n}\n\nfunction rowToEvent(row: any): ThreatEvent {\n return {\n id: row.id,\n timestamp: new Date(row.timestamp),\n module: row.module,\n category: row.category,\n severity: row.severity,\n message: row.message,\n source_ip: row.source_ip,\n details: row.details ? JSON.parse(row.details) : undefined,\n };\n}\n\nexport function closeDB(): void {\n if (db) {\n db.close();\n db = null;\n }\n}\n","import { existsSync, readdirSync, readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport TOML from '@iarna/toml';\nimport type { EventBus } from './event-bus.js';\nimport { PATHS } from './paths.js';\nimport { verifyModuleTrust } from './module-trust.js';\nimport { LogWatcher } from './watchers/log-watcher.js';\nimport { JournalWatcher } from './watchers/journal-watcher.js';\nimport { NetworkMonitor } from '../modules/network-monitor/index.js';\nimport { DnsMonitor } from '../modules/dns-monitor/index.js';\nimport { loadModuleConfigs } from '../core/config.js';\nimport { getModuleState, setModuleState } from '../core/state.js';\nimport type { ModuleConfig, ModuleManifest } from '../types/config.js';\nimport type { ThreatEvent } from '../types/events.js';\nimport type { ModuleAlert, ThreatCrushModule } from '../types/module.js';\n\ninterface HostedModule {\n name: string;\n version: string;\n source: 'builtin' | 'installed';\n status: 'running' | 'loaded' | 'error' | 'disabled';\n events: number;\n detail?: string;\n path?: string;\n config?: ModuleConfig;\n instance?: ThreatCrushModule;\n}\n\nexport class ModuleHost {\n private modules = new Map<string, HostedModule>();\n private logWatcher: LogWatcher | null = null;\n private journalWatcher: JournalWatcher | null = null;\n private networkMonitor: NetworkMonitor | null = null;\n private dnsMonitor: DnsMonitor | null = null;\n\n constructor(private bus: EventBus) {\n bus.on('event', (event) => {\n const mod = this.modules.get(event.module);\n if (mod) mod.events++;\n for (const hosted of this.modules.values()) {\n if (hosted.status !== 'running' || !hosted.instance?.onEvent) continue;\n void hosted.instance.onEvent(event).catch((err) => {\n hosted.status = 'error';\n hosted.detail = `onEvent failed: ${String((err as Error).message || err)}`;\n this.bus.announceModule(hosted.name, 'error', hosted.detail);\n });\n }\n });\n }\n\n async start(): Promise<void> {\n this.registerBuiltins();\n await this.discoverAndStartInstalled();\n\n this.logWatcher = new LogWatcher(this.bus);\n const watched = this.logWatcher.start();\n\n for (const modName of this.logWatcher.activeModules()) {\n const mod = this.modules.get(modName);\n if (mod) {\n mod.status = 'running';\n mod.detail = `watching ${watched.length} log source(s)`;\n this.bus.announceModule(modName, 'running', mod.detail);\n }\n }\n\n this.journalWatcher = new JournalWatcher(this.bus);\n if (this.journalWatcher.start()) {\n const mod = this.modules.get('user-journal');\n if (mod) {\n mod.status = 'running';\n mod.detail = `tailing ${JournalWatcher.scopeArgs().includes('--user') ? 'user journal' : 'system journal'}`;\n this.bus.announceModule('user-journal', 'running', mod.detail);\n }\n }\n\n // Network monitor (PRD 04)\n this.networkMonitor = new NetworkMonitor(this.bus);\n if (this.networkMonitor.start()) {\n const nmod = this.modules.get('network-monitor');\n if (nmod) {\n nmod.status = 'running';\n nmod.detail = 'monitoring connections via conntrack/ss';\n this.bus.announceModule('network-monitor', 'running', nmod.detail);\n }\n }\n\n // DNS monitor (PRD 05)\n this.dnsMonitor = new DnsMonitor(this.bus);\n if (this.dnsMonitor.start()) {\n const dmod = this.modules.get('dns-monitor');\n if (dmod) {\n dmod.status = 'running';\n dmod.detail = 'monitoring DNS queries';\n this.bus.announceModule('dns-monitor', 'running', dmod.detail);\n }\n }\n }\n\n async stop(): Promise<void> {\n this.logWatcher?.stop();\n this.journalWatcher?.stop();\n this.networkMonitor?.stop();\n this.dnsMonitor?.stop();\n for (const mod of this.modules.values()) {\n try {\n if (mod.instance && mod.status === 'running') {\n await mod.instance.stop();\n }\n } catch (err) {\n mod.status = 'error';\n mod.detail = `stop failed: ${String((err as Error).message || err)}`;\n this.bus.announceModule(mod.name, 'error', mod.detail);\n continue;\n }\n mod.status = 'loaded';\n this.bus.announceModule(mod.name, 'stopped');\n }\n }\n\n summary(): Array<{ name: string; status: string; events: number; detail?: string }> {\n return [...this.modules.values()].map((m) => ({\n name: m.name,\n status: m.status,\n events: m.events,\n detail: m.detail,\n }));\n }\n\n private registerBuiltins(): void {\n const builtins: HostedModule[] = [\n { name: 'log-watcher', version: '0.1.0', source: 'builtin', status: 'loaded', events: 0 },\n { name: 'ssh-guard', version: '0.1.0', source: 'builtin', status: 'loaded', events: 0 },\n { name: 'user-journal', version: '0.1.0', source: 'builtin', status: 'loaded', events: 0 },\n { name: 'network-monitor', version: '0.1.0', source: 'builtin', status: 'loaded', events: 0 },\n { name: 'dns-monitor', version: '0.1.0', source: 'builtin', status: 'loaded', events: 0 },\n ];\n for (const m of builtins) this.modules.set(m.name, m);\n }\n\n private async discoverAndStartInstalled(): Promise<void> {\n if (!existsSync(PATHS.moduleDir)) return;\n const configs = loadModuleConfigs(PATHS.confD);\n const entries = readdirSync(PATHS.moduleDir, { withFileTypes: true });\n for (const entry of entries) {\n if (!entry.isDirectory()) continue;\n const manifestPath = join(PATHS.moduleDir, entry.name, 'mod.toml');\n if (!existsSync(manifestPath)) continue;\n try {\n const manifest = TOML.parse(readFileSync(manifestPath, 'utf-8')) as unknown as ModuleManifest;\n const name = manifest.module?.name || entry.name;\n const defaults = manifest.module?.config?.defaults || {};\n const config = {\n enabled: true,\n ...defaults,\n ...(configs.get(name) || {}),\n } as ModuleConfig;\n const hosted: HostedModule = {\n name,\n version: manifest.module?.version || '0.0.0',\n source: 'installed',\n status: config.enabled === false ? 'disabled' : 'loaded',\n events: 0,\n path: join(PATHS.moduleDir, entry.name),\n config,\n };\n this.modules.set(name, hosted);\n if (config.enabled === false) continue;\n await this.startInstalled(hosted);\n } catch (err) {\n const name = entry.name;\n this.modules.set(name, {\n name,\n version: '0.0.0',\n source: 'installed',\n status: 'error',\n events: 0,\n detail: `manifest load failed: ${String((err as Error).message || err)}`,\n path: join(PATHS.moduleDir, entry.name),\n });\n }\n }\n }\n\n private async startInstalled(hosted: HostedModule): Promise<void> {\n const entrypoint = this.installedEntrypoint(hosted.path!);\n if (!entrypoint) {\n hosted.status = 'loaded';\n hosted.detail = 'no built entrypoint found; run npm install && npm run build in the module directory';\n return;\n }\n\n // TC-32: this daemon runs as root, so importing a marketplace module is\n // handing it the machine. Nothing loads without an explicit local trust\n // decision and an unchanged content digest.\n const trust = verifyModuleTrust(hosted.name, hosted.path!);\n if (!trust.ok) {\n hosted.status = 'error';\n hosted.detail = `refusing to load: ${trust.reason}`;\n this.bus.announceModule(hosted.name, 'error', hosted.detail);\n return;\n }\n\n try {\n const imported = await import(pathToFileURL(entrypoint).href);\n const exported = imported.default || imported.module || imported;\n const instance = typeof exported === 'function' ? new exported() : exported;\n if (!this.isThreatCrushModule(instance)) {\n throw new Error('entrypoint does not export a ThreatCrush module');\n }\n\n hosted.instance = instance;\n await instance.init(this.contextFor(hosted));\n await instance.start();\n hosted.status = 'running';\n hosted.detail = `started from ${entrypoint}`;\n this.bus.announceModule(hosted.name, 'running', hosted.detail);\n } catch (err) {\n hosted.status = 'error';\n hosted.detail = String((err as Error).message || err);\n this.bus.announceModule(hosted.name, 'error', hosted.detail);\n }\n }\n\n private installedEntrypoint(modulePath: string): string | null {\n const packageJson = join(modulePath, 'package.json');\n const candidates: string[] = [];\n if (existsSync(packageJson)) {\n try {\n const pkg = JSON.parse(readFileSync(packageJson, 'utf-8')) as { main?: string };\n if (pkg.main) candidates.push(join(modulePath, pkg.main));\n } catch {\n // fall through to conventional paths\n }\n }\n candidates.push(join(modulePath, 'dist', 'index.js'), join(modulePath, 'index.js'));\n return candidates.find((candidate) => existsSync(candidate)) || null;\n }\n\n private isThreatCrushModule(value: unknown): value is ThreatCrushModule {\n return Boolean(\n value &&\n typeof value === 'object' &&\n typeof (value as ThreatCrushModule).init === 'function' &&\n typeof (value as ThreatCrushModule).start === 'function' &&\n typeof (value as ThreatCrushModule).stop === 'function',\n );\n }\n\n private contextFor(hosted: HostedModule) {\n return {\n config: hosted.config || { enabled: true },\n logger: this.loggerFor(hosted.name),\n emit: (event: ThreatEvent) => this.bus.publish(event),\n subscribe: (eventType: string, handler: (event: ThreatEvent) => void) => {\n this.bus.on('event', (event) => {\n if (event.category === eventType || event.module === eventType) handler(event);\n });\n },\n alert: (alert: ModuleAlert) => {\n this.bus.emit('alert', alert.event || {\n timestamp: new Date(),\n module: hosted.name,\n category: 'system',\n severity: alert.severity,\n message: alert.title,\n details: alert.body ? { body: alert.body } : undefined,\n });\n },\n getState: (key: string) => getModuleState(hosted.name, key),\n setState: (key: string, value: unknown) => setModuleState(hosted.name, key, value),\n };\n }\n\n private loggerFor(moduleName: string) {\n return {\n debug: (msg: string, ...args: unknown[]) => console.debug(`[${moduleName}] ${msg}`, ...args),\n info: (msg: string, ...args: unknown[]) => console.info(`[${moduleName}] ${msg}`, ...args),\n warn: (msg: string, ...args: unknown[]) => console.warn(`[${moduleName}] ${msg}`, ...args),\n error: (msg: string, ...args: unknown[]) => console.error(`[${moduleName}] ${msg}`, ...args),\n };\n }\n}\n","import { createHash, verify as verifySignature } from 'node:crypto';\nimport {\n chmodSync,\n existsSync,\n readFileSync,\n readdirSync,\n readlinkSync,\n writeFileSync,\n} from 'node:fs';\nimport { join, relative, sep } from 'node:path';\nimport { PATHS } from './paths.js';\n\n/**\n * TC-32: threatcrushd runs as root and used to `await import()` anything sitting\n * in its module directory. Modules arrive from the public marketplace or an\n * arbitrary Git URL, so publishing a module was equivalent to remote code\n * execution as root on every host that installed it.\n *\n * Loading is now gated on an explicit local decision. A module runs only if the\n * operator trusted it AND its contents still hash to what they trusted. That\n * turns a silent supply-chain compromise into something a human has to approve,\n * and makes post-install tampering fail closed.\n *\n * Ed25519 signatures are verified when a module ships one and publisher keys\n * are pinned; the marketplace does not emit signatures yet, so this is an\n * additional check rather than the primary gate.\n */\n\nconst TRUST_FILE = join(PATHS.configDir, 'trusted-modules.json');\nconst PUBLISHER_KEYS_FILE = join(PATHS.configDir, 'publisher-keys.json');\n\n/** Never contributes to identity: VCS metadata is not executed. */\nconst DIGEST_EXCLUDED_DIRS = new Set(['.git']);\n\nexport interface TrustRecord {\n digest: string;\n trustedAt: string;\n source: string;\n}\n\ninterface TrustFile {\n version: 1;\n modules: Record<string, TrustRecord>;\n}\n\nexport interface TrustVerdict {\n ok: boolean;\n reason?: string;\n}\n\ninterface DigestEntry {\n path: string;\n isSymlink: boolean;\n}\n\nfunction collectFiles(root: string, dir = root, out: DigestEntry[] = []): DigestEntry[] {\n for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) =>\n a.name < b.name ? -1 : a.name > b.name ? 1 : 0,\n )) {\n const full = join(dir, entry.name);\n if (entry.isSymbolicLink()) {\n // Recorded by link target, never followed — see computeModuleDigest.\n out.push({ path: full, isSymlink: true });\n } else if (entry.isDirectory()) {\n if (DIGEST_EXCLUDED_DIRS.has(entry.name)) continue;\n collectFiles(root, full, out);\n } else if (entry.isFile()) {\n out.push({ path: full, isSymlink: false });\n }\n }\n return out;\n}\n\n/**\n * SHA-256 over every file in the module, path included. node_modules is hashed\n * too — a dependency is exactly where hostile code would hide, and skipping it\n * would let an attacker swap a transitive package without breaking the digest.\n * Symlinks are hashed by their target string, not by following them, so a link\n * repointed at /etc/shadow changes the digest instead of reading the file.\n */\nexport function computeModuleDigest(modulePath: string): string {\n const hash = createHash('sha256');\n\n for (const entry of collectFiles(modulePath)) {\n // Normalize to POSIX separators so a digest taken on one platform matches.\n const relPath = relative(modulePath, entry.path).split(sep).join('/');\n hash.update(relPath);\n hash.update('\\0');\n\n if (entry.isSymlink) {\n hash.update('symlink:');\n hash.update(readlinkSync(entry.path));\n } else {\n hash.update('file:');\n hash.update(readFileSync(entry.path));\n }\n hash.update('\\0');\n }\n\n return hash.digest('hex');\n}\n\nfunction readTrustFile(): TrustFile {\n if (!existsSync(TRUST_FILE)) return { version: 1, modules: {} };\n try {\n const parsed = JSON.parse(readFileSync(TRUST_FILE, 'utf-8')) as Partial<TrustFile>;\n if (parsed.version !== 1 || typeof parsed.modules !== 'object' || !parsed.modules) {\n return { version: 1, modules: {} };\n }\n return { version: 1, modules: parsed.modules };\n } catch {\n // A corrupt ledger must not be read as \"everything is trusted\".\n return { version: 1, modules: {} };\n }\n}\n\nfunction writeTrustFile(file: TrustFile): void {\n writeFileSync(TRUST_FILE, JSON.stringify(file, null, 2) + '\\n', { mode: 0o600 });\n try {\n chmodSync(TRUST_FILE, 0o600);\n } catch {\n // best-effort\n }\n}\n\nexport function trustModule(name: string, modulePath: string, source: string): TrustRecord {\n const file = readTrustFile();\n const record: TrustRecord = {\n digest: computeModuleDigest(modulePath),\n trustedAt: new Date().toISOString(),\n source,\n };\n file.modules[name] = record;\n writeTrustFile(file);\n return record;\n}\n\nexport function untrustModule(name: string): boolean {\n const file = readTrustFile();\n if (!file.modules[name]) return false;\n delete file.modules[name];\n writeTrustFile(file);\n return true;\n}\n\nexport function listTrustedModules(): Record<string, TrustRecord> {\n return readTrustFile().modules;\n}\n\n/** Pinned publisher keys, as { keyId: \"<SPKI PEM>\" }. Absent file = none pinned. */\nfunction readPublisherKeys(): Record<string, string> {\n if (!existsSync(PUBLISHER_KEYS_FILE)) return {};\n try {\n const parsed = JSON.parse(readFileSync(PUBLISHER_KEYS_FILE, 'utf-8')) as Record<string, string>;\n return parsed && typeof parsed === 'object' ? parsed : {};\n } catch {\n return {};\n }\n}\n\n/**\n * A module may ship mod.sig: { keyId, signature } (base64) over its digest.\n * When publisher keys are pinned, an unsigned or badly-signed module is\n * rejected outright, whatever the local trust ledger says.\n */\nexport function verifyModuleSignature(modulePath: string, digest: string): TrustVerdict {\n const keys = readPublisherKeys();\n const pinnedKeyIds = Object.keys(keys);\n const sigPath = join(modulePath, 'mod.sig');\n\n if (pinnedKeyIds.length === 0) {\n return { ok: true };\n }\n\n if (!existsSync(sigPath)) {\n return { ok: false, reason: 'publisher keys are pinned but the module ships no mod.sig' };\n }\n\n let parsed: { keyId?: string; signature?: string };\n try {\n parsed = JSON.parse(readFileSync(sigPath, 'utf-8')) as { keyId?: string; signature?: string };\n } catch {\n return { ok: false, reason: 'mod.sig is not valid JSON' };\n }\n\n if (!parsed.keyId || !parsed.signature) {\n return { ok: false, reason: 'mod.sig is missing keyId or signature' };\n }\n\n const publicKey = keys[parsed.keyId];\n if (!publicKey) {\n return { ok: false, reason: `mod.sig references unpinned key \"${parsed.keyId}\"` };\n }\n\n try {\n // Ed25519 takes the message directly (algorithm is null).\n const valid = verifySignature(\n null,\n Buffer.from(digest, 'hex'),\n publicKey,\n Buffer.from(parsed.signature, 'base64'),\n );\n return valid ? { ok: true } : { ok: false, reason: 'mod.sig signature does not match' };\n } catch (err) {\n return { ok: false, reason: `signature check failed: ${String((err as Error).message || err)}` };\n }\n}\n\n/**\n * The gate the daemon calls immediately before importing a module.\n */\nexport function verifyModuleTrust(name: string, modulePath: string): TrustVerdict {\n let digest: string;\n try {\n digest = computeModuleDigest(modulePath);\n } catch (err) {\n return { ok: false, reason: `could not hash module: ${String((err as Error).message || err)}` };\n }\n\n const signature = verifyModuleSignature(modulePath, digest);\n if (!signature.ok) return signature;\n\n const record = readTrustFile().modules[name];\n if (!record) {\n return {\n ok: false,\n reason: `not trusted — review it, then run: threatcrush modules trust ${name}`,\n };\n }\n\n if (record.digest !== digest) {\n return {\n ok: false,\n reason:\n `contents changed since it was trusted on ${record.trustedAt} — ` +\n `re-review it, then run: threatcrush modules trust ${name}`,\n };\n }\n\n return { ok: true };\n}\n","import { existsSync, statSync, createReadStream, accessSync, constants } from 'node:fs';\nimport { createInterface } from 'node:readline';\nimport type { EventBus } from '../event-bus.js';\nimport { autoDetectParser, detectAttackPattern, parseAuthLog, parseNginxLog } from '../../core/log-parser.js';\nimport { insertEvent } from '../../core/state.js';\nimport type { ThreatEvent, EventCategory, EventSeverity } from '../../types/events.js';\n\nexport interface LogSource {\n path: string;\n module: string;\n category: EventCategory;\n}\n\nexport const DEFAULT_SOURCES: LogSource[] = [\n { path: '/var/log/auth.log', module: 'ssh-guard', category: 'auth' },\n { path: '/var/log/secure', module: 'ssh-guard', category: 'auth' },\n { path: '/var/log/nginx/access.log', module: 'log-watcher', category: 'web' },\n { path: '/var/log/syslog', module: 'log-watcher', category: 'system' },\n];\n\nexport class LogWatcher {\n private timers = new Map<string, NodeJS.Timeout>();\n private positions = new Map<string, number>();\n private active = new Set<string>();\n\n constructor(private bus: EventBus, private sources: LogSource[] = DEFAULT_SOURCES) {}\n\n start(): string[] {\n const started: string[] = [];\n for (const src of this.sources) {\n if (!existsSync(src.path)) continue;\n try { accessSync(src.path, constants.R_OK); }\n catch { continue; }\n this.tail(src);\n started.push(src.path);\n }\n return started;\n }\n\n stop(): void {\n for (const t of this.timers.values()) clearInterval(t);\n this.timers.clear();\n this.positions.clear();\n this.active.clear();\n }\n\n activeModules(): string[] {\n return [...this.active];\n }\n\n private tail(src: LogSource): void {\n try {\n this.positions.set(src.path, statSync(src.path).size);\n } catch {\n this.positions.set(src.path, 0);\n }\n\n const timer = setInterval(() => this.poll(src), 1000);\n this.timers.set(src.path, timer);\n this.active.add(src.module);\n }\n\n private poll(src: LogSource): void {\n let stat;\n try { stat = statSync(src.path); } catch { return; }\n const prev = this.positions.get(src.path) ?? 0;\n\n if (stat.size < prev) {\n this.positions.set(src.path, 0); // rotated\n return;\n }\n if (stat.size === prev) return;\n\n const stream = createReadStream(src.path, { start: prev, encoding: 'utf-8' });\n stream.on('error', () => this.positions.set(src.path, stat.size));\n const rl = createInterface({ input: stream });\n rl.on('error', () => {});\n rl.on('line', (line) => {\n if (!line.trim()) return;\n this.process(line, src);\n });\n rl.on('close', () => this.positions.set(src.path, stat.size));\n }\n\n private process(line: string, src: LogSource): void {\n const parsed = autoDetectParser(line);\n if (!parsed) return;\n\n let severity: EventSeverity = 'info';\n let message = line;\n let sourceIp: string | undefined;\n\n if (parsed.source === 'auth') {\n const entry = parseAuthLog(line);\n if (!entry) return;\n sourceIp = entry.fields.ip;\n const msg = entry.fields.message;\n if (/failed password/i.test(msg)) {\n severity = 'high';\n message = `Failed SSH login for ${entry.fields.user || 'unknown'} from ${entry.fields.ip || 'unknown'}`;\n } else if (/invalid user/i.test(msg)) {\n severity = 'high';\n message = `Invalid SSH user: ${entry.fields.user || 'unknown'} from ${entry.fields.ip || 'unknown'}`;\n } else if (/accepted/i.test(msg)) {\n severity = 'info';\n message = `SSH login accepted for ${entry.fields.user || 'unknown'}`;\n } else {\n return;\n }\n } else if (parsed.source === 'nginx') {\n const entry = parseNginxLog(line);\n if (!entry) return;\n sourceIp = entry.fields.ip;\n const status = parseInt(entry.fields.status, 10);\n const attack = detectAttackPattern(entry.fields.path);\n if (attack) {\n severity = 'critical';\n message = `Attack [${attack.toUpperCase()}]: ${entry.fields.method} ${entry.fields.path}`;\n } else if (status >= 500) {\n severity = 'medium';\n message = `Server error ${status}: ${entry.fields.method} ${entry.fields.path}`;\n } else if (status >= 400) {\n severity = 'low';\n message = `Client error ${status}: ${entry.fields.method} ${entry.fields.path}`;\n } else {\n return;\n }\n } else {\n return;\n }\n\n const event: ThreatEvent = {\n timestamp: new Date(),\n module: src.module,\n category: src.category,\n severity,\n message,\n source_ip: sourceIp,\n };\n\n try { insertEvent(event); } catch { /* db optional */ }\n this.bus.publish(event);\n }\n}\n","import type { ParsedLogLine, NginxLogEntry, AuthLogEntry, SyslogEntry } from '../types/events.js';\n\n// Nginx combined log format:\n// 127.0.0.1 - - [04/Apr/2026:12:00:00 +0000] \"GET /path HTTP/1.1\" 200 1234 \"-\" \"Mozilla/5.0\"\nconst NGINX_REGEX = /^(\\S+) \\S+ \\S+ \\[([^\\]]+)\\] \"(\\S+) (\\S+) \\S+\" (\\d{3}) (\\d+) \"[^\"]*\" \"([^\"]*)\"/;\n\n// Auth.log format:\n// Apr 4 12:00:00 hostname sshd[1234]: Failed password for user from 1.2.3.4 port 22 ssh2\nconst AUTH_REGEX = /^(\\w+\\s+\\d+\\s+[\\d:]+)\\s+\\S+\\s+(\\S+?)(?:\\[\\d+\\])?:\\s+(.*)/;\n\n// Syslog format:\n// Apr 4 12:00:00 hostname process[pid]: message\nconst SYSLOG_REGEX = /^(\\w+\\s+\\d+\\s+[\\d:]+)\\s+\\S+\\s+(\\S+?)(?:\\[\\d+\\])?:\\s+(.*)/;\n\n// Extract IP from auth messages\nconst IP_REGEX = /(?:from|FROM)\\s+(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})/;\nconst INVALID_USER_REGEX = /(?:for\\s+invalid\\s+user)\\s+(\\S+?)(?:\\s+from|\\s*$)/;\nconst USER_REGEX = /(?:for|user)\\s+(\\S+?)(?:\\s+from|\\s*$)/;\n\n// Attack pattern signatures\nexport const ATTACK_PATTERNS = {\n sqli: [\n /(?:union\\s+(?:all\\s+)?select)/i,\n /(?:select\\s+.*\\s+from\\s+)/i,\n /(?:insert\\s+into\\s+)/i,\n /(?:drop\\s+(?:table|database))/i,\n /(?:or\\s+1\\s*=\\s*1)/i,\n /(?:'\\s*(?:or|and)\\s+')/i,\n /(?:--\\s*$|;\\s*--)/,\n /(?:\\/\\*.*\\*\\/)/,\n ],\n xss: [\n /<script[^>]*>/i,\n /javascript\\s*:/i,\n /on(?:load|error|click|mouseover)\\s*=/i,\n /eval\\s*\\(/i,\n /document\\.(?:cookie|write|location)/i,\n ],\n path_traversal: [\n /\\.\\.\\//,\n /\\.\\.\\\\/, \n /etc\\/(?:passwd|shadow|hosts)/,\n /proc\\/self/,\n /windows\\/system32/i,\n ],\n rfi: [\n /(?:https?|ftp):\\/\\/.*\\?/i,\n /php:\\/\\/(?:input|filter)/i,\n /data:\\/\\//i,\n ],\n};\n\nexport function parseNginxLog(line: string): NginxLogEntry | null {\n const match = line.match(NGINX_REGEX);\n if (!match) return null;\n\n return {\n timestamp: parseNginxTimestamp(match[2]),\n raw: line,\n source: 'nginx',\n fields: {\n ip: match[1],\n method: match[3],\n path: match[4],\n status: match[5],\n size: match[6],\n user_agent: match[7],\n },\n };\n}\n\nexport function parseAuthLog(line: string): AuthLogEntry | null {\n const match = line.match(AUTH_REGEX);\n if (!match) return null;\n\n const ipMatch = match[3].match(IP_REGEX);\n const userMatch = match[3].match(INVALID_USER_REGEX) || match[3].match(USER_REGEX);\n\n return {\n timestamp: parseSyslogTimestamp(match[1]),\n raw: line,\n source: 'auth',\n fields: {\n process: match[2],\n message: match[3],\n ip: ipMatch?.[1],\n user: userMatch?.[1],\n },\n };\n}\n\nexport function parseSyslog(line: string): SyslogEntry | null {\n const match = line.match(SYSLOG_REGEX);\n if (!match) return null;\n\n return {\n timestamp: parseSyslogTimestamp(match[1]),\n raw: line,\n source: 'syslog',\n fields: {\n facility: 'syslog',\n process: match[2],\n message: match[3],\n },\n };\n}\n\nexport function detectAttackPattern(path: string): string | null {\n // nginx logs the request URI URL-encoded, so raw signatures like `<script`\n // or `or 1=1` never match an encoded payload (e.g. `%3Cscript%3E`,\n // `%27%20OR%201=1`). Test the raw value AND its URL-decoded forms so that\n // single- and double-encoded payloads are still caught. decodeURIComponent\n // throws on a malformed `%` sequence, so guard each decode.\n const candidates = new Set<string>([path]);\n let current = path;\n for (let i = 0; i < 2; i++) {\n let decoded: string | null = null;\n try {\n decoded = decodeURIComponent(current);\n } catch {\n decoded = null;\n }\n if (decoded === null || decoded === current) break;\n candidates.add(decoded);\n current = decoded;\n }\n\n for (const [type, patterns] of Object.entries(ATTACK_PATTERNS)) {\n for (const pattern of patterns) {\n for (const candidate of candidates) {\n if (pattern.test(candidate)) {\n return type;\n }\n }\n }\n }\n return null;\n}\n\nexport function autoDetectParser(line: string): ParsedLogLine | null {\n // Try nginx first (most specific format)\n const nginx = parseNginxLog(line);\n if (nginx) return nginx;\n\n // Try auth log\n const auth = parseAuthLog(line);\n if (auth) return auth;\n\n // Fall back to generic syslog\n return parseSyslog(line);\n}\n\nfunction parseNginxTimestamp(s: string): Date {\n // \"04/Apr/2026:12:00:00 +0000\"\n // new Date(<unparseable>) returns an Invalid Date instead of throwing, so the\n // old try/catch never triggered and an Invalid Date leaked into downstream\n // time-window logic. Check getTime() explicitly and fall back to now.\n const cleaned = s.replace(/(\\d{2})\\/(\\w{3})\\/(\\d{4}):/, '$2 $1, $3 ');\n const d = new Date(cleaned);\n return Number.isNaN(d.getTime()) ? new Date() : d;\n}\n\nfunction parseSyslogTimestamp(s: string): Date {\n // \"Apr 4 12:00:00\" — no year. Assume the most recent year that is not in the\n // future, so a December log parsed in early January is dated to the previous\n // year rather than the current one.\n const now = new Date();\n let d = new Date(`${s} ${now.getFullYear()}`);\n if (Number.isNaN(d.getTime())) return now;\n if (d.getTime() > now.getTime()) {\n const prev = new Date(`${s} ${now.getFullYear() - 1}`);\n if (!Number.isNaN(prev.getTime())) d = prev;\n }\n return d;\n}\n","import { spawn, type ChildProcess, spawnSync } from 'node:child_process';\nimport type { EventBus } from '../event-bus.js';\nimport { insertEvent } from '../../core/state.js';\nimport type { ThreatEvent, EventSeverity } from '../../types/events.js';\n\n// Wraps `journalctl --user -o json -f` so threatcrushd can pick up user-session\n// events without needing to belong to the `adm` or `systemd-journal` group.\n// On systems without journalctl this watcher is a no-op.\nexport class JournalWatcher {\n private proc: ChildProcess | null = null;\n private buffer = '';\n private moduleName = 'user-journal';\n private active = false;\n\n constructor(private bus: EventBus) {}\n\n // When the daemon runs as root (system mode), tail the SYSTEM journal so\n // we pick up sshd / sudo / kernel / UFW events. Falling back to --user\n // would give us root's mostly-empty per-user journal. Otherwise we use\n // --user so the daemon can run unprivileged on a workstation.\n static scopeArgs(): string[] {\n const isRoot = process.platform === 'linux'\n && typeof process.getuid === 'function'\n && process.getuid() === 0;\n return isRoot ? [] : ['--user'];\n }\n\n static isAvailable(): boolean {\n const probe = spawnSync('journalctl', [...this.scopeArgs(), '-n', '0', '--no-pager'], {\n stdio: ['ignore', 'ignore', 'ignore'],\n });\n return probe.status === 0;\n }\n\n start(): boolean {\n if (!JournalWatcher.isAvailable()) return false;\n\n const child = spawn(\n 'journalctl',\n [...JournalWatcher.scopeArgs(), '-o', 'json', '-f', '--since', 'now'],\n { stdio: ['ignore', 'pipe', 'pipe'] },\n );\n if (!child.stdout) return false;\n child.stdout.setEncoding('utf-8');\n child.stdout.on('data', (chunk: string) => this.onData(chunk));\n child.on('exit', () => {\n this.proc = null;\n this.active = false;\n });\n this.proc = child;\n\n this.active = true;\n return true;\n }\n\n stop(): void {\n if (this.proc) {\n try { this.proc.kill('SIGTERM'); } catch {}\n this.proc = null;\n }\n this.active = false;\n }\n\n isActive(): boolean {\n return this.active;\n }\n\n moduleNameValue(): string {\n return this.moduleName;\n }\n\n private onData(chunk: string): void {\n this.buffer += chunk;\n let idx;\n while ((idx = this.buffer.indexOf('\\n')) >= 0) {\n const line = this.buffer.slice(0, idx);\n this.buffer = this.buffer.slice(idx + 1);\n if (!line.trim()) continue;\n this.handleLine(line);\n }\n }\n\n private handleLine(line: string): void {\n let entry: Record<string, string>;\n try {\n entry = JSON.parse(line) as Record<string, string>;\n } catch {\n return;\n }\n\n const message = entry.MESSAGE;\n if (!message) return;\n\n const priority = parseInt(entry.PRIORITY ?? '6', 10);\n const severity = priorityToSeverity(priority);\n\n // Surface a couple of common suspicious-looking sources at a higher\n // severity even if the kernel disagrees with us.\n const ident = entry.SYSLOG_IDENTIFIER || entry._COMM || 'journal';\n const bumpedSeverity = bumpForIdent(ident, message, severity);\n\n const event: ThreatEvent = {\n timestamp: realtimeToDate(entry.__REALTIME_TIMESTAMP) || new Date(),\n module: this.moduleName,\n category: 'system',\n severity: bumpedSeverity,\n message: `[${ident}] ${message}`.slice(0, 500),\n };\n\n try { insertEvent(event); } catch { /* db optional */ }\n this.bus.publish(event);\n }\n}\n\nfunction priorityToSeverity(priority: number): EventSeverity {\n // syslog priorities: 0 emerg, 1 alert, 2 crit, 3 err, 4 warning, 5 notice, 6 info, 7 debug\n if (priority <= 2) return 'critical';\n if (priority === 3) return 'high';\n if (priority === 4) return 'medium';\n if (priority === 5) return 'low';\n return 'info';\n}\n\nfunction bumpForIdent(ident: string, message: string, base: EventSeverity): EventSeverity {\n if (/sudo/i.test(ident) && /authentication failure|incorrect password|FAILED/i.test(message)) {\n return 'high';\n }\n if (/sshd/i.test(ident) && /failed|invalid user|break-in/i.test(message)) {\n return 'high';\n }\n return base;\n}\n\nfunction realtimeToDate(rt: string | undefined): Date | null {\n if (!rt) return null;\n const us = parseInt(rt, 10);\n if (!Number.isFinite(us)) return null;\n return new Date(Math.floor(us / 1000));\n}\n","/**\n * Network Monitor Module (PRD 04)\n *\n * Observes TCP/UDP connections via conntrack / ss / /proc/net.\n * Detects port scans and SYN-flood-style patterns.\n * Emits detections through the event bus for the rule engine.\n */\n\nimport { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport type { EventBus } from '../../daemon/event-bus.js';\nimport { insertEvent } from '../../core/state.js';\nimport type { ThreatEvent, EventSeverity } from '../../types/events.js';\n\ninterface ConnectionRecord {\n source_ip: string;\n dest_port: number;\n timestamp: number;\n}\n\ninterface ScanTracker {\n ports: Set<number>;\n firstSeen: number;\n lastSeen: number;\n count: number;\n}\n\nexport class NetworkMonitor {\n private active = false;\n private pollTimer: NodeJS.Timeout | null = null;\n private scanTrackers = new Map<string, ScanTracker>();\n private halfOpenTrackers = new Map<string, { count: number; firstSeen: number }>();\n private lastConnections = new Set<string>();\n\n // Config\n private pollIntervalMs = 5000;\n private portScanThreshold = 10; // unique ports in window\n private portScanWindowMs = 30_000;\n private synFloodThreshold = 50; // half-open connections\n private synFloodWindowMs = 10_000;\n\n constructor(private bus: EventBus) {}\n\n start(): boolean {\n if (!this.hasConntrackOrSs()) {\n return false;\n }\n this.active = true;\n this.pollTimer = setInterval(() => this.poll(), this.pollIntervalMs);\n return true;\n }\n\n stop(): void {\n if (this.pollTimer) clearInterval(this.pollTimer);\n this.pollTimer = null;\n this.active = false;\n }\n\n isActive(): boolean { return this.active; }\n\n private hasConntrackOrSs(): boolean {\n const ss = spawnSync('ss', ['--version'], { stdio: 'pipe' });\n if (ss.status === 0) return true;\n // Try /proc/net/tcp\n return existsSync('/proc/net/tcp');\n }\n\n private poll(): void {\n try {\n const connections = this.getConnections();\n this.analyzePortScans(connections);\n this.analyzeSynFlood(connections);\n this.cleanupTrackers();\n } catch {\n // Graceful degradation\n }\n }\n\n private getConnections(): ConnectionRecord[] {\n const records: ConnectionRecord[] = [];\n const now = Date.now();\n\n try {\n // Try conntrack first\n const ct = spawnSync('conntrack', ['-L', '-p', 'tcp', '-o', 'extended'], {\n encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 3000,\n });\n if (ct.status === 0 && ct.stdout) {\n for (const line of ct.stdout.split('\\n')) {\n const srcMatch = line.match(/src=(\\d+\\.\\d+\\.\\d+\\.\\d+)/);\n const dportMatch = line.match(/dport=(\\d+)/);\n if (srcMatch && dportMatch) {\n records.push({ source_ip: srcMatch[1], dest_port: parseInt(dportMatch[1]), timestamp: now });\n }\n }\n if (records.length > 0) return records;\n }\n } catch { /* fallthrough */ }\n\n try {\n // Fallback to ss\n const ss = spawnSync('ss', ['-tnp', '-H'], {\n encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 3000,\n });\n if (ss.status === 0 && ss.stdout) {\n for (const line of ss.stdout.split('\\n')) {\n // ss output: State Recv-Q Send-Q Local:Port Peer:Port Process\n const parts = line.trim().split(/\\s+/);\n if (parts.length < 5) continue;\n const peerParts = parts[4].split(':');\n const localParts = parts[3].split(':');\n if (peerParts.length >= 2 && localParts.length >= 2) {\n const sourceIp = peerParts.slice(0, -1).join(':');\n const destPort = parseInt(localParts[localParts.length - 1]);\n if (sourceIp && !isNaN(destPort) && !this.isLocalIp(sourceIp)) {\n records.push({ source_ip: sourceIp, dest_port: destPort, timestamp: now });\n }\n }\n }\n }\n } catch { /* fallthrough */ }\n\n return records;\n }\n\n private analyzePortScans(connections: ConnectionRecord[]): void {\n const now = Date.now();\n\n for (const conn of connections) {\n const key = conn.source_ip;\n let tracker = this.scanTrackers.get(key);\n\n if (!tracker) {\n tracker = { ports: new Set(), firstSeen: now, lastSeen: now, count: 0 };\n this.scanTrackers.set(key, tracker);\n }\n\n tracker.ports.add(conn.dest_port);\n tracker.lastSeen = now;\n tracker.count++;\n\n // Check threshold within window\n if (tracker.ports.size >= this.portScanThreshold &&\n (now - tracker.firstSeen) <= this.portScanWindowMs) {\n this.emitEvent(\n 'high',\n `Port scan detected: ${conn.source_ip} probed ${tracker.ports.size} ports in ${Math.round((now - tracker.firstSeen) / 1000)}s`,\n conn.source_ip,\n { ports_scanned: tracker.ports.size, window_seconds: Math.round((now - tracker.firstSeen) / 1000) },\n );\n // Reset tracker after alert\n this.scanTrackers.delete(key);\n }\n }\n }\n\n private analyzeSynFlood(connections: ConnectionRecord[]): void {\n // Count SYN_RECV (half-open) states via ss\n try {\n const ss = spawnSync('ss', ['-tn', 'state', 'syn-recv', '-H'], {\n encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 3000,\n });\n if (ss.status !== 0 || !ss.stdout) return;\n\n const perSource = new Map<string, number>();\n\n for (const line of ss.stdout.split('\\n')) {\n const parts = line.trim().split(/\\s+/);\n if (parts.length < 5) continue;\n const peer = parts[4].split(':');\n const ip = peer.slice(0, -1).join(':');\n if (ip) perSource.set(ip, (perSource.get(ip) || 0) + 1);\n }\n\n for (const [ip, count] of perSource) {\n if (count >= this.synFloodThreshold) {\n this.emitEvent(\n 'critical',\n `SYN flood indicators: ${count} half-open connections from ${ip}`,\n ip,\n { half_open_count: count },\n );\n }\n }\n } catch { /* graceful */ }\n }\n\n private emitEvent(severity: EventSeverity, message: string, sourceIp?: string, details?: Record<string, unknown>): void {\n const event: ThreatEvent = {\n timestamp: new Date(),\n module: 'network-monitor',\n category: 'network',\n severity,\n message,\n source_ip: sourceIp,\n details,\n };\n try { insertEvent(event); } catch { /* db optional */ }\n this.bus.publish(event);\n }\n\n private cleanupTrackers(): void {\n const now = Date.now();\n for (const [key, tracker] of this.scanTrackers) {\n if (now - tracker.lastSeen > this.portScanWindowMs * 2) {\n this.scanTrackers.delete(key);\n }\n }\n }\n\n private isLocalIp(ip: string): boolean {\n return ip === '127.0.0.1' || ip === '::1' || ip === '0.0.0.0' || ip.startsWith('::ffff:127.');\n }\n}\n","/**\n * DNS Monitor Module (PRD 05)\n *\n * Observes DNS query activity for tunneling and DGA indicators.\n * Sources: resolver logs, systemd-resolved, dnsmasq logs, passive :53 observation.\n */\n\nimport { existsSync, statSync, createReadStream, accessSync, constants } from 'node:fs';\nimport { createInterface } from 'node:readline';\nimport type { EventBus } from '../../daemon/event-bus.js';\nimport { insertEvent } from '../../core/state.js';\nimport type { ThreatEvent, EventSeverity } from '../../types/events.js';\n\ninterface DnsQuery {\n domain: string;\n type: string;\n source_ip?: string;\n timestamp: number;\n}\n\nconst DNS_LOG_SOURCES = [\n '/var/log/syslog', // systemd-resolved logs here\n '/var/log/dnsmasq.log', // dnsmasq\n '/var/log/named/queries.log', // bind9\n '/var/log/pihole.log', // Pi-hole\n];\n\nexport class DnsMonitor {\n private active = false;\n private timers = new Map<string, NodeJS.Timeout>();\n private positions = new Map<string, number>();\n\n // Tracking windows\n private txtQueryCounts = new Map<string, { count: number; firstSeen: number }>();\n private domainBuffer: DnsQuery[] = [];\n\n // Config\n private txtRateThreshold = 20; // TXT queries per source per window\n private txtWindowMs = 60_000;\n private dgaBurstThreshold = 15; // unique high-entropy domains per window\n private dgaWindowMs = 60_000;\n private entropyThreshold = 3.5; // Shannon entropy threshold for DGA\n\n constructor(private bus: EventBus) {}\n\n start(): boolean {\n const sources = DNS_LOG_SOURCES.filter(p => {\n if (!existsSync(p)) return false;\n try { accessSync(p, constants.R_OK); return true; }\n catch { return false; }\n });\n\n if (sources.length === 0) return false;\n\n this.active = true;\n for (const src of sources) {\n this.tailLog(src);\n }\n\n // Periodic analysis\n setInterval(() => this.analyzeBuffer(), 10_000);\n return true;\n }\n\n stop(): void {\n for (const t of this.timers.values()) clearInterval(t);\n this.timers.clear();\n this.active = false;\n }\n\n isActive(): boolean { return this.active; }\n\n private tailLog(path: string): void {\n try {\n this.positions.set(path, statSync(path).size);\n } catch {\n this.positions.set(path, 0);\n }\n\n const timer = setInterval(() => this.pollLog(path), 2000);\n this.timers.set(path, timer);\n }\n\n private pollLog(path: string): void {\n let stat;\n try { stat = statSync(path); } catch { return; }\n const prev = this.positions.get(path) ?? 0;\n\n if (stat.size < prev) { this.positions.set(path, 0); return; }\n if (stat.size === prev) return;\n\n const stream = createReadStream(path, { start: prev, encoding: 'utf-8' });\n stream.on('error', () => this.positions.set(path, stat.size));\n const rl = createInterface({ input: stream });\n rl.on('line', (line) => this.parseDnsLine(line));\n rl.on('close', () => this.positions.set(path, stat.size));\n }\n\n private parseDnsLine(line: string): void {\n // systemd-resolved pattern: \"query[TXT] suspicious.domain.com from 192.168.1.1\"\n const resolvedMatch = line.match(/query\\[(\\w+)\\]\\s+(\\S+)\\s+from\\s+(\\S+)/i);\n if (resolvedMatch) {\n this.domainBuffer.push({\n type: resolvedMatch[1],\n domain: resolvedMatch[2],\n source_ip: resolvedMatch[3],\n timestamp: Date.now(),\n });\n return;\n }\n\n // dnsmasq pattern: \"query[TXT] suspicious.domain.com from 192.168.1.1\"\n const dnsmasqMatch = line.match(/query\\[(\\w+)\\]\\s+(\\S+)\\s+from\\s+(\\S+)/i);\n if (dnsmasqMatch) {\n this.domainBuffer.push({\n type: dnsmasqMatch[1],\n domain: dnsmasqMatch[2],\n source_ip: dnsmasqMatch[3],\n timestamp: Date.now(),\n });\n return;\n }\n\n // Generic DNS query log pattern\n const genericMatch = line.match(/(?:query|lookup|resolve)[:\\s]+(\\S+)/i);\n if (genericMatch) {\n const typeMatch = line.match(/type[:\\s]+(\\w+)/i);\n this.domainBuffer.push({\n type: typeMatch?.[1] || 'A',\n domain: genericMatch[1],\n timestamp: Date.now(),\n });\n }\n }\n\n private analyzeBuffer(): void {\n const now = Date.now();\n const cutoff = now - this.txtWindowMs;\n\n // Prune old entries\n this.domainBuffer = this.domainBuffer.filter(q => q.timestamp > cutoff);\n\n this.detectTunneling();\n this.detectDga();\n }\n\n private detectTunneling(): void {\n // Check for high TXT query volume from single source\n const txtBySource = new Map<string, number>();\n const longLabelDomains: string[] = [];\n\n for (const q of this.domainBuffer) {\n if (q.type === 'TXT') {\n const key = q.source_ip || 'unknown';\n txtBySource.set(key, (txtBySource.get(key) || 0) + 1);\n }\n\n // DNS tunneling uses abnormally long subdomain labels\n const labels = q.domain.split('.');\n const maxLabel = Math.max(...labels.map(l => l.length));\n if (maxLabel > 50) {\n longLabelDomains.push(q.domain);\n }\n }\n\n for (const [source, count] of txtBySource) {\n if (count >= this.txtRateThreshold) {\n this.emitEvent(\n 'high',\n `DNS tunneling indicators: ${count} TXT queries from ${source} in ${this.txtWindowMs / 1000}s`,\n source !== 'unknown' ? source : undefined,\n { txt_query_count: count, type: 'tunneling' },\n );\n }\n }\n\n if (longLabelDomains.length >= 5) {\n this.emitEvent(\n 'high',\n `DNS tunneling: ${longLabelDomains.length} queries with abnormally long labels detected`,\n undefined,\n { domains: longLabelDomains.slice(0, 5), type: 'tunneling-labels' },\n );\n }\n }\n\n private detectDga(): void {\n // Find domains with high entropy (DGA-like)\n const highEntropyDomains: string[] = [];\n\n for (const q of this.domainBuffer) {\n const domain = q.domain.toLowerCase();\n // Extract the second-level domain\n const parts = domain.split('.');\n if (parts.length < 2) continue;\n const sld = parts[parts.length - 2];\n\n if (sld.length >= 8 && this.shannonEntropy(sld) >= this.entropyThreshold) {\n highEntropyDomains.push(domain);\n }\n }\n\n // Deduplicate\n const unique = [...new Set(highEntropyDomains)];\n if (unique.length >= this.dgaBurstThreshold) {\n this.emitEvent(\n 'critical',\n `DGA-like domain burst: ${unique.length} unique high-entropy domains detected`,\n undefined,\n { sample_domains: unique.slice(0, 10), type: 'dga', unique_count: unique.length },\n );\n }\n }\n\n private shannonEntropy(str: string): number {\n const freq = new Map<string, number>();\n for (const ch of str) {\n freq.set(ch, (freq.get(ch) || 0) + 1);\n }\n let entropy = 0;\n for (const count of freq.values()) {\n const p = count / str.length;\n if (p > 0) entropy -= p * Math.log2(p);\n }\n return entropy;\n }\n\n private emitEvent(severity: EventSeverity, message: string, sourceIp?: string, details?: Record<string, unknown>): void {\n const event: ThreatEvent = {\n timestamp: new Date(),\n module: 'dns-monitor',\n category: 'network',\n severity,\n message,\n source_ip: sourceIp,\n details,\n };\n try { insertEvent(event); } catch { /* db optional */ }\n this.bus.publish(event);\n }\n}\n","import { readFileSync, existsSync, readdirSync } from 'node:fs';\nimport { join } from 'node:path';\nimport TOML from '@iarna/toml';\nimport type { ThreatCrushConfig, ModuleConfig } from '../types/config.js';\n\nconst DEFAULT_CONFIG_PATH = '/etc/threatcrush/threatcrushd.conf';\nconst DEFAULT_CONFDIR = '/etc/threatcrush/threatcrushd.conf.d';\n\nconst DEFAULT_CONFIG: ThreatCrushConfig = {\n daemon: {\n pid_file: '/var/run/threatcrush/threatcrushd.pid',\n log_level: 'info',\n log_file: '/var/log/threatcrush/threatcrushd.log',\n state_db: '/var/lib/threatcrush/state.db',\n },\n api: {\n enabled: true,\n bind: '127.0.0.1:9393',\n tls: false,\n },\n alerts: {},\n modules: {\n auto_update: true,\n update_interval: '24h',\n module_dir: '/etc/threatcrush/modules',\n config_dir: DEFAULT_CONFDIR,\n },\n};\n\nexport function loadConfig(configPath?: string): ThreatCrushConfig {\n const path = configPath || DEFAULT_CONFIG_PATH;\n if (!existsSync(path)) {\n return { ...DEFAULT_CONFIG };\n }\n\n try {\n const raw = readFileSync(path, 'utf-8');\n const parsed = TOML.parse(raw) as unknown as Partial<ThreatCrushConfig>;\n return {\n daemon: { ...DEFAULT_CONFIG.daemon, ...parsed.daemon },\n api: { ...DEFAULT_CONFIG.api, ...parsed.api },\n alerts: parsed.alerts || {},\n modules: { ...DEFAULT_CONFIG.modules, ...parsed.modules },\n license: parsed.license,\n };\n } catch {\n return { ...DEFAULT_CONFIG };\n }\n}\n\nexport function loadModuleConfigs(confDir?: string): Map<string, ModuleConfig> {\n const dir = confDir || DEFAULT_CONFDIR;\n const configs = new Map<string, ModuleConfig>();\n\n if (!existsSync(dir)) {\n return configs;\n }\n\n const files = readdirSync(dir).filter((f) => f.endsWith('.conf'));\n for (const file of files) {\n try {\n const raw = readFileSync(join(dir, file), 'utf-8');\n const parsed = TOML.parse(raw) as Record<string, unknown>;\n for (const [name, config] of Object.entries(parsed)) {\n configs.set(name, config as ModuleConfig);\n }\n } catch {\n // skip bad configs\n }\n }\n\n return configs;\n}\n\nexport function generateDefaultConfig(detectedServices: string[]): string {\n const config: Record<string, unknown> = {\n daemon: DEFAULT_CONFIG.daemon,\n api: DEFAULT_CONFIG.api,\n modules: DEFAULT_CONFIG.modules,\n };\n\n return TOML.stringify(config as any);\n}\n\nexport function generateModuleConfig(\n moduleName: string,\n defaults: Record<string, unknown> = {},\n): string {\n const config: Record<string, unknown> = {\n [moduleName]: {\n enabled: true,\n ...defaults,\n },\n };\n return TOML.stringify(config as any);\n}\n","import type { ThreatEvent } from '../../types/events.js';\n\ntype Mailer = {\n sendMail: (opts: Record<string, unknown>) => Promise<unknown>;\n};\n\nlet transporter: Mailer | null = null;\n// Lazy-load nodemailer so the CLI build doesn't pull it in when alerts are off.\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nlet nodemailer: any = null;\n\nexport interface SmtpConfig {\n host?: string;\n port?: number;\n secure?: boolean;\n user?: string;\n pass?: string;\n from?: string;\n to?: string[] | string;\n min_severity?: 'low' | 'medium' | 'high' | 'critical';\n}\n\nconst SEVERITY_RANK: Record<string, number> = {\n info: 0,\n low: 1,\n medium: 2,\n high: 3,\n critical: 4,\n};\n\nasync function ensureTransporter(config: SmtpConfig): Promise<Mailer | null> {\n if (!config.host || !config.from) return null;\n if (transporter) return transporter;\n\n if (!nodemailer) {\n try {\n nodemailer = await import('nodemailer');\n } catch {\n return null;\n }\n }\n\n transporter = nodemailer.createTransport({\n host: config.host,\n port: config.port ?? 587,\n secure: config.secure ?? false,\n auth: config.user && config.pass ? { user: config.user, pass: config.pass } : undefined,\n });\n return transporter;\n}\n\nfunction meetsSeverity(event: ThreatEvent, min?: SmtpConfig['min_severity']): boolean {\n if (!min) return true;\n return (SEVERITY_RANK[event.severity] ?? 0) >= (SEVERITY_RANK[min] ?? 0);\n}\n\nfunction renderBody(event: ThreatEvent): { text: string; html: string } {\n const ts = event.timestamp.toISOString();\n const ip = event.source_ip ? `\\nSource IP: ${event.source_ip}` : '';\n const text =\n `[${event.severity.toUpperCase()}] ${event.module}\\n\\n` +\n `${event.message}${ip}\\n\\n` +\n `When: ${ts}\\nCategory: ${event.category}`;\n const html =\n `<div style=\"font-family:system-ui,sans-serif;line-height:1.5\">` +\n `<h2 style=\"margin:0 0 8px\">⚠ ${event.severity.toUpperCase()} — ${event.module}</h2>` +\n `<p>${event.message}</p>` +\n (event.source_ip ? `<p><strong>Source IP:</strong> <code>${event.source_ip}</code></p>` : '') +\n `<p style=\"color:#888;margin-top:16px\"><small>${ts} · ${event.category}</small></p>` +\n `</div>`;\n return { text, html };\n}\n\nexport function smtpChannel(config: SmtpConfig): (event: ThreatEvent) => Promise<void> {\n return async (event) => {\n if (!meetsSeverity(event, config.min_severity)) return;\n const t = await ensureTransporter(config);\n if (!t) return;\n\n const to = Array.isArray(config.to) ? config.to.join(', ') : config.to;\n if (!to) return;\n\n const { text, html } = renderBody(event);\n await t.sendMail({\n from: config.from,\n to,\n subject: `[ThreatCrush ${event.severity}] ${event.module} — ${event.message.slice(0, 60)}`,\n text,\n html,\n });\n };\n}\n","import type { ThreatEvent } from '../../types/events.js';\n\nexport interface DiscordConfig {\n webhook_url: string;\n min_severity?: 'low' | 'medium' | 'high' | 'critical';\n}\n\nconst SEVERITY_RANK: Record<string, number> = {\n info: 0, low: 1, medium: 2, high: 3, critical: 4,\n};\n\nconst SEVERITY_COLORS: Record<string, number> = {\n info: 0x2ecc71, // green\n low: 0x3498db, // blue\n medium: 0xf39c12, // orange\n high: 0xe74c3c, // red\n critical: 0x9b59b6, // purple\n};\n\nexport function discordChannel(config: DiscordConfig): (event: ThreatEvent) => Promise<void> {\n return async (event) => {\n if (config.min_severity) {\n const eventRank = SEVERITY_RANK[event.severity] ?? 0;\n const minRank = SEVERITY_RANK[config.min_severity] ?? 0;\n if (eventRank < minRank) return;\n }\n\n const embed = {\n title: `${event.severity === 'critical' ? '🚨' : '⚠️'} [${event.severity.toUpperCase()}] ${event.module}`,\n description: event.message,\n color: SEVERITY_COLORS[event.severity] ?? 0xffffff,\n fields: [\n ...(event.source_ip ? [{ name: 'Source IP', value: `\\`${event.source_ip}\\``, inline: true }] : []),\n { name: 'Category', value: event.category, inline: true },\n { name: 'Time', value: event.timestamp.toISOString(), inline: true },\n ],\n footer: { text: 'ThreatCrush Security Alert' },\n };\n\n await fetch(config.webhook_url, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ embeds: [embed] }),\n });\n };\n}\n","import type { ThreatEvent } from '../../types/events.js';\n\nexport interface PagerDutyConfig {\n routing_key: string;\n min_severity?: 'low' | 'medium' | 'high' | 'critical';\n}\n\nconst SEVERITY_RANK: Record<string, number> = {\n info: 0, low: 1, medium: 2, high: 3, critical: 4,\n};\n\n// Map ThreatCrush severity to PagerDuty severity\nconst PD_SEVERITY: Record<string, string> = {\n info: 'info',\n low: 'info',\n medium: 'warning',\n high: 'error',\n critical: 'critical',\n};\n\nexport function pagerdutyChannel(config: PagerDutyConfig): (event: ThreatEvent) => Promise<void> {\n return async (event) => {\n if (config.min_severity) {\n const eventRank = SEVERITY_RANK[event.severity] ?? 0;\n const minRank = SEVERITY_RANK[config.min_severity] ?? 0;\n if (eventRank < minRank) return;\n }\n\n const payload = {\n routing_key: config.routing_key,\n event_action: 'trigger',\n payload: {\n summary: `[${event.severity.toUpperCase()}] ${event.module}: ${event.message}`,\n source: 'threatcrush',\n severity: PD_SEVERITY[event.severity] || 'warning',\n timestamp: event.timestamp.toISOString(),\n custom_details: {\n module: event.module,\n category: event.category,\n source_ip: event.source_ip,\n details: event.details,\n },\n },\n };\n\n await fetch('https://events.pagerduty.com/v2/enqueue', {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify(payload),\n });\n };\n}\n","import type { ThreatCrushConfig, AlertChannelConfig } from '../../types/config.js';\nimport type { ThreatEvent } from '../../types/events.js';\nimport type { EventBus } from '../event-bus.js';\nimport { smtpChannel, type SmtpConfig } from './smtp.js';\nimport { discordChannel, type DiscordConfig } from './discord.js';\nimport { pagerdutyChannel, type PagerDutyConfig } from './pagerduty.js';\n\ntype Channel = (event: ThreatEvent) => Promise<void>;\n\nexport class AlertDispatcher {\n private channels: Channel[] = [];\n private rateLimits = new Map<string, number[]>();\n\n constructor(private bus: EventBus, private config: ThreatCrushConfig) {\n this.bindChannels();\n bus.on('alert', (event) => { void this.dispatch(event); });\n }\n\n private bindChannels(): void {\n const alerts = this.config.alerts || {};\n for (const [name, raw] of Object.entries(alerts)) {\n const cfg = raw as AlertChannelConfig;\n if (!cfg.enabled) continue;\n if (name === 'webhook' && typeof cfg.url === 'string') {\n this.channels.push(webhookChannel(cfg.url, cfg.secret as string | undefined));\n }\n if (name === 'slack' && typeof cfg.webhook_url === 'string') {\n this.channels.push(slackChannel(cfg.webhook_url));\n }\n if (name === 'email' && typeof cfg.host === 'string' && typeof cfg.from === 'string') {\n this.channels.push(smtpChannel(cfg as unknown as SmtpConfig));\n }\n if (name === 'discord' && typeof cfg.webhook_url === 'string') {\n this.channels.push(discordChannel(cfg as unknown as DiscordConfig));\n }\n if (name === 'pagerduty' && typeof cfg.routing_key === 'string') {\n this.channels.push(pagerdutyChannel(cfg as unknown as PagerDutyConfig));\n }\n }\n }\n\n private checkRateLimit(channelIdx: number, maxPerHour: number = 60): boolean {\n const key = String(channelIdx);\n const now = Date.now();\n const hour = 3600_000;\n let timestamps = this.rateLimits.get(key) || [];\n timestamps = timestamps.filter(t => t > now - hour);\n if (timestamps.length >= maxPerHour) return false;\n timestamps.push(now);\n this.rateLimits.set(key, timestamps);\n return true;\n }\n\n private async dispatch(event: ThreatEvent): Promise<void> {\n await Promise.all(this.channels.map((ch, idx) => {\n if (!this.checkRateLimit(idx)) return Promise.resolve();\n return ch(event).catch(() => {});\n }));\n }\n}\n\nfunction webhookChannel(url: string, secret?: string): Channel {\n return async (event) => {\n const body = JSON.stringify({ event });\n const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n if (secret) headers['X-Threatcrush-Signature'] = secret;\n await fetch(url, { method: 'POST', headers, body });\n };\n}\n\nfunction slackChannel(webhookUrl: string): Channel {\n return async (event) => {\n const emoji = event.severity === 'critical' ? ':rotating_light:' : ':warning:';\n const text = `${emoji} *[${event.severity.toUpperCase()}]* \\`${event.module}\\` — ${event.message}${event.source_ip ? ` (from ${event.source_ip})` : ''}`;\n await fetch(webhookUrl, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ text }),\n });\n };\n}\n","import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\n\nexport const CLI_CONFIG_DIR = join(homedir(), '.threatcrush');\nexport const CLI_CONFIG_PATH = join(CLI_CONFIG_DIR, 'config.json');\n\nexport interface CliConfig {\n email?: string;\n user_id?: string;\n token?: string;\n refresh_token?: string;\n expires_at?: number;\n display_name?: string;\n current_org_id?: string;\n current_org_slug?: string;\n}\n\nexport function readCliConfig(): CliConfig {\n try {\n return JSON.parse(readFileSync(CLI_CONFIG_PATH, 'utf-8')) as CliConfig;\n } catch {\n return {};\n }\n}\n\nexport function writeCliConfig(config: CliConfig): void {\n if (!existsSync(CLI_CONFIG_DIR)) mkdirSync(CLI_CONFIG_DIR, { recursive: true });\n writeFileSync(CLI_CONFIG_PATH, JSON.stringify(config, null, 2), 'utf-8');\n try { chmodSync(CLI_CONFIG_PATH, 0o600); } catch { /* non-posix */ }\n}\n\nexport function updateCliConfig(patch: Partial<CliConfig>): CliConfig {\n const current = readCliConfig();\n const next = { ...current, ...patch };\n writeCliConfig(next);\n return next;\n}\n\nexport function clearCliConfig(keys?: Array<keyof CliConfig>): void {\n const current = readCliConfig();\n if (!keys) {\n writeCliConfig({});\n return;\n }\n for (const key of keys) delete current[key];\n writeCliConfig(current);\n}\n\nexport function isLoggedIn(): boolean {\n const cfg = readCliConfig();\n if (!cfg.token) return false;\n if (cfg.expires_at && cfg.expires_at * 1000 < Date.now()) return false;\n return true;\n}\n\nexport function authHeaders(): Record<string, string> {\n const cfg = readCliConfig();\n const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n if (cfg.token) headers['Authorization'] = `Bearer ${cfg.token}`;\n return headers;\n}\n","import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { dirname, join, resolve } from 'node:path';\nimport chalk from 'chalk';\nimport ora from 'ora';\nimport { banner, logger } from '../core/logger.js';\nimport type { RunResult, StructuredFinding } from '../core/run-result.js';\nimport { summarize } from '../core/run-result.js';\nimport { meetsFailThreshold, SEVERITY_ORDER } from '@threatcrush/scan';\nimport type { ScanFinding, Severity } from '@threatcrush/scan';\nimport { buildSarif, scanDependencies, scanPath } from '@threatcrush/scan/node';\n\nexport type ScanFormat = 'text' | 'json' | 'sarif';\n\nexport interface ScanCommandOptions {\n /**\n * `text` for humans, `sarif` for the Security tab and coverage validators,\n * `json` for anything else. Non-text formats put the payload on stdout (or\n * `--output`) and every human line on stderr, so\n * `threatcrush scan --format sarif > out.sarif` produces a valid file.\n */\n format?: ScanFormat;\n /** Write the machine-readable payload here instead of stdout. */\n output?: string;\n /** Exit non-zero when a finding at or above one of these severities exists. */\n failOn?: readonly Severity[];\n /** Prefix prepended to SARIF URIs when the scan root is not the repo root. */\n pathPrefix?: string;\n /** Print the paths that could not be read, not just the count. */\n verbose?: boolean;\n /**\n * Query OSV.dev for advisories against the resolved lockfile versions.\n * Off by default in the CLI because it is the only part of a scan that\n * needs the network — a CI job should opt in deliberately rather than\n * discover the dependency mid-run.\n */\n dependencies?: boolean;\n /** Globs to skip, merged with any `.threatcrushignore` at the scan root. */\n exclude?: readonly string[];\n /**\n * Also report security controls the tree shows no evidence of — headers,\n * CSRF, rate limiting, body size limits.\n *\n * Off by default, and deliberately so. Every other finding points at a line;\n * these point at an absence, which a reverse proxy or a gateway may already\n * be covering from outside the repository. Opt-in keeps a normal scan made\n * only of things that are actually there.\n */\n missingControls?: boolean;\n}\n\ninterface ScanOutcome {\n result: RunResult;\n findings: ScanFinding[];\n filesScanned: number;\n unreadable: string[];\n suppressed: number;\n excluded: number;\n root: string;\n}\n\nfunction readVersion(): string {\n for (const candidate of [\n join(__dirname, '..', 'package.json'),\n join(__dirname, '..', '..', 'package.json'),\n ]) {\n try {\n return (\n (JSON.parse(readFileSync(candidate, 'utf-8')) as { version?: string }).version ?? '0.0.0'\n );\n } catch {\n /* try the next candidate */\n }\n }\n return '0.0.0';\n}\n\nconst PKG_VERSION = readVersion();\n\n/** Parse `--fail-on critical,high` into severities, rejecting unknown names. */\nexport function parseFailOn(raw: string | undefined): Severity[] {\n if (!raw) return [];\n const requested = raw\n .split(',')\n .map((part) => part.trim().toLowerCase())\n .filter(Boolean);\n\n const unknown = requested.filter((name) => !SEVERITY_ORDER.includes(name as Severity));\n if (unknown.length > 0) {\n throw new Error(\n `unknown severity in --fail-on: ${unknown.join(', ')} (expected ${SEVERITY_ORDER.join(', ')})`,\n );\n }\n return requested as Severity[];\n}\n\nfunction toRunResult(\n targetPath: string,\n findings: readonly ScanFinding[],\n filesScanned: number,\n): RunResult {\n const structured: StructuredFinding[] = findings.map((finding) => ({\n type: finding.title,\n severity: finding.severity,\n message: finding.message,\n location: `${finding.file}:${finding.line}`,\n details: {\n file: finding.file,\n line: finding.line,\n snippet: finding.excerpt,\n ruleId: finding.ruleId,\n confidence: finding.confidence,\n ...(finding.cwe ? { cwe: finding.cwe } : {}),\n },\n }));\n const counts = summarize(structured);\n\n return {\n type: 'scan',\n target: targetPath,\n findings: structured,\n severity_summary: counts,\n summary:\n findings.length === 0\n ? `No issues found across ${filesScanned} files`\n : `${findings.length} issue(s): ${counts.critical}C ${counts.high}H ${counts.medium}M ${counts.low}L`,\n };\n}\n\nfunction failedResult(targetPath: string, message: string): RunResult {\n return {\n type: 'scan',\n target: targetPath,\n findings: [],\n severity_summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },\n summary: `Scan failed: ${message}`,\n error: message,\n };\n}\n\n/**\n * Non-interactive scan used by the daemon and the runs worker.\n *\n * Includes dependency advisories, as it always has — the daemon runs on a\n * schedule against a server it can reach the network from, and an advisory\n * published since the last run is the main thing that changed.\n */\nexport async function runScan(targetPath: string): Promise<RunResult> {\n try {\n const report = scanPath(targetPath);\n const findings = [...report.findings, ...(await scanDependencies(targetPath))];\n return toRunResult(targetPath, findings, report.filesScanned);\n } catch (err) {\n return failedResult(targetPath, (err as Error).message);\n }\n}\n\nexport async function scanCommand(\n targetPath: string,\n options: ScanCommandOptions = {},\n): Promise<RunResult> {\n const format = options.format ?? 'text';\n const machineReadable = format !== 'text';\n // Human output goes to stderr whenever stdout is carrying a payload. A\n // banner in the middle of a SARIF document is exactly how \"the scan worked\n // but the pipeline reports zero findings\" happens.\n const say = machineReadable\n ? (line: string) => process.stderr.write(`${line}\\n`)\n : (line: string) => process.stdout.write(`${line}\\n`);\n\n if (!existsSync(targetPath)) {\n say(chalk.red(`Scan target does not exist: ${targetPath}`));\n process.exitCode = 2;\n return failedResult(targetPath, `no such path: ${targetPath}`);\n }\n\n if (!machineReadable) {\n banner();\n logger.info(`Scanning ${chalk.white(targetPath)} for security issues...\\n`);\n }\n\n const spinner = machineReadable ? null : ora({ text: 'Scanning files...', color: 'green' }).start();\n\n let outcome: ScanOutcome;\n try {\n let seen = 0;\n const report = scanPath(targetPath, {\n exclude: options.exclude,\n missingControls: options.missingControls,\n onFile: () => {\n seen += 1;\n if (spinner) spinner.text = `Scanning files... (${seen} files)`;\n },\n });\n if (options.dependencies) {\n if (spinner) spinner.text = 'Querying OSV.dev for dependency advisories...';\n report.findings.push(...(await scanDependencies(targetPath)));\n }\n outcome = {\n result: toRunResult(targetPath, report.findings, report.filesScanned),\n findings: report.findings,\n filesScanned: report.filesScanned,\n unreadable: report.unreadable,\n suppressed: report.suppressed,\n excluded: report.excluded,\n root: report.root,\n };\n } catch (err) {\n spinner?.fail(`Scan failed: ${(err as Error).message}`);\n process.exitCode = 2;\n return failedResult(targetPath, (err as Error).message);\n }\n\n spinner?.succeed(`Scanned ${outcome.filesScanned} files\\n`);\n\n if (outcome.unreadable.length > 0) {\n // Surfaced, never swallowed. An unexamined file is not a clean one, and a\n // scanner that hides read failures reports silence as safety.\n say(\n chalk.yellow(\n ` ! ${outcome.unreadable.length} path(s) could not be read and were NOT scanned`,\n ),\n );\n if (options.verbose) {\n for (const path of outcome.unreadable) say(chalk.gray(` ${path}`));\n }\n }\n\n if (outcome.excluded > 0) {\n say(\n chalk.gray(\n ` · ${outcome.excluded} path(s) excluded by --exclude or .threatcrushignore`,\n ),\n );\n }\n\n if (outcome.suppressed > 0) {\n say(\n chalk.gray(\n ` · ${outcome.suppressed} finding(s) suppressed by inline threatcrush-disable comments`,\n ),\n );\n }\n\n if (machineReadable) {\n emitMachineReadable(format, outcome, targetPath, options, say);\n } else {\n printHuman(outcome);\n }\n\n const failOn = options.failOn ?? [];\n if (meetsFailThreshold(outcome.findings, failOn)) {\n say(\n chalk.red(\n `\\n ✗ findings at or above ${[...failOn].join('/')} — failing as requested by --fail-on`,\n ),\n );\n process.exitCode = 1;\n }\n\n return outcome.result;\n}\n\nfunction emitMachineReadable(\n format: ScanFormat,\n outcome: ScanOutcome,\n targetPath: string,\n options: ScanCommandOptions,\n say: (line: string) => void,\n): void {\n const payload =\n format === 'sarif'\n ? buildSarif(outcome.findings, {\n toolVersion: PKG_VERSION,\n pathPrefix: options.pathPrefix,\n // Relative to the working directory, NOT the scan root. `threatcrush\n // scan vulns` from a repo root must emit `vulns/secrets/x.env`, not\n // `secrets/x.env` — the second form matches nothing in the\n // consumer's view of the repository, so every finding lands\n // \"outside\" whatever it scoped to and a working scan reads as 0%.\n // This is the single most expensive mistake in the whole pipeline\n // and it fails silently. `--path-prefix` covers the remaining case:\n // a scan run from inside the subdirectory it is scanning.\n base: process.cwd(),\n root: resolve(outcome.root),\n })\n : {\n tool: 'threatcrush',\n version: PKG_VERSION,\n target: targetPath,\n filesScanned: outcome.filesScanned,\n unreadable: outcome.unreadable,\n suppressed: outcome.suppressed,\n summary: outcome.result.severity_summary,\n findings: outcome.findings,\n };\n\n const serialized = `${JSON.stringify(payload, null, 2)}\\n`;\n\n if (options.output) {\n mkdirSync(dirname(resolve(options.output)), { recursive: true });\n writeFileSync(options.output, serialized, 'utf-8');\n say(\n chalk.gray(\n ` ${format.toUpperCase()} written to ${options.output} (${outcome.findings.length} finding(s))`,\n ),\n );\n return;\n }\n process.stdout.write(serialized);\n}\n\nfunction printHuman(outcome: ScanOutcome): void {\n const { findings, filesScanned } = outcome;\n\n if (findings.length === 0) {\n console.log(chalk.green.bold(' ✓ No security issues found!'));\n console.log();\n return;\n }\n\n const counts = outcome.result.severity_summary;\n console.log(chalk.white.bold(' Scan Results'));\n console.log(chalk.gray(' ' + '─'.repeat(70)));\n console.log(\n ` ${chalk.red.bold(counts.critical + ' critical')} ` +\n `${chalk.red(counts.high + ' high')} ` +\n `${chalk.yellow(counts.medium + ' medium')} ` +\n `${chalk.gray(counts.low + ' low')}`,\n );\n console.log(chalk.gray(' ' + '─'.repeat(70)));\n console.log();\n\n for (const finding of findings) {\n const label = finding.severity.toUpperCase();\n const badge =\n finding.severity === 'critical'\n ? chalk.bgRed.white.bold(` ${label} `)\n : finding.severity === 'high'\n ? chalk.red(`[${label}]`)\n : finding.severity === 'medium'\n ? chalk.yellow(`[${label}]`)\n : chalk.gray(`[${label}]`);\n\n console.log(` ${badge} ${chalk.white.bold(finding.title)}`);\n console.log(\n ` ${chalk.gray('File:')} ${chalk.cyan(finding.file)}:${chalk.yellow(String(finding.line))}`,\n );\n console.log(` ${chalk.gray('Info:')} ${finding.message}`);\n if (finding.consequence) {\n console.log(` ${chalk.gray('Risk:')} ${chalk.dim(finding.consequence)}`);\n }\n if (finding.excerpt) {\n console.log(` ${chalk.gray('Code:')} ${finding.excerpt}`);\n }\n console.log(\n ` ${chalk.gray('Rule:')} ${chalk.dim(finding.ruleId)}` +\n (finding.cwe ? chalk.dim(` · ${finding.cwe}`) : '') +\n chalk.dim(` · confidence: ${finding.confidence}`),\n );\n console.log();\n }\n\n console.log(chalk.gray(' ' + '─'.repeat(70)));\n console.log(\n ` ${chalk.white.bold(`${findings.length} issue(s) found`)} across ${filesScanned} files`,\n );\n console.log();\n}\n","const ANSI_BACKGROUND_OFFSET = 10;\n\nconst wrapAnsi16 = (offset = 0) => code => `\\u001B[${code + offset}m`;\n\nconst wrapAnsi256 = (offset = 0) => code => `\\u001B[${38 + offset};5;${code}m`;\n\nconst wrapAnsi16m = (offset = 0) => (red, green, blue) => `\\u001B[${38 + offset};2;${red};${green};${blue}m`;\n\nconst styles = {\n\tmodifier: {\n\t\treset: [0, 0],\n\t\t// 21 isn't widely supported and 22 does the same thing\n\t\tbold: [1, 22],\n\t\tdim: [2, 22],\n\t\titalic: [3, 23],\n\t\tunderline: [4, 24],\n\t\toverline: [53, 55],\n\t\tinverse: [7, 27],\n\t\thidden: [8, 28],\n\t\tstrikethrough: [9, 29],\n\t},\n\tcolor: {\n\t\tblack: [30, 39],\n\t\tred: [31, 39],\n\t\tgreen: [32, 39],\n\t\tyellow: [33, 39],\n\t\tblue: [34, 39],\n\t\tmagenta: [35, 39],\n\t\tcyan: [36, 39],\n\t\twhite: [37, 39],\n\n\t\t// Bright color\n\t\tblackBright: [90, 39],\n\t\tgray: [90, 39], // Alias of `blackBright`\n\t\tgrey: [90, 39], // Alias of `blackBright`\n\t\tredBright: [91, 39],\n\t\tgreenBright: [92, 39],\n\t\tyellowBright: [93, 39],\n\t\tblueBright: [94, 39],\n\t\tmagentaBright: [95, 39],\n\t\tcyanBright: [96, 39],\n\t\twhiteBright: [97, 39],\n\t},\n\tbgColor: {\n\t\tbgBlack: [40, 49],\n\t\tbgRed: [41, 49],\n\t\tbgGreen: [42, 49],\n\t\tbgYellow: [43, 49],\n\t\tbgBlue: [44, 49],\n\t\tbgMagenta: [45, 49],\n\t\tbgCyan: [46, 49],\n\t\tbgWhite: [47, 49],\n\n\t\t// Bright color\n\t\tbgBlackBright: [100, 49],\n\t\tbgGray: [100, 49], // Alias of `bgBlackBright`\n\t\tbgGrey: [100, 49], // Alias of `bgBlackBright`\n\t\tbgRedBright: [101, 49],\n\t\tbgGreenBright: [102, 49],\n\t\tbgYellowBright: [103, 49],\n\t\tbgBlueBright: [104, 49],\n\t\tbgMagentaBright: [105, 49],\n\t\tbgCyanBright: [106, 49],\n\t\tbgWhiteBright: [107, 49],\n\t},\n};\n\nexport const modifierNames = Object.keys(styles.modifier);\nexport const foregroundColorNames = Object.keys(styles.color);\nexport const backgroundColorNames = Object.keys(styles.bgColor);\nexport const colorNames = [...foregroundColorNames, ...backgroundColorNames];\n\nfunction assembleStyles() {\n\tconst codes = new Map();\n\n\tfor (const [groupName, group] of Object.entries(styles)) {\n\t\tfor (const [styleName, style] of Object.entries(group)) {\n\t\t\tstyles[styleName] = {\n\t\t\t\topen: `\\u001B[${style[0]}m`,\n\t\t\t\tclose: `\\u001B[${style[1]}m`,\n\t\t\t};\n\n\t\t\tgroup[styleName] = styles[styleName];\n\n\t\t\tcodes.set(style[0], style[1]);\n\t\t}\n\n\t\tObject.defineProperty(styles, groupName, {\n\t\t\tvalue: group,\n\t\t\tenumerable: false,\n\t\t});\n\t}\n\n\tObject.defineProperty(styles, 'codes', {\n\t\tvalue: codes,\n\t\tenumerable: false,\n\t});\n\n\tstyles.color.close = '\\u001B[39m';\n\tstyles.bgColor.close = '\\u001B[49m';\n\n\tstyles.color.ansi = wrapAnsi16();\n\tstyles.color.ansi256 = wrapAnsi256();\n\tstyles.color.ansi16m = wrapAnsi16m();\n\tstyles.bgColor.ansi = wrapAnsi16(ANSI_BACKGROUND_OFFSET);\n\tstyles.bgColor.ansi256 = wrapAnsi256(ANSI_BACKGROUND_OFFSET);\n\tstyles.bgColor.ansi16m = wrapAnsi16m(ANSI_BACKGROUND_OFFSET);\n\n\t// From https://github.com/Qix-/color-convert/blob/3f0e0d4e92e235796ccb17f6e85c72094a651f49/conversions.js\n\tObject.defineProperties(styles, {\n\t\trgbToAnsi256: {\n\t\t\tvalue(red, green, blue) {\n\t\t\t\t// We use the extended greyscale palette here, with the exception of\n\t\t\t\t// black and white. normal palette only has 4 greyscale shades.\n\t\t\t\tif (red === green && green === blue) {\n\t\t\t\t\tif (red < 8) {\n\t\t\t\t\t\treturn 16;\n\t\t\t\t\t}\n\n\t\t\t\t\tif (red > 248) {\n\t\t\t\t\t\treturn 231;\n\t\t\t\t\t}\n\n\t\t\t\t\treturn Math.round(((red - 8) / 247) * 24) + 232;\n\t\t\t\t}\n\n\t\t\t\treturn 16\n\t\t\t\t\t+ (36 * Math.round(red / 255 * 5))\n\t\t\t\t\t+ (6 * Math.round(green / 255 * 5))\n\t\t\t\t\t+ Math.round(blue / 255 * 5);\n\t\t\t},\n\t\t\tenumerable: false,\n\t\t},\n\t\thexToRgb: {\n\t\t\tvalue(hex) {\n\t\t\t\tconst matches = /[a-f\\d]{6}|[a-f\\d]{3}/i.exec(hex.toString(16));\n\t\t\t\tif (!matches) {\n\t\t\t\t\treturn [0, 0, 0];\n\t\t\t\t}\n\n\t\t\t\tlet [colorString] = matches;\n\n\t\t\t\tif (colorString.length === 3) {\n\t\t\t\t\tcolorString = [...colorString].map(character => character + character).join('');\n\t\t\t\t}\n\n\t\t\t\tconst integer = Number.parseInt(colorString, 16);\n\n\t\t\t\treturn [\n\t\t\t\t\t/* eslint-disable no-bitwise */\n\t\t\t\t\t(integer >> 16) & 0xFF,\n\t\t\t\t\t(integer >> 8) & 0xFF,\n\t\t\t\t\tinteger & 0xFF,\n\t\t\t\t\t/* eslint-enable no-bitwise */\n\t\t\t\t];\n\t\t\t},\n\t\t\tenumerable: false,\n\t\t},\n\t\thexToAnsi256: {\n\t\t\tvalue: hex => styles.rgbToAnsi256(...styles.hexToRgb(hex)),\n\t\t\tenumerable: false,\n\t\t},\n\t\tansi256ToAnsi: {\n\t\t\tvalue(code) {\n\t\t\t\tif (code < 8) {\n\t\t\t\t\treturn 30 + code;\n\t\t\t\t}\n\n\t\t\t\tif (code < 16) {\n\t\t\t\t\treturn 90 + (code - 8);\n\t\t\t\t}\n\n\t\t\t\tlet red;\n\t\t\t\tlet green;\n\t\t\t\tlet blue;\n\n\t\t\t\tif (code >= 232) {\n\t\t\t\t\tred = (((code - 232) * 10) + 8) / 255;\n\t\t\t\t\tgreen = red;\n\t\t\t\t\tblue = red;\n\t\t\t\t} else {\n\t\t\t\t\tcode -= 16;\n\n\t\t\t\t\tconst remainder = code % 36;\n\n\t\t\t\t\tred = Math.floor(code / 36) / 5;\n\t\t\t\t\tgreen = Math.floor(remainder / 6) / 5;\n\t\t\t\t\tblue = (remainder % 6) / 5;\n\t\t\t\t}\n\n\t\t\t\tconst value = Math.max(red, green, blue) * 2;\n\n\t\t\t\tif (value === 0) {\n\t\t\t\t\treturn 30;\n\t\t\t\t}\n\n\t\t\t\t// eslint-disable-next-line no-bitwise\n\t\t\t\tlet result = 30 + ((Math.round(blue) << 2) | (Math.round(green) << 1) | Math.round(red));\n\n\t\t\t\tif (value === 2) {\n\t\t\t\t\tresult += 60;\n\t\t\t\t}\n\n\t\t\t\treturn result;\n\t\t\t},\n\t\t\tenumerable: false,\n\t\t},\n\t\trgbToAnsi: {\n\t\t\tvalue: (red, green, blue) => styles.ansi256ToAnsi(styles.rgbToAnsi256(red, green, blue)),\n\t\t\tenumerable: false,\n\t\t},\n\t\thexToAnsi: {\n\t\t\tvalue: hex => styles.ansi256ToAnsi(styles.hexToAnsi256(hex)),\n\t\t\tenumerable: false,\n\t\t},\n\t});\n\n\treturn styles;\n}\n\nconst ansiStyles = assembleStyles();\n\nexport default ansiStyles;\n","import process from 'node:process';\nimport os from 'node:os';\nimport tty from 'node:tty';\n\n// From: https://github.com/sindresorhus/has-flag/blob/main/index.js\n/// function hasFlag(flag, argv = globalThis.Deno?.args ?? process.argv) {\nfunction hasFlag(flag, argv = globalThis.Deno ? globalThis.Deno.args : process.argv) {\n\tconst prefix = flag.startsWith('-') ? '' : (flag.length === 1 ? '-' : '--');\n\tconst position = argv.indexOf(prefix + flag);\n\tconst terminatorPosition = argv.indexOf('--');\n\treturn position !== -1 && (terminatorPosition === -1 || position < terminatorPosition);\n}\n\nconst {env} = process;\n\nlet flagForceColor;\nif (\n\thasFlag('no-color')\n\t|| hasFlag('no-colors')\n\t|| hasFlag('color=false')\n\t|| hasFlag('color=never')\n) {\n\tflagForceColor = 0;\n} else if (\n\thasFlag('color')\n\t|| hasFlag('colors')\n\t|| hasFlag('color=true')\n\t|| hasFlag('color=always')\n) {\n\tflagForceColor = 1;\n}\n\nfunction envForceColor() {\n\tif ('FORCE_COLOR' in env) {\n\t\tif (env.FORCE_COLOR === 'true') {\n\t\t\treturn 1;\n\t\t}\n\n\t\tif (env.FORCE_COLOR === 'false') {\n\t\t\treturn 0;\n\t\t}\n\n\t\treturn env.FORCE_COLOR.length === 0 ? 1 : Math.min(Number.parseInt(env.FORCE_COLOR, 10), 3);\n\t}\n}\n\nfunction translateLevel(level) {\n\tif (level === 0) {\n\t\treturn false;\n\t}\n\n\treturn {\n\t\tlevel,\n\t\thasBasic: true,\n\t\thas256: level >= 2,\n\t\thas16m: level >= 3,\n\t};\n}\n\nfunction _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {\n\tconst noFlagForceColor = envForceColor();\n\tif (noFlagForceColor !== undefined) {\n\t\tflagForceColor = noFlagForceColor;\n\t}\n\n\tconst forceColor = sniffFlags ? flagForceColor : noFlagForceColor;\n\n\tif (forceColor === 0) {\n\t\treturn 0;\n\t}\n\n\tif (sniffFlags) {\n\t\tif (hasFlag('color=16m')\n\t\t\t|| hasFlag('color=full')\n\t\t\t|| hasFlag('color=truecolor')) {\n\t\t\treturn 3;\n\t\t}\n\n\t\tif (hasFlag('color=256')) {\n\t\t\treturn 2;\n\t\t}\n\t}\n\n\t// Check for Azure DevOps pipelines.\n\t// Has to be above the `!streamIsTTY` check.\n\tif ('TF_BUILD' in env && 'AGENT_NAME' in env) {\n\t\treturn 1;\n\t}\n\n\tif (haveStream && !streamIsTTY && forceColor === undefined) {\n\t\treturn 0;\n\t}\n\n\tconst min = forceColor || 0;\n\n\tif (env.TERM === 'dumb') {\n\t\treturn min;\n\t}\n\n\tif (process.platform === 'win32') {\n\t\t// Windows 10 build 10586 is the first Windows release that supports 256 colors.\n\t\t// Windows 10 build 14931 is the first release that supports 16m/TrueColor.\n\t\tconst osRelease = os.release().split('.');\n\t\tif (\n\t\t\tNumber(osRelease[0]) >= 10\n\t\t\t&& Number(osRelease[2]) >= 10_586\n\t\t) {\n\t\t\treturn Number(osRelease[2]) >= 14_931 ? 3 : 2;\n\t\t}\n\n\t\treturn 1;\n\t}\n\n\tif ('CI' in env) {\n\t\tif (['GITHUB_ACTIONS', 'GITEA_ACTIONS', 'CIRCLECI'].some(key => key in env)) {\n\t\t\treturn 3;\n\t\t}\n\n\t\tif (['TRAVIS', 'APPVEYOR', 'GITLAB_CI', 'BUILDKITE', 'DRONE'].some(sign => sign in env) || env.CI_NAME === 'codeship') {\n\t\t\treturn 1;\n\t\t}\n\n\t\treturn min;\n\t}\n\n\tif ('TEAMCITY_VERSION' in env) {\n\t\treturn /^(9\\.(0*[1-9]\\d*)\\.|\\d{2,}\\.)/.test(env.TEAMCITY_VERSION) ? 1 : 0;\n\t}\n\n\tif (env.COLORTERM === 'truecolor') {\n\t\treturn 3;\n\t}\n\n\tif (env.TERM === 'xterm-kitty') {\n\t\treturn 3;\n\t}\n\n\tif (env.TERM === 'xterm-ghostty') {\n\t\treturn 3;\n\t}\n\n\tif (env.TERM === 'wezterm') {\n\t\treturn 3;\n\t}\n\n\tif ('TERM_PROGRAM' in env) {\n\t\tconst version = Number.parseInt((env.TERM_PROGRAM_VERSION || '').split('.')[0], 10);\n\n\t\tswitch (env.TERM_PROGRAM) {\n\t\t\tcase 'iTerm.app': {\n\t\t\t\treturn version >= 3 ? 3 : 2;\n\t\t\t}\n\n\t\t\tcase 'Apple_Terminal': {\n\t\t\t\treturn 2;\n\t\t\t}\n\t\t\t// No default\n\t\t}\n\t}\n\n\tif (/-256(color)?$/i.test(env.TERM)) {\n\t\treturn 2;\n\t}\n\n\tif (/^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux/i.test(env.TERM)) {\n\t\treturn 1;\n\t}\n\n\tif ('COLORTERM' in env) {\n\t\treturn 1;\n\t}\n\n\treturn min;\n}\n\nexport function createSupportsColor(stream, options = {}) {\n\tconst level = _supportsColor(stream, {\n\t\tstreamIsTTY: stream && stream.isTTY,\n\t\t...options,\n\t});\n\n\treturn translateLevel(level);\n}\n\nconst supportsColor = {\n\tstdout: createSupportsColor({isTTY: tty.isatty(1)}),\n\tstderr: createSupportsColor({isTTY: tty.isatty(2)}),\n};\n\nexport default supportsColor;\n","// TODO: When targeting Node.js 16, use `String.prototype.replaceAll`.\nexport function stringReplaceAll(string, substring, replacer) {\n\tlet index = string.indexOf(substring);\n\tif (index === -1) {\n\t\treturn string;\n\t}\n\n\tconst substringLength = substring.length;\n\tlet endIndex = 0;\n\tlet returnValue = '';\n\tdo {\n\t\treturnValue += string.slice(endIndex, index) + substring + replacer;\n\t\tendIndex = index + substringLength;\n\t\tindex = string.indexOf(substring, endIndex);\n\t} while (index !== -1);\n\n\treturnValue += string.slice(endIndex);\n\treturn returnValue;\n}\n\nexport function stringEncaseCRLFWithFirstIndex(string, prefix, postfix, index) {\n\tlet endIndex = 0;\n\tlet returnValue = '';\n\tdo {\n\t\tconst gotCR = string[index - 1] === '\\r';\n\t\treturnValue += string.slice(endIndex, (gotCR ? index - 1 : index)) + prefix + (gotCR ? '\\r\\n' : '\\n') + postfix;\n\t\tendIndex = index + 1;\n\t\tindex = string.indexOf('\\n', endIndex);\n\t} while (index !== -1);\n\n\treturnValue += string.slice(endIndex);\n\treturn returnValue;\n}\n","import ansiStyles from '#ansi-styles';\nimport supportsColor from '#supports-color';\nimport { // eslint-disable-line import/order\n\tstringReplaceAll,\n\tstringEncaseCRLFWithFirstIndex,\n} from './utilities.js';\n\nconst {stdout: stdoutColor, stderr: stderrColor} = supportsColor;\n\nconst GENERATOR = Symbol('GENERATOR');\nconst STYLER = Symbol('STYLER');\nconst IS_EMPTY = Symbol('IS_EMPTY');\n\n// `supportsColor.level` → `ansiStyles.color[name]` mapping\nconst levelMapping = [\n\t'ansi',\n\t'ansi',\n\t'ansi256',\n\t'ansi16m',\n];\n\nconst styles = Object.create(null);\n\nconst applyOptions = (object, options = {}) => {\n\tif (options.level && !(Number.isInteger(options.level) && options.level >= 0 && options.level <= 3)) {\n\t\tthrow new Error('The `level` option should be an integer from 0 to 3');\n\t}\n\n\t// Detect level if not set manually\n\tconst colorLevel = stdoutColor ? stdoutColor.level : 0;\n\tobject.level = options.level === undefined ? colorLevel : options.level;\n};\n\nexport class Chalk {\n\tconstructor(options) {\n\t\t// eslint-disable-next-line no-constructor-return\n\t\treturn chalkFactory(options);\n\t}\n}\n\nconst chalkFactory = options => {\n\tconst chalk = (...strings) => strings.join(' ');\n\tapplyOptions(chalk, options);\n\n\tObject.setPrototypeOf(chalk, createChalk.prototype);\n\n\treturn chalk;\n};\n\nfunction createChalk(options) {\n\treturn chalkFactory(options);\n}\n\nObject.setPrototypeOf(createChalk.prototype, Function.prototype);\n\nfor (const [styleName, style] of Object.entries(ansiStyles)) {\n\tstyles[styleName] = {\n\t\tget() {\n\t\t\tconst builder = createBuilder(this, createStyler(style.open, style.close, this[STYLER]), this[IS_EMPTY]);\n\t\t\tObject.defineProperty(this, styleName, {value: builder});\n\t\t\treturn builder;\n\t\t},\n\t};\n}\n\nstyles.visible = {\n\tget() {\n\t\tconst builder = createBuilder(this, this[STYLER], true);\n\t\tObject.defineProperty(this, 'visible', {value: builder});\n\t\treturn builder;\n\t},\n};\n\nconst getModelAnsi = (model, level, type, ...arguments_) => {\n\tif (model === 'rgb') {\n\t\tif (level === 'ansi16m') {\n\t\t\treturn ansiStyles[type].ansi16m(...arguments_);\n\t\t}\n\n\t\tif (level === 'ansi256') {\n\t\t\treturn ansiStyles[type].ansi256(ansiStyles.rgbToAnsi256(...arguments_));\n\t\t}\n\n\t\treturn ansiStyles[type].ansi(ansiStyles.rgbToAnsi(...arguments_));\n\t}\n\n\tif (model === 'hex') {\n\t\treturn getModelAnsi('rgb', level, type, ...ansiStyles.hexToRgb(...arguments_));\n\t}\n\n\treturn ansiStyles[type][model](...arguments_);\n};\n\nconst usedModels = ['rgb', 'hex', 'ansi256'];\n\nfor (const model of usedModels) {\n\tstyles[model] = {\n\t\tget() {\n\t\t\tconst {level} = this;\n\t\t\treturn function (...arguments_) {\n\t\t\t\tconst styler = createStyler(getModelAnsi(model, levelMapping[level], 'color', ...arguments_), ansiStyles.color.close, this[STYLER]);\n\t\t\t\treturn createBuilder(this, styler, this[IS_EMPTY]);\n\t\t\t};\n\t\t},\n\t};\n\n\tconst bgModel = 'bg' + model[0].toUpperCase() + model.slice(1);\n\tstyles[bgModel] = {\n\t\tget() {\n\t\t\tconst {level} = this;\n\t\t\treturn function (...arguments_) {\n\t\t\t\tconst styler = createStyler(getModelAnsi(model, levelMapping[level], 'bgColor', ...arguments_), ansiStyles.bgColor.close, this[STYLER]);\n\t\t\t\treturn createBuilder(this, styler, this[IS_EMPTY]);\n\t\t\t};\n\t\t},\n\t};\n}\n\nconst proto = Object.defineProperties(() => {}, {\n\t...styles,\n\tlevel: {\n\t\tenumerable: true,\n\t\tget() {\n\t\t\treturn this[GENERATOR].level;\n\t\t},\n\t\tset(level) {\n\t\t\tthis[GENERATOR].level = level;\n\t\t},\n\t},\n});\n\nconst createStyler = (open, close, parent) => {\n\tlet openAll;\n\tlet closeAll;\n\tif (parent === undefined) {\n\t\topenAll = open;\n\t\tcloseAll = close;\n\t} else {\n\t\topenAll = parent.openAll + open;\n\t\tcloseAll = close + parent.closeAll;\n\t}\n\n\treturn {\n\t\topen,\n\t\tclose,\n\t\topenAll,\n\t\tcloseAll,\n\t\tparent,\n\t};\n};\n\nconst createBuilder = (self, _styler, _isEmpty) => {\n\t// Single argument is hot path, implicit coercion is faster than anything\n\t// eslint-disable-next-line no-implicit-coercion\n\tconst builder = (...arguments_) => applyStyle(builder, (arguments_.length === 1) ? ('' + arguments_[0]) : arguments_.join(' '));\n\n\t// We alter the prototype because we must return a function, but there is\n\t// no way to create a function with a different prototype\n\tObject.setPrototypeOf(builder, proto);\n\n\tbuilder[GENERATOR] = self;\n\tbuilder[STYLER] = _styler;\n\tbuilder[IS_EMPTY] = _isEmpty;\n\n\treturn builder;\n};\n\nconst applyStyle = (self, string) => {\n\tif (self.level <= 0 || !string) {\n\t\treturn self[IS_EMPTY] ? '' : string;\n\t}\n\n\tlet styler = self[STYLER];\n\n\tif (styler === undefined) {\n\t\treturn string;\n\t}\n\n\tconst {openAll, closeAll} = styler;\n\tif (string.includes('\\u001B')) {\n\t\twhile (styler !== undefined) {\n\t\t\t// Replace any instances already present with a re-opening code\n\t\t\t// otherwise only the part of the string until said closing code\n\t\t\t// will be colored, and the rest will simply be 'plain'.\n\t\t\tstring = stringReplaceAll(string, styler.close, styler.open);\n\n\t\t\tstyler = styler.parent;\n\t\t}\n\t}\n\n\t// We can move both next actions out of loop, because remaining actions in loop won't have\n\t// any/visible effect on parts we add here. Close the styling before a linebreak and reopen\n\t// after next line to fix a bleed issue on macOS: https://github.com/chalk/chalk/pull/92\n\tconst lfIndex = string.indexOf('\\n');\n\tif (lfIndex !== -1) {\n\t\tstring = stringEncaseCRLFWithFirstIndex(string, closeAll, openAll, lfIndex);\n\t}\n\n\treturn openAll + string + closeAll;\n};\n\nObject.defineProperties(createChalk.prototype, styles);\n\nconst chalk = createChalk();\nexport const chalkStderr = createChalk({level: stderrColor ? stderrColor.level : 0});\n\nexport {\n\tmodifierNames,\n\tforegroundColorNames,\n\tbackgroundColorNames,\n\tcolorNames,\n\n\t// TODO: Remove these aliases in the next major version\n\tmodifierNames as modifiers,\n\tforegroundColorNames as foregroundColors,\n\tbackgroundColorNames as backgroundColors,\n\tcolorNames as colors,\n} from './vendor/ansi-styles/index.js';\n\nexport {\n\tstdoutColor as supportsColor,\n\tstderrColor as supportsColorStderr,\n};\n\nexport default chalk;\n","import chalk from 'chalk';\nimport type { EventSeverity } from '../types/events.js';\n\nconst SEVERITY_COLORS: Record<EventSeverity, (s: string) => string> = {\n info: chalk.green,\n low: chalk.cyan,\n medium: chalk.yellow,\n high: chalk.red,\n critical: chalk.bgRed.white.bold,\n};\n\nconst LEVEL_COLORS: Record<string, (s: string) => string> = {\n debug: chalk.gray,\n info: chalk.green,\n warn: chalk.yellow,\n error: chalk.red,\n};\n\nexport function severityColor(severity: EventSeverity, text: string): string {\n return (SEVERITY_COLORS[severity] || chalk.white)(text);\n}\n\nexport function formatTimestamp(date: Date = new Date()): string {\n return chalk.gray(date.toISOString().replace('T', ' ').slice(0, 19));\n}\n\nexport function formatEvent(\n module: string,\n severity: EventSeverity,\n message: string,\n ip?: string,\n): string {\n const ts = formatTimestamp();\n const sev = severityColor(severity, `[${severity.toUpperCase()}]`.padEnd(10));\n const mod = chalk.cyan(`[${module}]`.padEnd(14));\n const src = ip ? chalk.magenta(` (${ip})`) : '';\n return `${ts} ${sev} ${mod} ${message}${src}`;\n}\n\nexport const logger = {\n debug: (msg: string) => console.log(`${formatTimestamp()} ${LEVEL_COLORS.debug('[DEBUG]')} ${msg}`),\n info: (msg: string) => console.log(`${formatTimestamp()} ${LEVEL_COLORS.info('[INFO]')} ${msg}`),\n warn: (msg: string) => console.log(`${formatTimestamp()} ${LEVEL_COLORS.warn('[WARN]')} ${msg}`),\n error: (msg: string) => console.error(`${formatTimestamp()} ${LEVEL_COLORS.error('[ERROR]')} ${msg}`),\n success: (msg: string) => console.log(`${formatTimestamp()} ${chalk.green('[OK]')} ${msg}`),\n threat: (msg: string, ip?: string) => {\n const src = ip ? chalk.magenta(` from ${ip}`) : '';\n console.log(`${formatTimestamp()} ${chalk.red.bold('[THREAT]')} ${chalk.red(msg)}${src}`);\n },\n};\n\nexport function banner(): void {\n console.log(chalk.green.bold(`\n ████████╗██╗ ██╗██████╗ ███████╗ █████╗ ████████╗ ██████╗██████╗ ██╗ ██╗███████╗██╗ ██╗\n ╚══██╔══╝██║ ██║██╔══██╗██╔════╝██╔══██╗╚══██╔══╝██╔════╝██╔══██╗██║ ██║██╔════╝██║ ██║\n ██║ ███████║██████╔╝█████╗ ███████║ ██║ ██║ ██████╔╝██║ ██║███████╗███████║\n ██║ ██╔══██║██╔══██╗██╔══╝ ██╔══██║ ██║ ██║ ██╔══██╗██║ ██║╚════██║██╔══██║\n ██║ ██║ ██║██║ ██║███████╗██║ ██║ ██║ ╚██████╗██║ ██║╚██████╔╝███████║██║ ██║\n ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝ ╚═════╝ ╚══════╝╚═╝ ╚═╝\n `));\n console.log(chalk.gray(' All-in-one security agent daemon — v0.1.0\\n'));\n}\n","import os from 'node:os';\n\nexport type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';\n\nexport interface StructuredFinding {\n type: string;\n severity: Severity;\n message: string;\n location?: string;\n details?: Record<string, unknown>;\n}\n\nexport interface RunResult {\n type: 'scan' | 'pentest';\n target: string;\n findings: StructuredFinding[];\n severity_summary: Record<Severity, number>;\n summary: string;\n error?: string;\n}\n\nexport function emptyCounts(): Record<Severity, number> {\n return { critical: 0, high: 0, medium: 0, low: 0, info: 0 };\n}\n\nexport function summarize(findings: StructuredFinding[]): Record<Severity, number> {\n const counts = emptyCounts();\n for (const f of findings) counts[f.severity] = (counts[f.severity] || 0) + 1;\n return counts;\n}\n\nexport function workerId(): string {\n return `${os.hostname()}/${process.pid}`;\n}\n","/**\n * Node.js-specific vulnerability rules.\n *\n * Why this file exists\n * --------------------\n * `code-rules.ts` is deliberately cross-language: SQL injection, path\n * traversal and weak hashing look much the same in six languages, so one rule\n * covers all of them. That breadth is also its limit. A whole set of classes\n * only exist inside the Node ecosystem — `vm2` sandbox escapes, Electron's\n * renderer settings, `node-serialize`'s function-executing deserialiser, JWT's\n * `none` algorithm, headless-browser navigation — and each one needs to know\n * which package it is looking at before it can say anything useful.\n *\n * Those live here, evaluated by the same engine and obeying the same\n * confidence model. Splitting them out keeps the cross-language table readable\n * and gives the ecosystem-specific rules one place to document their\n * preconditions.\n *\n * Provenance and licence\n * ----------------------\n * The *list of classes* covered here was drawn up by reading what njsscan\n * (github.com/ajinabraham/njsscan) reports on, to close a coverage gap against\n * an established Node scanner. Nothing was copied. njsscan is LGPL-3.0 and\n * this package is MIT, so its rule definitions could not be reused even in\n * translation; a set of vulnerability class names is a fact about the\n * ecosystem, not an expression of it. Every pattern, guard, title and\n * consequence below was written from scratch against this engine's semantics,\n * which are not njsscan's — it delegates to semgrep for AST matching, while\n * these are line-oriented regexes with guard windows and a severity cap.\n *\n * That difference shapes the rules. Where njsscan can write \"this call, inside\n * a file that imported this module, not wrapped in an escaper\", the closest\n * honest equivalent here is `fileRequires` for the import plus a narrow\n * pattern. Classes that genuinely need AST scope — entity-expansion limits,\n * taint through a router — are absent rather than approximated. See KNOWN_GAPS\n * at the foot of this file.\n */\n\nimport type { CodeRule } from './code-rules';\n\n/**\n * A path is being assembled with containment already checked.\n *\n * Zip-slip is the one class in this file where the safe and unsafe forms are\n * the *same call* — `join(dest, entry.fileName)` — distinguished only by\n * whether the result is verified to stay under `dest`. So the guard has to\n * recognise containment checks specifically, which the generic guard does not:\n * a bare `startsWith` is too weak a signal to exonerate arbitrary rules, but\n * next to a path join it is exactly the check that matters.\n */\nconst PATH_CONTAINMENT_GUARD =\n /\\bstartsWith\\s*\\(|\\brelative\\s*\\(|\\bnormalize\\s*\\(|\\brealpath\\b|\\bisInside\\b|\\bwithin\\s*\\(|\\bsanitiz\\w*\\b/i;\n\n/** Packages whose archive entries carry an attacker-chosen path. */\nconst ARCHIVE_LIBRARY =\n /\\b(?:adm-zip|unzipper|yauzl|node-stream-zip|extract-zip|decompress|tar-stream|tar-fs)\\b|require\\s*\\(\\s*['\"]tar['\"]|from\\s+['\"]tar['\"]/;\n\n/** Packages that drive a real browser, where a URL becomes a request from the server. */\nconst HEADLESS_BROWSER =\n /\\b(?:puppeteer|playwright|phantom|phantomjs|wkhtmltopdf|wkhtmltoimage|chrome-aws-lambda|html-pdf)\\b/;\n\n/**\n * Evidence that a reflected origin was checked before being echoed.\n *\n * This rule cannot use the generic guard, and the reason is worth recording.\n * `Access-Control-Allow-Origin` contains the word \"Allow\"; the generic guard's\n * allow-list heuristic is case-insensitive and accepts a following `-`, so the\n * *header name itself* matched it. The rule was silently unable to ever fire —\n * it did not report fewer findings, it reported none, and only a failing test\n * distinguished that from \"no vulnerable code here\".\n *\n * What genuinely exonerates a reflected origin is a membership test on the\n * value, which is also the shape of the one correct implementation.\n */\nconst ORIGIN_ALLOWLIST_GUARD = /\\b(?:includes|indexOf|has|test|find|some)\\s*\\(/;\n\n/** Deserialisers that reconstruct functions, not just data. */\nconst FUNCTION_DESERIALIZER = /\\b(?:node-serialize|serialize-to-js|funcster|cryo)\\b/;\n\n/**\n * A string literal being concatenated onto — either quote style, separately.\n *\n * One character class cannot do this. The interesting strings are the ones\n * containing the *other* quote:\n *\n * \"this.name === '\" + name + \"'\"\n * \"//user[@id='\" + id + \"']\"\n *\n * A combined `['\"][^'\"]*['\"]` class stops dead at that inner quote and matches\n * nothing, which silently drops the most common injection shape. `code-rules.ts`\n * hit this with SQL and split the class per quote character; the same split is\n * needed everywhere a rule looks for assembled strings, so it lives here once.\n */\nconst CONCATENATED_STRING = String.raw`(?:\"[^\"\\n]*\"|'[^'\\n]*')\\s*\\+`;\n\n// A template literal with at least one interpolation. Written as a quoted\n// string rather than with `String.raw`, because the pattern has to contain a\n// backtick and a raw template literal cannot hold one unescaped.\nconst INTERPOLATED_TEMPLATE = '`[^`\\\\n]*\\\\$\\\\{';\n\nexport const NODE_RULES: readonly CodeRule[] = [\n // ── Code execution ───────────────────────────────────────────────────────\n {\n id: 'js-vm-untrusted-execution',\n title: 'script compiled and run by the `vm` module',\n consequence:\n 'Node’s `vm` is not a security boundary — it isolates globals, not the process. Code reaching it can walk back out through any object it is handed and runs with the server’s full privileges.',\n cwe: 'CWE-94',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\bvm\\s*\\.\\s*(?:runInNewContext|runInThisContext|runInContext|compileFunction)\\s*\\(|\\bnew\\s+vm\\s*\\.\\s*Script\\s*\\(/,\n // A `vm` call whose source is a build-time constant is a plugin loader, not\n // a vulnerability. The class only becomes real once the script text can be\n // influenced, so require that evidence before reporting at full severity.\n needsContext: true,\n },\n {\n id: 'js-vm2-sandbox',\n title: '`vm2` used as a sandbox',\n consequence:\n 'vm2 was discontinued after a series of escapes that its maintainer judged unfixable by design. Any code it runs should be assumed to run on the host.',\n cwe: 'CWE-1104',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\bnew\\s+(?:NodeVM|VMScript)\\s*\\(|\\bfrom\\s+['\"]vm2['\"]|require\\s*\\(\\s*['\"]vm2['\"]\\s*\\)/,\n // Nothing on the surrounding lines changes the answer: the package itself\n // is the finding, the same way a broken cipher is.\n inherent: true,\n },\n {\n id: 'js-function-deserialization',\n title: 'deserialiser that reconstructs functions',\n consequence:\n 'These formats encode functions alongside data and invoke them on load, so parsing an attacker’s payload is executing it. No amount of validation after the parse call helps — the code has already run.',\n cwe: 'CWE-502',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern: /\\b(?:unserialize|deepDeserialize|deserialize)\\s*\\(/,\n // Without this the rule fires on every project that happens to own a\n // function called `deserialize`, which is most of them. The import is what\n // makes the call the dangerous one.\n fileRequires: FUNCTION_DESERIALIZER,\n // The parse *is* the execution, so nearby input cannot make it worse and\n // its absence cannot make it safe. Nobody round-trips a constant through\n // these libraries.\n inherent: true,\n },\n {\n id: 'js-template-injection',\n title: 'template compiled from a non-constant source',\n consequence:\n 'Template languages are programming languages. A user-supplied template body is remote code execution, not cross-site scripting — the expression runs on the server before any output is escaped.',\n cwe: 'CWE-1336',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\b(?:handlebars|Handlebars|hbs|ejs|pug|jade|nunjucks|eta|twig|dot|doT|liquid|mustache)\\s*\\.\\s*(?:compile|compileFile|render|renderString)\\s*\\(\\s*(?:`[^`\\n]*\\$\\{|[a-zA-Z_$][\\w$.]*\\s*[,)]|[a-zA-Z_$][\\w$.]*\\s*\\+)/,\n // Rendering a template held in a variable is the normal case — it was read\n // from a file at boot. Only the version where request data reaches the\n // template *body* is this class.\n needsContext: true,\n },\n {\n id: 'js-shelljs-command-execution',\n title: 'shelljs command assembled from a string',\n consequence:\n '`shell.exec` runs its argument through a shell, so a `;` or backtick in an interpolated value runs as the server user.',\n cwe: 'CWE-78',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern: new RegExp(\n `\\\\b(?:shell|shelljs|sh)\\\\s*\\\\.\\\\s*exec\\\\s*\\\\(\\\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING}|[a-zA-Z_$][\\\\w$]*\\\\s*\\\\+)`,\n ),\n fileRequires: /\\bshelljs\\b/,\n },\n\n // ── Injection ────────────────────────────────────────────────────────────\n {\n id: 'js-nosql-where-expression',\n title: 'MongoDB `$where` built by string assembly',\n consequence:\n '`$where` is evaluated as JavaScript by the database server, once per document. An interpolated value can rewrite the predicate to `true` or run a denial-of-service loop inside the database.',\n cwe: 'CWE-943',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern: new RegExp(\n `\\\\$where\\\\s*['\"]?\\\\s*:\\\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING})` +\n `|\\\\.\\\\s*\\\\$where\\\\s*=\\\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING})`,\n ),\n },\n {\n id: 'js-xpath-injection',\n title: 'XPath expression built by concatenation',\n consequence:\n 'A quote in the interpolated value closes the predicate early, so the query selects nodes the caller was never meant to read — the XML equivalent of `OR 1=1`.',\n cwe: 'CWE-643',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n // An XPath expression is recognisable by its own syntax — a descendant\n // axis or an attribute predicate. Matching on the *call* name alone would\n // flag every `select(` in the ecosystem. The quoted forms are split per\n // quote character for the reason given at CONCATENATED_STRING: the\n // predicate that makes it XPath usually contains the other quote.\n pattern: new RegExp(\n '\\\\b(?:xpath|xpathSelect|select|selectNodes|selectSingleNode|evaluate|find)\\\\s*\\\\(\\\\s*(?:' +\n '`[^`\\\\n]*(?:\\\\/\\\\/|\\\\[@)[^`\\\\n]*\\\\$\\\\{' +\n '|\"[^\"\\\\n]*(?:\\\\/\\\\/|\\\\[@)[^\"\\\\n]*\"\\\\s*\\\\+' +\n \"|'[^'\\\\n]*(?:\\\\/\\\\/|\\\\[@)[^'\\\\n]*'\\\\s*\\\\+\" +\n ')',\n ),\n fileRequires: /\\bxpath\\b|\\bxmldom\\b|\\blibxmljs\\b|\\bxpath\\.js\\b/,\n },\n {\n id: 'js-regex-from-input',\n title: 'regular expression compiled from a variable',\n consequence:\n 'A caller who controls the pattern controls the matcher: they can supply catastrophic backtracking to hang the event loop, or a permissive pattern that defeats whatever the regex was validating.',\n cwe: 'CWE-1333',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n pattern: new RegExp(\n `\\\\bnew\\\\s+RegExp\\\\s*\\\\(\\\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING}|(?!['\"\\`/])[a-zA-Z_$][\\\\w$.]*\\\\s*[,)])`,\n ),\n needsContext: true,\n },\n\n // ── XML ──────────────────────────────────────────────────────────────────\n {\n id: 'js-xml-external-entities',\n title: 'XML parser configured to resolve entities',\n consequence:\n 'An entity declaration in the document body makes the parser fetch a local file or an internal URL and paste the result into the parsed output — file disclosure and server-side request forgery from a document upload.',\n cwe: 'CWE-611',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n // The option name is the finding. Every parser in the ecosystem defaults\n // these off, so an explicit `true` is a deliberate re-enable.\n pattern: /\\b(?:noent|resolveEntities|expandEntities|externalEntities|resolveExternals)\\s*:\\s*(?:true|1)\\b/,\n inherent: true,\n },\n\n // ── Authentication and tokens ────────────────────────────────────────────\n {\n id: 'js-jwt-none-algorithm',\n title: 'JWT algorithm set to `none`',\n consequence:\n 'The `none` algorithm means the signature is not checked. Anyone can mint a token with any claims — including another user’s id or an admin role — by base64-encoding a header and a body.',\n cwe: 'CWE-347',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern: /\\balgorithms?\\s*:\\s*\\[?\\s*['\"]none['\"]/i,\n inherent: true,\n },\n\n // ── Cryptography ─────────────────────────────────────────────────────────\n {\n id: 'js-broken-cipher-algorithm',\n title: 'broken cipher selected',\n consequence:\n 'DES, 3DES, RC2, RC4, Blowfish and IDEA are all breakable with commodity hardware or have practical plaintext-recovery attacks. Data encrypted with them should be treated as encoded, not encrypted.',\n cwe: 'CWE-327',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\bcreate(?:Cipher|Decipher)(?:iv)?\\s*\\(\\s*['\"](?:des|des3|des-ede\\w*|3des|rc2|rc4|bf|blowfish|cast5?|idea|seed)\\b/i,\n inherent: true,\n },\n {\n id: 'js-ecb-mode-cipher',\n title: 'block cipher in ECB mode',\n consequence:\n 'ECB encrypts every block independently, so identical plaintext blocks produce identical ciphertext. Structure in the data survives encryption and blocks can be reordered or replayed without detection.',\n cwe: 'CWE-327',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\bcreate(?:Cipher|Decipher)(?:iv)?\\s*\\(\\s*['\"][^'\"\\n]*-ecb\\b/i,\n inherent: true,\n },\n {\n id: 'js-legacy-cipher-api',\n title: 'deprecated `createCipher` used',\n consequence:\n '`createCipher` derives the key from a passphrase with a single unsalted MD5 pass and uses a fixed all-zero IV, so the same passphrase always produces the same keystream. It was removed in Node 22.',\n cwe: 'CWE-327',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n // `createCipheriv` is the correct API and shares the prefix, so the\n // negative look-ahead is what separates the finding from the fix.\n pattern: /\\bcrypto\\s*\\.\\s*create(?:Cipher|Decipher)\\s*\\(/,\n lineGuard: /create(?:Cipher|Decipher)iv\\s*\\(/,\n inherent: true,\n },\n\n // ── Cross-site scripting ─────────────────────────────────────────────────\n {\n id: 'js-template-autoescape-disabled',\n title: 'template auto-escaping turned off',\n consequence:\n 'Auto-escaping is the control that makes a template engine safe by default. Disabling it globally means every interpolation in every template becomes an injection point, including ones written later by someone who assumed the default.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\bautoescape\\s*:\\s*false\\b|\\bescape\\s*:\\s*false\\b|\\bnoEscape\\s*:\\s*true\\b/,\n inherent: true,\n },\n {\n id: 'js-serialize-javascript-unsafe',\n title: '`serialize-javascript` in unsafe mode',\n consequence:\n 'The `unsafe` flag turns off escaping of HTML-significant characters in the output. Embedding the result in a `<script>` block lets a string value close the tag and start a new one.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\bunsafe\\s*:\\s*true\\b/,\n fileRequires: /\\bserialize-javascript\\b/,\n inherent: true,\n },\n {\n id: 'js-cors-origin-reflected',\n title: 'CORS origin reflected from the request',\n consequence:\n 'Echoing the caller’s `Origin` header back as `Access-Control-Allow-Origin` allows every site, while looking like an allow-list. Combined with credentials, any page the victim visits can read their authenticated responses.',\n cwe: 'CWE-942',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n // Both spellings of the same mistake: writing the header directly, and\n // handing the request's origin to a CORS middleware's `origin` option.\n //\n // An earlier draft also matched a bare variable — `setHeader('…', origin)`\n // — which is wrong. A variable holding a *validated* origin is exactly\n // what the correct implementation looks like, and the rule cannot tell the\n // two apart. Only the visible read from the request qualifies.\n pattern:\n /\\bAccess-Control-Allow-Origin['\"]\\s*,\\s*(?:req|request|ctx)\\s*\\.|\\borigin\\s*:\\s*(?:req|request|ctx)\\s*\\./,\n // Reflecting the header is the defect whatever surrounds it; there is no\n // arrangement of nearby lines that makes an echoed origin safe — except a\n // membership test on the value, which is what the guard looks for.\n inherent: true,\n guard: ORIGIN_ALLOWLIST_GUARD,\n /**\n * Logging the origin is not reflecting it.\n *\n * `origin: request.headers.origin` is the CORS mistake *and* the ordinary\n * way to record who called — the two are character-for-character\n * identical, and only what encloses them differs. A response header goes\n * out to the browser; a log line goes to stdout, where it grants nobody\n * anything.\n */\n enclosingCallGuard: /(?:^|\\.)(?:log|debug|info|warn|error|trace|verbose|fatal)$/,\n },\n\n // ── Server-side request forgery ──────────────────────────────────────────\n {\n id: 'js-headless-browser-navigation',\n title: 'headless browser sent to a non-constant URL',\n consequence:\n 'The browser runs on the server, inside the private network. A controlled URL reaches the cloud metadata endpoint, localhost admin panels and internal services — and `file://` reads the disk.',\n cwe: 'CWE-918',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\.\\s*(?:goto|setContent|navigate)\\s*\\(\\s*(?:`[^`\\n]*\\$\\{|(?!['\"`])[a-zA-Z_$][\\w$.]*\\s*[,)])/,\n fileRequires: HEADLESS_BROWSER,\n needsContext: true,\n },\n\n // ── Path handling ────────────────────────────────────────────────────────\n {\n id: 'js-archive-entry-path',\n title: 'archive entry written to a path built from its own name',\n consequence:\n 'An entry named `../../etc/cron.d/x` escapes the extraction directory when its name is joined to the destination. Overwriting a file outside the target — a systemd unit, an SSH key, a deployed script — is code execution on the next run.',\n cwe: 'CWE-22',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\b(?:join|resolve)\\s*\\(\\s*[^,\\n)]+,\\s*[a-zA-Z_$][\\w$]*\\s*\\.\\s*(?:entryName|fileName|filename|name|path)\\b/,\n fileRequires: ARCHIVE_LIBRARY,\n guard: PATH_CONTAINMENT_GUARD,\n // The containment check comes *after* the join — you build the path, then\n // verify it stayed inside. A backwards-only window would miss every\n // correct implementation and report the safe code alongside the unsafe.\n guardForward: 3,\n },\n\n // ── Electron ─────────────────────────────────────────────────────────────\n {\n id: 'js-electron-node-integration',\n title: 'Electron renderer given Node access',\n consequence:\n 'With node integration on — or context isolation off — any script that reaches the page reaches `require`. A single XSS in rendered content becomes `child_process.exec` on the user’s machine.',\n cwe: 'CWE-1188',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\bnodeIntegration(?:InWorker|InSubFrames)?\\s*:\\s*true\\b|\\bcontextIsolation\\s*:\\s*false\\b|\\benableRemoteModule\\s*:\\s*true\\b|\\bsandbox\\s*:\\s*false\\b/,\n inherent: true,\n },\n {\n id: 'js-electron-web-security-disabled',\n title: 'Electron web security disabled',\n consequence:\n 'Turning off `webSecurity` drops the same-origin policy for the window, so remote content can read local files and every other origin the app has loaded.',\n cwe: 'CWE-1173',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\bwebSecurity\\s*:\\s*false\\b|\\ballowRunningInsecureContent\\s*:\\s*true\\b|\\bwebviewTag\\s*:\\s*true\\b/,\n inherent: true,\n },\n {\n id: 'js-electron-open-external',\n title: 'Electron `openExternal` with a non-constant URL',\n consequence:\n '`shell.openExternal` hands the string to the operating system’s handler. A `file://` path executes a local binary and, on Windows, an SMB path executes a remote one.',\n cwe: 'CWE-749',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\bshell\\s*\\.\\s*openExternal\\s*\\(\\s*(?:`[^`\\n]*\\$\\{|(?!['\"`])[a-zA-Z_$][\\w$.]*\\s*[,)])/,\n needsContext: true,\n },\n\n // ── Hardening and resource limits ────────────────────────────────────────\n {\n id: 'js-helmet-protection-disabled',\n title: 'security header explicitly disabled',\n consequence:\n 'Each of these switches off a browser-side protection that was already on. The header stops being sent, so the defence it enables — framing, sniffing, referrer leakage, transport downgrade — is available to an attacker again.',\n cwe: 'CWE-693',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\b(?:contentSecurityPolicy|frameguard|hsts|noSniff|xssFilter|hidePoweredBy|referrerPolicy|dnsPrefetchControl|ieNoOpen|permittedCrossDomainPolicies|crossOriginEmbedderPolicy|crossOriginOpenerPolicy|crossOriginResourcePolicy|originAgentCluster)\\s*:\\s*false\\b/,\n inherent: true,\n },\n {\n id: 'js-buffer-bounds-check-disabled',\n title: 'buffer bounds checking turned off',\n consequence:\n 'With `noAssert` the read or write is not range-checked, so an offset past the end of the buffer returns adjacent heap memory or corrupts it instead of throwing.',\n cwe: 'CWE-125',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n // The trailing `true` on a Buffer numeric accessor *is* `noAssert` — it is\n // the last positional parameter of every one of these methods. Anchoring\n // on the accessor name is what keeps this from matching `, true)` on any\n // call in the codebase.\n pattern:\n /\\b(?:read|write)(?:U?Int(?:8|16|32)(?:[BL]E)?|U?Int[BL]E|Float[BL]E|Double[BL]E)\\s*\\([^)\\n]*,\\s*true\\s*\\)|\\bnoAssert\\s*:\\s*true\\b/,\n inherent: true,\n },\n {\n id: 'js-uninitialized-buffer',\n title: 'buffer allocated without zeroing',\n consequence:\n '`allocUnsafe` and the old `new Buffer(size)` hand back whatever was previously in that heap memory — keys, session tokens, other users’ request bodies. Anything not overwritten before the buffer is sent leaks it.',\n cwe: 'CWE-908',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n pattern: /\\bBuffer\\s*\\.\\s*allocUnsafe(?:Slow)?\\s*\\(|\\bnew\\s+Buffer\\s*\\(\\s*(?![`'\"])[a-zA-Z_$0-9]/,\n inherent: true,\n // Filling the buffer yourself is the whole reason to call `allocUnsafe`,\n // so reporting every call reports correct code. What is left reported is\n // an allocation whose bytes are never written before it escapes.\n filledBeforeUseGuard: true,\n },\n {\n id: 'js-oversized-request-body-limit',\n title: 'request body limit raised to a very large value',\n consequence:\n 'A body limit in the tens of megabytes lets a handful of concurrent requests exhaust memory, and the parse happens before any authentication check the route performs.',\n cwe: 'CWE-400',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n // Two or more digits before `mb` — 50mb and up. A limit is a *good* thing;\n // only an ineffective one is the finding.\n pattern: /\\blimit\\s*:\\s*['\"]\\s*(?:[5-9]\\d|\\d{3,})\\s*mb\\s*['\"]|\\blimit\\s*:\\s*['\"]\\s*\\d+\\s*gb\\s*['\"]/i,\n inherent: true,\n },\n\n // ── Information disclosure ───────────────────────────────────────────────\n {\n id: 'js-error-detail-returned',\n title: 'error object or stack trace sent to the client',\n consequence:\n 'A stack trace names absolute paths, package versions and internal function names, and framework errors often carry the failing query or connection string with them. It is a map of the server, handed out on request.',\n cwe: 'CWE-209',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n // `res.status(500).send(…)` is the overwhelmingly common spelling, so the\n // optional `.status(…)` hop is not a nicety — without it the rule misses\n // nearly every real occurrence.\n pattern:\n /\\bres\\s*\\.\\s*(?:status\\s*\\([^)\\n]*\\)\\s*\\.\\s*)?(?:send|json|end|write)\\s*\\(\\s*(?:[a-zA-Z_$][\\w$]*\\s*\\.\\s*stack\\b|(?:error|err|e)\\s*[,)])|\\.\\s*(?:send|json)\\s*\\(\\s*\\{[^}\\n]*\\b(?:stack|err|error)\\s*:\\s*(?:error|err|e)\\s*[,}]/,\n inherent: true,\n },\n];\n\n/**\n * KNOWN_GAPS — Node classes deliberately not implemented here.\n *\n * Each of these needs analysis this engine does not do, and the regex that\n * would approximate it fires on ordinary code often enough to make the whole\n * rule set less useful. They are listed rather than silently omitted so the\n * next person does not have to rediscover why.\n *\n * XML entity-expansion DoS (CWE-776)\n * The defect is the *absence* of an expansion limit, which is a property\n * of parser configuration spread across a file, not a line.\n *\n * Missing anti-CSRF, rate limiting, security headers (CWE-352, CWE-770)\n * Also absence-of-evidence, and genuinely whole-project. Handled instead\n * by `controls.ts`, which accumulates across the walk and reports once —\n * and only when asked, because a missing control is a weaker claim than a\n * present defect.\n *\n * JWT tokens not revocable, sensitive claims in the payload\n * Requires knowing what a claim means. `{ ssn: user.ssn }` and\n * `{ sub: user.id }` are the same shape.\n *\n * Prototype-pollution gadget chains\n * The direct assignment forms are covered by `js-prototype-pollution` in\n * the cross-language table. Reaching a gadget through a merge helper needs\n * interprocedural reasoning.\n *\n * Sequelize / driver TLS options\n * `rejectUnauthorized: false` is already reported by\n * `tls-verification-disabled`, which is language-agnostic and catches it\n * wherever it appears. A driver-specific duplicate would double-report.\n */\n","/**\n * Shared vocabulary for `threatcrush scan`.\n *\n * The scan pipeline is deliberately three separable pieces — rules produce\n * findings, the engine walks the tree, the reporters serialise. Keeping the\n * types here means a reporter never has to import a rule table to know what a\n * finding looks like.\n */\n\nexport type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';\n\n/**\n * How much the scanner is claiming.\n *\n * `pattern` the dangerous construct is present on the line. Nothing more.\n * `contextual` the construct sits alongside something that looks like\n * attacker-controlled input. Still not proof of exploitability,\n * but a materially stronger claim — and the only one allowed to\n * present at the rule's full severity.\n * `evidence` the match *is* the finding, not a proxy for it. A hardcoded\n * AWS key is a committed credential whether or not any request\n * ever reaches it, so the severity cap below does not apply.\n *\n * This mirrors the confidence model in `modules/code-scanner` (PRD 0004), for\n * the same reason: a regex is not data-flow analysis, and a scanner that blurs\n * the two produces confident-sounding findings that waste triage time.\n */\nexport type Confidence = 'pattern' | 'contextual' | 'evidence';\n\nexport type ScanLanguage =\n | 'javascript'\n | 'typescript'\n | 'python'\n | 'ruby'\n | 'go'\n | 'java'\n | 'php'\n | 'shell'\n | 'config'\n | 'other';\n\nexport interface ScanFinding {\n /** Stable rule identifier, e.g. `js-sql-string-building`. Used as the SARIF ruleId. */\n ruleId: string;\n /** Short human title for the construct, e.g. \"SQL assembled by concatenation\". */\n title: string;\n /** Path relative to the scan root, POSIX-separated. */\n file: string;\n /** 1-based. Whole-file findings report 1, never 0 — SARIF forbids 0. */\n line: number;\n severity: Severity;\n confidence: Confidence;\n /** What was found, in a sentence. Shown to the operator. */\n message: string;\n /** What happens if it is real. An operator triages on consequence. */\n consequence?: string;\n /** `CWE-89`. Absent for findings with no clean CWE mapping. */\n cwe?: string;\n /**\n * The matched source line, trimmed. Redacted by the reporters for secret\n * findings — see `redactSecret`.\n */\n excerpt: string;\n /** True when `excerpt` may contain credential material. */\n sensitive?: boolean;\n category: 'secret' | 'code' | 'manifest' | 'dependency' | 'file';\n}\n\nexport const SEVERITY_ORDER: readonly Severity[] = ['info', 'low', 'medium', 'high', 'critical'];\n\nexport function severityRank(severity: Severity): number {\n const index = SEVERITY_ORDER.indexOf(severity);\n return index === -1 ? 0 : index;\n}\n\n/**\n * Cap for a bare pattern match.\n *\n * A construct that merely *exists* never presents as high or critical. Enforced\n * centrally rather than per-rule so no future rule can opt out of it by\n * accident.\n */\nexport function severityFor(declared: Severity, confidence: Confidence): Severity {\n if (confidence !== 'pattern') return declared;\n return severityRank(declared) > severityRank('medium') ? 'medium' : declared;\n}\n","/**\n * Code-level vulnerability rules for `threatcrush scan`.\n *\n * Why this file exists\n * --------------------\n * Measured against the public testbed at `profullstack/malware-test-prs`, the\n * CLI scored 15.6% true-positive rate with a 0.0% false-positive rate: it found\n * every hardcoded credential and none of the code-level classes — no SQL\n * injection, XSS, SSRF, command injection, deserialisation or template\n * injection. ThreatCrush was a secrets scanner wearing a code scanner's name.\n *\n * These rules close that gap without giving up the number that was actually\n * worth having. The false-positive denominator in that testbed is a control\n * group of `SAFE:` lines — each one a *correct* implementation of the same\n * pattern the neighbouring vulnerable code gets wrong. A scanner that flags one\n * is pattern-matching on syntax instead of following the data. So every rule\n * here is built against both halves: it must fire on the vulnerable shape and\n * stay silent on the corrected shape standing next to it.\n *\n * Three mechanisms do that work:\n *\n * 1. **Shape, not keyword.** `db.query(\"SELECT … $1\", [id])` and\n * `db.query(\"SELECT … '\" + id + \"'\")` both contain `SELECT`. Only the\n * second concatenates, and only the second matches.\n * 2. **Guard windows.** A construct is exonerated by the code around it —\n * an allow-list two lines up, a `realpath` on the same line, an\n * `ObjectInputFilter` installed before the `readObject()`. Comment lines\n * are excluded from the window, because a comment saying \"no allow-list\n * here\" is not an allow-list.\n * 3. **Confidence.** A construct that merely exists is capped at medium.\n * Escalation requires visible untrusted input. See `types.ts`.\n *\n * What this is not: data-flow analysis. It is line-oriented matching with a\n * small amount of local context, and it says so. Classes that genuinely need\n * whole-function reasoning — missing CSRF tokens, check-then-use races,\n * integer overflow — are deliberately absent rather than approximated by a\n * rule that would flag every session read in the codebase. See KNOWN_GAPS.\n */\n\nimport { NODE_RULES } from './node-rules';\nimport type { Confidence, ScanLanguage, Severity } from './types';\nimport { severityFor } from './types';\n\nexport interface CodeRule {\n id: string;\n title: string;\n /** What happens if it is real. An operator triages on consequence. */\n consequence: string;\n cwe: string;\n severity: Severity;\n /** Languages the rule applies to. `undefined` means every language. */\n languages?: readonly ScanLanguage[];\n pattern: RegExp;\n /**\n * The rule describes a construct that is ordinary on its own — reading a\n * file from a computed path is just software. Only report it when untrusted\n * input is visible nearby.\n */\n needsContext?: boolean;\n /**\n * The construct *is* the defect, so its severity does not depend on context.\n *\n * The default model caps a finding at medium unless untrusted input is\n * visible nearby, which is right for injection: `exec(cmd)` is only a\n * vulnerability once `cmd` can be influenced. It is wrong for a whole class\n * of rules where nothing nearby changes the answer. `curl -k` against HTTPS\n * is a machine-in-the-middle hole whether or not a positional parameter\n * appears six lines above it; DES is broken in every file that uses it.\n *\n * Marking those rules `inherent` reports them at confidence `evidence` and\n * at their declared severity, the same treatment the credential rules get\n * for the same reason — a committed AWS key is a committed AWS key.\n *\n * Do not reach for this to make a rule look important. It is for rules whose\n * finding text would be identical no matter what surrounds the line.\n */\n inherent?: boolean;\n /**\n * Extra evidence that must appear in the guard window for the rule to fire.\n * Used where the dangerous part is the *combination* — a base64 blob is\n * harmless until something executes it.\n */\n requires?: RegExp;\n /**\n * Evidence that must appear somewhere in the file, not merely in the guard\n * window.\n *\n * For rules whose *applicability* is settled far from the match. Whether a\n * `.parse()` call is XML parsing is decided by an import at the top of the\n * file, which in a 1,600-line source is nowhere near the line that matched;\n * widening `guardBack` far enough to reach it would drag in unrelated\n * evidence for every other rule. Distinct from `requires`, which asks\n * whether the surrounding lines complete a dangerous combination.\n */\n fileRequires?: RegExp;\n /**\n * Evidence that the construct is already handled. `false` opts the rule out\n * of the generic guard entirely — the CWE-532 rules are *about* reading\n * `process.env`, so the generic guard would veto every true positive.\n */\n guard?: RegExp | false;\n /**\n * Evidence — on the matched line ONLY — that this occurrence is safe.\n *\n * Distinct from `guard`, which also searches the surrounding window. That\n * breadth is right for \"the value was sanitised three lines up\" but wrong\n * for properties of the line itself: a static `innerHTML` assignment says\n * nothing about a dynamic one two lines below it, and a context-scoped\n * guard would silently veto the dynamic one too.\n */\n lineGuard?: RegExp;\n /**\n * Evidence that the match sits inside a call that cannot be a sink —\n * matched against the callee of each unclosed call enclosing the line.\n *\n * Distinct from `guard` and `lineGuard`, both of which ask what is *near*\n * the match. Neither can answer \"is this an argument to something\", and that\n * is the question that separates a CORS header from a log line:\n *\n * console.log('connection', {\n * headers: { origin: request.headers.origin },\n * });\n *\n * The reflected-origin rule matched the inner line, four lines below the\n * `console.log(` that makes it inert. A window guard wide enough to see the\n * logger would also exonerate a genuine reflection written four lines under\n * an unrelated log statement; nesting is the only thing that distinguishes\n * them, so nesting is what this reads.\n */\n enclosingCallGuard?: RegExp;\n /**\n * Exonerate a template literal whose every `${…}` names a file-local `const`\n * bound to a string literal.\n *\n * const SRC = '/srv/app/routes';\n * execSync(`find ${SRC} -name '*.js'`);\n *\n * The command is a compile-time constant written in two pieces. Nothing\n * reaches it, so nothing can be injected into it — the shape is a build\n * script naming its own directories, and it is most of what the\n * interpolated-exec rules find in practice.\n *\n * `const` only, and a plain string literal only. `let` can be reassigned\n * from a request between the binding and the call, and a binding built by\n * interpolation just moves the question somewhere this cannot follow.\n */\n constantInterpolationGuard?: boolean;\n /**\n * Exonerate an uninitialised buffer that is written into before it escapes.\n *\n * const out = Buffer.allocUnsafe(length);\n * src.copy(out, 0, start, start + firstLen);\n * return out;\n *\n * `allocUnsafe` hands back unzeroed heap and the leak it enables is real, but\n * \"I will fill this myself\" is the entire reason the API exists. A rule that\n * fires on every call reports correct code as a vulnerability, and both hits\n * on the repository this was found against were a PTY ring that writes every\n * byte it later hands out. Neither could be silenced without silencing the\n * rule everywhere.\n *\n * Bound to the *name* the allocation is assigned to, not to a write merely\n * appearing nearby: an unrelated `.copy(` below an escaping `allocUnsafe`\n * must not exonerate it.\n *\n * The trade is deliberate and worth stating plainly. This cannot prove the\n * write covers the whole buffer, so a partial fill — `src.copy(out, 0, 0, 5)`\n * into a hundred-byte buffer — is exonerated and still leaks the rest.\n * Proving coverage needs range analysis this engine does not do. The\n * alternative is the status quo, where the rule fires on every correct use,\n * is read as noise and gets switched off — which catches that partial write\n * in exactly the same number of cases, namely none.\n *\n * An allocation with no binding to follow is never exonerated:\n * `return Buffer.allocUnsafe(n)` and `send(Buffer.allocUnsafe(n))` hand the\n * unzeroed memory straight out, which is the shape of the actual defect.\n */\n filledBeforeUseGuard?: boolean;\n /** Lines of context searched backwards for guards and required evidence. */\n guardBack?: number;\n /**\n * Lines searched *forwards*. Zero for almost everything: code that fixes a\n * problem generally runs before the problem. XML parser hardening is the\n * exception — the factory is constructed, then configured, so the evidence\n * is below the match.\n */\n guardForward?: number;\n}\n\n/**\n * Things that look like attacker-controlled input, per language family.\n *\n * Deliberately shallow. It is a heuristic for *ranking*, not a taint-source\n * model. A real source list would be framework-aware and interprocedural,\n * which is exactly what this subsystem promises not to pretend to be.\n */\n/**\n * `searchParams` is a read *and* a write API. `params.get('q')` is inbound\n * data; `url.searchParams.set('limit', 50)` is an outbound URL being built,\n * and treating the two alike marked every client of every third-party API as\n * taking untrusted input — which is what made the SSRF rule fire on requests\n * whose host is a compile-time constant. Only the reading half is evidence.\n */\nconst UNTRUSTED_JS =\n /\\b(?:req|request|ctx|context)\\s*\\.\\s*(?:body|query|params|param|headers|cookies|url|files)\\b|\\bprocess\\.argv\\b|\\bwindow\\.location\\b|\\bdocument\\.location\\b|\\blocation\\.(?:search|hash|href)\\b|\\bsearchParams\\s*\\.\\s*(?:get|getAll|has|entries|keys|values|forEach)\\b|\\bgetParameter\\s*\\(|\\bgetQueryString\\s*\\(|\\bgetInputStream\\s*\\(/;\n\nconst UNTRUSTED_PY = /\\brequest\\b|\\bparams\\b|\\bflask\\b|\\bsys\\.argv\\b|\\bos\\.environ\\b\\s*\\[/;\n\nconst UNTRUSTED_RB = /\\bparams\\s*\\[|\\brequest\\b|\\bcookies\\s*\\[/;\n\nconst UNTRUSTED_GO =\n /\\br\\s*\\.\\s*(?:URL|Form|Body|Header|PostForm)\\b|\\bFormValue\\s*\\(|\\bQuery\\s*\\(\\s*\\)\\s*\\.\\s*Get\\s*\\(|\\bmux\\.Vars\\s*\\(/;\n\nconst UNTRUSTED_JAVA =\n /\\bgetParameter\\s*\\(|\\bgetQueryString\\s*\\(|\\bgetHeader\\s*\\(|\\bgetInputStream\\s*\\(|\\bgetCookies\\s*\\(|\\b@RequestParam\\b|\\b@PathVariable\\b/;\n\n/**\n * Untrusted input to a shell script: what the caller controls.\n *\n * Positional parameters and `read` are the whole surface. Environment\n * variables are deliberately absent — a script's own configuration arrives\n * that way, so treating `$PREFIX` as attacker-controlled would mark every\n * line of every installer.\n */\nconst UNTRUSTED_SH =\n /\\$\\{?[1-9]\\d*\\b|\\$[@*]|\\$\\{@\\}|\\bread\\s+(?:-\\S+\\s+)*[A-Za-z_]\\w*|\\$\\{?REPLY\\b|\\$\\{?QUERY_STRING\\b/;\n\n/** PHP's superglobals are the request, verbatim. */\nconst UNTRUSTED_PHP =\n /\\$_(?:GET|POST|REQUEST|COOKIE|FILES|SERVER)\\b|\\bphp:\\/\\/input\\b|\\bgetallheaders\\s*\\(/;\n\nexport function untrustedPatternFor(language: ScanLanguage): RegExp {\n switch (language) {\n case 'php':\n return UNTRUSTED_PHP;\n case 'shell':\n return UNTRUSTED_SH;\n case 'python':\n return UNTRUSTED_PY;\n case 'ruby':\n return UNTRUSTED_RB;\n case 'go':\n return UNTRUSTED_GO;\n case 'java':\n return UNTRUSTED_JAVA;\n default:\n return UNTRUSTED_JS;\n }\n}\n\n/**\n * Evidence that the dangerous construct on this line is already handled.\n *\n * Every entry here was added because a *correct* implementation in the testbed\n * corpus was otherwise flagged. They are named after what the safe code does,\n * not after what the finding is:\n *\n * allow/whitelist an allow-list decides what reaches the sink\n * escape/sanitize the value is encoded for its output context\n * realpath/… the path is resolved and re-checked before use\n * process.env/… the value comes from the environment, not the request\n * ObjectInputFilter a class allow-list is installed on the stream\n *\n * A guard match suppresses the finding rather than downgrading it. Reporting\n * \"we saw an allow-list but flagged it anyway\" is the behaviour that makes\n * operators stop reading scanner output.\n */\nexport const GENERIC_GUARD =\n // `esc(`, `aEsc(`, `htmlEscape(`, `escapeHtml(` — the escaper is almost\n // never *named* `escapeHtml` in real code. It gets aliased to something\n // short because it is called on nearly every interpolation, so matching only\n // the long spellings reported the codebases that escape most rigorously.\n //\n // The identifier must END at the escaper (with at most a known output-context\n // suffix). An earlier, looser form also matched `describe(`, which would have\n // silenced findings across every test file in every repository.\n // The `Access-Control-` lookbehind is not a nicety. This regex is\n // case-insensitive, and `Access-Control-Allow-Origin` contains the word\n // \"Allow\" followed by a non-word character — so the CORS header name matched\n // the allow-list heuristic. Because the guard is tested against an 8-line\n // *window*, one header line silently disabled every guardable rule near it:\n // in a four-line Express error handler, the header on one line suppressed\n // both the `none`-algorithm JWT finding and the returned stack trace below\n // it. The failure mode is the dangerous kind — not fewer findings, none, and\n // indistinguishable from clean code.\n //\n // Scoped to the header prefix rather than to a bare `allow(?!-)`, because\n // this guard also runs over `.yml` and `.conf` files, where `allow-list:`\n // and `allowed-hosts:` are ordinary keys that should still guard.\n /(?<!Access-Control-)\\ballow(?:ed|list|_list|ed_hosts)?\\b|\\bwhitelist\\b|\\b\\w{0,6}[Ee]sc(?:ape)?(?:[Hh]tml|HTML|[Xx]ml|XML|[Ss]ql|[Aa]ttr|[Jj]s|[Uu]ri|[Uu]rl)?\\s*\\(|\\bhtml_escape\\b|\\bhtmlspecialchars\\s*\\(|\\bsanitiz\\w*\\b|\\bencoded\\b|\\brealpath\\b|\\bcommonpath\\b|\\bresolve\\(\\)\\.startsWith\\b|\\bprocess\\.env\\b|\\bos\\.environ\\b|\\bgetenv\\b|\\bENV\\s*\\[|setObjectInputFilter|ObjectInputFilter/i;\n\n/** Evidence that an XML parser factory has been hardened against XXE. */\nconst XXE_GUARD =\n /FEATURE_SECURE_PROCESSING|setExpandEntityReferences|disallow-doctype-decl|external-general-entities|external-parameter-entities|setXIncludeAware\\s*\\(\\s*false/;\n\n/**\n * Evidence that a Java source parses XML at all.\n *\n * The package names are the reliable half: a file that reaches for\n * `javax.xml.parsers` or `org.xml.sax` has declared its intent at the top,\n * whatever the local variable ends up being called. The bare type names cover\n * sources that import by wildcard or sit in the same package.\n */\nconst XML_PARSING_FILE =\n /\\b(?:javax\\.xml|org\\.xml\\.sax|org\\.w3c\\.dom|org\\.jdom2?|org\\.dom4j|XmlPullParser|DocumentBuilderFactory|DocumentBuilder|SAXParserFactory|SAXParser|XMLInputFactory|XMLReaderFactory|XMLReader|SAXBuilder|SAXReader)\\b/;\n\n/** A sink that executes whatever string reaches it. */\nconst CODE_SINK =\n /\\bglobalThis\\s*\\[|\\bconstructor\\b|\\beval\\b|\\bFunction\\b|\\brun\\s*\\(|\\bvm\\s*\\.\\s*run/;\n\n/** A sink whose output is retained: a log, a console, an outbound request. */\nconst EXFIL_SINK = /\\bconsole\\s*\\.\\s*(?:log|debug|info|warn|error)\\s*\\(|\\bfetch\\s*\\(|\\baxios\\b|\\brequest\\s*\\(|\\.\\s*send\\s*\\(/;\n\n/**\n * SQL text that is being *assembled* rather than parameterised.\n *\n * The four tails are the four ways to build a string in the languages this\n * covers: `+` concatenation, `${}` template interpolation, `%`/`.format()`\n * substitution, and Ruby's `#{}`. A bound placeholder (`$1`, `?`, `%s` passed\n * as an argument) leaves a comma after the closing quote and matches none of\n * them — which is exactly how the safe counterparts stay unflagged.\n */\n// Each verb requires the clause that makes it SQL rather than an English word.\n//\n// The bare forms — `INSERT`, `UPDATE`, `DELETE`, `DROP`, a lone `SELECT` — were\n// the source of this rule's false positives: `\\bINSERT\\b` matches the `insert`\n// in a React key `` `insert-${i}` ``, and `\\bUPDATE\\b` matches `Update` in a\n// log line `` `Update finished in ${ms}ms` ``. Both read as SQL injection.\n//\n// Real SQL pairs the verb with structure — `SELECT … FROM`, `INSERT INTO`,\n// `UPDATE … SET`, `DELETE FROM`, `DROP TABLE`. Requiring it keeps every\n// injection shape the corpus and the unit tests exercise (all of which are\n// `SELECT … FROM` or `DELETE FROM`) while a verb standing alone as prose no\n// longer qualifies. The `SELECT`/`UPDATE` look-aheads stay inside one string\n// literal — the character class excludes quotes and backticks — so the clause\n// must live in the same statement, not merely somewhere later on the line.\nconst SQL_KEYWORDS =\n \"SELECT\\\\b(?=[^`'\\\"\\\\n]*\\\\bFROM\\\\b)\" +\n \"|INSERT\\\\s+INTO\" +\n \"|UPDATE\\\\b(?=[^`'\\\"\\\\n]*\\\\bSET\\\\b)\" +\n \"|DELETE\\\\s+FROM\" +\n \"|DROP\\\\s+(?:TABLE|DATABASE|INDEX|VIEW|SCHEMA)\" +\n \"|TRUNCATE\\\\s+TABLE\" +\n \"|UNION\\\\s+SELECT\";\n\n/**\n * A quoted string containing a SQL verb.\n *\n * Two variants, one per quote character, because the interesting strings\n * contain the *other* quote:\n *\n * \"SELECT id FROM users WHERE id = '\" + id + \"'\"\n *\n * A single `[\"'][^\"'\\n]*` class stops dead at that inner `'` and matches\n * nothing — which silently drops the most common SQL-injection shape in every\n * language at once. Match a double-quoted string with a class that excludes\n * only `\"`, and vice versa.\n */\nconst SQL_IN_DOUBLE = `\"[^\"\\\\n]*(?:${SQL_KEYWORDS})\\\\b[^\"\\\\n]*\"`;\nconst SQL_IN_SINGLE = `'[^'\\\\n]*(?:${SQL_KEYWORDS})\\\\b[^'\\\\n]*'`;\nconst SQL_STRING = `(?:${SQL_IN_DOUBLE}|${SQL_IN_SINGLE})`;\n\nexport const CODE_RULES: readonly CodeRule[] = [\n // ── Injection: SQL ───────────────────────────────────────────────────────\n {\n id: 'sql-string-concatenation',\n title: 'SQL assembled by concatenation or interpolation',\n consequence:\n 'A quote in the interpolated value changes the query’s meaning — the query runs as the attacker wrote it, not as you wrote it.',\n cwe: 'CWE-89',\n severity: 'critical',\n // The tail is what distinguishes assembly from parameterisation. A bound\n // query leaves a comma after the closing quote (`\"… = $1\", [id]`) and\n // matches none of these.\n //\n // The clause alternative anchors the keyword to the *start* of the\n // concatenated fragment, because that is where a clause being appended\n // actually sits: `sql + \"WHERE id = \" + id`, `sql + \" ORDER BY \" + col`.\n //\n // Allowing it anywhere in the fragment made the rule read English. `WHERE`\n // and `SET` are ordinary words, and without a leading `\\b` they were not\n // even required to be whole ones — \"any`where`\" and \"sub`set`\" both\n // matched. A help string reading \"lists them anywhere\" was reported as\n // critical SQL injection, which is the kind of finding that teaches a team\n // the scanner is not worth reading.\n pattern: new RegExp(\n `${SQL_STRING}\\\\s*\\\\+|` +\n `${SQL_STRING}\\\\s*%\\\\s*[\\\\w(]|` +\n `${SQL_STRING}\\\\s*\\\\.\\\\s*format\\\\s*\\\\(|` +\n '\\\\+\\\\s*(?:\"|\\')\\\\s*\\\\b(?:WHERE|ORDER\\\\s+BY|VALUES|SET)\\\\b',\n 'i',\n ),\n },\n {\n id: 'sql-template-interpolation',\n title: 'SQL built from a template literal or f-string',\n consequence:\n 'Template interpolation is string concatenation with nicer syntax — it binds nothing and escapes nothing.',\n cwe: 'CWE-89',\n severity: 'critical',\n pattern: new RegExp(\n `\\`[^\\`\\\\n]*(?:${SQL_KEYWORDS})\\\\b[^\\`\\\\n]*\\\\$\\\\{|` +\n `\\\\bf\"[^\"\\\\n]*(?:${SQL_KEYWORDS})\\\\b[^\"\\\\n]*\\\\{|` +\n `\\\\bf'[^'\\\\n]*(?:${SQL_KEYWORDS})\\\\b[^'\\\\n]*\\\\{`,\n 'i',\n ),\n /**\n * Interpolating a column list is not interpolating a value.\n *\n * const COLS = `tld, user_id, owner_email, price_usd`;\n * get(`SELECT ${COLS} FROM moshpit_tlds WHERE tld = ?`, [tld]);\n *\n * That query *is* parameterised: every value the caller supplies rides a\n * `?`, and the only thing spliced into the text is a constant written a\n * few lines up. Naming the column list once instead of repeating it in\n * fourteen queries is ordinary hygiene, and it is the shape this rule met\n * most often in practice — one repository produced eighteen findings this\n * way and not one of them could be injected into.\n *\n * The guard resolves the interpolations rather than trusting the shape, so\n * the moment a query mixes a constant with anything else —\n * `` `SELECT ${COLS} FROM t WHERE id = ${req.query.id}` `` — it is reported\n * again. `interpolationsAreConstant` requires *every* `${…}` to resolve.\n */\n constantInterpolationGuard: true,\n },\n {\n id: 'sql-format-call',\n title: 'SQL text produced by a format helper',\n consequence:\n '`Sprintf`/`String.format` substitute without quoting; the resulting string is concatenated SQL by another name.',\n cwe: 'CWE-89',\n severity: 'critical',\n languages: ['go', 'java'],\n pattern: new RegExp(\n `\\\\b(?:fmt\\\\.Sprintf|String\\\\.format)\\\\s*\\\\(\\\\s*\"[^\"\\\\n]*(?:${SQL_KEYWORDS})\\\\b`,\n 'i',\n ),\n },\n {\n id: 'rb-sql-interpolation',\n title: 'ActiveRecord query built by string interpolation',\n consequence:\n '`where(\"… #{value}\")` interpolates before the adapter sees it, so no binding ever happens.',\n cwe: 'CWE-89',\n severity: 'critical',\n languages: ['ruby'],\n pattern:\n /\\b(?:where|find_by_sql|execute|select_all|select_values|order|group|pluck)\\s*[( ]\\s*(?:\"[^\"\\n]*|'[^'\\n]*)#\\{/,\n },\n\n // ── Injection: OS command ────────────────────────────────────────────────\n {\n id: 'js-shell-exec-interpolation',\n title: 'shell execution with an interpolated string',\n consequence: 'A `;` or `$(…)` in the interpolated value runs as the server user.',\n cwe: 'CWE-78',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\b(?:exec|execSync|spawn|spawnSync)\\s*\\(\\s*(?:`[^`]*\\$\\{|['\"][^'\"]*['\"]\\s*\\+|[a-zA-Z_$][\\w$]*\\s*\\+)/,\n constantInterpolationGuard: true,\n },\n {\n id: 'py-shell-command-string',\n title: 'shell command built from a string',\n consequence:\n '`os.system` and `shell=True` hand the string to `/bin/sh`, which happily interprets metacharacters.',\n cwe: 'CWE-78',\n severity: 'critical',\n languages: ['python'],\n pattern:\n /\\bos\\.(?:system|popen)\\s*\\(\\s*(?:f?['\"][^'\"]*['\"]\\s*(?:\\+|%|\\.\\s*format)|f['\"]|[a-zA-Z_]\\w*\\s*[,)])|\\bsubprocess\\.(?:run|call|check_call|check_output|Popen)\\s*\\([^)]*\\bshell\\s*=\\s*True/,\n },\n {\n id: 'go-shell-exec-command',\n title: 'exec.Command invoking a shell',\n consequence:\n 'Passing `sh -c` re-introduces the shell that `exec.Command`’s argv interface exists to avoid.',\n cwe: 'CWE-78',\n severity: 'critical',\n languages: ['go'],\n pattern: /\\bexec\\.Command(?:Context)?\\s*\\(\\s*(?:ctx\\s*,\\s*)?\"(?:\\/bin\\/)?(?:sh|bash|zsh|cmd|powershell)\"\\s*,\\s*\"(?:-c|\\/c)\"/,\n // A call whose whole argv is string literals cannot be injected into.\n // `exec.Command(\"cmd\", \"/c\", \"ver\")` reads the Windows version; there is no\n // value in it for an attacker to reach, and the consequence above — that a\n // shell will interpret metacharacters — describes metacharacters nobody can\n // supply. gosec's G204 draws the line in the same place, and this was the\n // single finding a Go project got out of a whole scan before declining the\n // offer, which is an expensive way to report nothing.\n //\n // The guard has to end at the closing paren, so a literal followed by\n // anything else still reports: `\"ls \" + dir` leaves a `+` before the `)`,\n // `fmt.Sprintf(…)` leaves an identifier, and a bare variable leaves a name.\n // `(?:[^\"\\\\]|\\\\.)*` rather than `[^\"]*` so an escaped quote inside a\n // literal — `\"echo \\\"hi\\\"\"` — does not end the literal early and drop the\n // guard on a line it should have covered.\n lineGuard:\n /\\bexec\\.Command(?:Context)?\\s*\\(\\s*(?:ctx\\s*,\\s*)?\"(?:\\/bin\\/)?(?:sh|bash|zsh|cmd|powershell)\"\\s*,\\s*\"(?:-c|\\/c)\"\\s*(?:,\\s*\"(?:[^\"\\\\]|\\\\.)*\")*\\s*,?\\s*\\)/,\n },\n {\n id: 'rb-backtick-interpolation',\n title: 'backtick command with interpolation',\n consequence: 'Ruby backticks are a shell invocation; `#{}` inside one is command injection.',\n cwe: 'CWE-78',\n severity: 'critical',\n languages: ['ruby'],\n pattern: /`[^`\\n]*#\\{|\\bsystem\\s*\\(\\s*[\"'][^\"'\\n]*#\\{|%x\\[[^\\]]*#\\{/,\n },\n\n // ── Injection: dynamic code ──────────────────────────────────────────────\n {\n id: 'js-dynamic-code-execution',\n title: 'dynamic code execution',\n consequence: 'Any string reaching this call executes as code with the process’ privileges.',\n cwe: 'CWE-95',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\beval\\s*\\(|\\bnew\\s+Function\\s*\\(|\\bvm\\s*\\.\\s*run(?:InThisContext|InNewContext|InContext)\\s*\\(|\\bset(?:Timeout|Interval)\\s*\\(\\s*(?:['\"`]|(?:req|request|ctx|params|query|body)\\b)/,\n },\n {\n id: 'js-indirect-code-sink',\n title: 'code sink reached indirectly',\n consequence:\n 'Resolving `eval`/`Function` through `globalThis[…]` or `.constructor` hides the sink from literal matching. Legitimate code has no reason to.',\n cwe: 'CWE-506',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\bglobalThis\\s*\\[\\s*[a-zA-Z_$][\\w$]*\\s*\\]|\\(\\s*function\\s*\\(\\s*\\)\\s*\\{\\s*\\}\\s*\\)\\s*\\.\\s*constructor/,\n },\n {\n id: 'js-encoded-payload-execution',\n title: 'encoded blob decoded next to a code sink',\n consequence:\n 'A base64 literal that is decoded and executed is the standard shape of a planted backdoor; the encoding exists to defeat review.',\n cwe: 'CWE-506',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern: /\\bBuffer\\.from\\s*\\(\\s*[\\w.$]+\\s*,\\s*['\"]base64['\"]\\s*\\)|\\batob\\s*\\(\\s*[\\w.$]+\\s*\\)/,\n requires: CODE_SINK,\n guardBack: 6,\n guardForward: 3,\n },\n {\n id: 'py-dynamic-code-execution',\n title: 'dynamic code execution',\n consequence: 'Any string reaching this call executes as Python with the process’ privileges.',\n cwe: 'CWE-95',\n severity: 'critical',\n languages: ['python'],\n pattern: /\\b(?:eval|exec)\\s*\\(\\s*(?!['\"]\\s*\\))[a-zA-Z_(f'\"]/,\n needsContext: true,\n },\n {\n id: 'rb-dynamic-dispatch',\n title: 'dynamic code execution or unrestricted #send',\n consequence:\n '`eval` runs arbitrary Ruby; unrestricted `#send` lets the caller invoke any method on the receiver, including private ones.',\n cwe: 'CWE-95',\n severity: 'critical',\n languages: ['ruby'],\n pattern: /\\beval\\s*\\(|\\binstance_eval\\s*\\(|\\bclass_eval\\s*\\(|\\.\\s*send\\s*\\(\\s*(?:params|request|args)\\b/,\n },\n\n // ── Cross-site scripting ─────────────────────────────────────────────────\n {\n id: 'js-unescaped-html-sink',\n title: 'unescaped HTML rendering',\n consequence: 'A script tag in the value executes in the victim’s session — stored or reflected XSS.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n /**\n * The assignment alternative carries its own exemption, as a lookahead, so\n * that it is decided per assignment rather than per line.\n *\n * A whole-statement assignment of a string with no interpolation and no\n * concatenation carries no data, so it cannot carry attacker data. This was\n * the single largest source of noise: a codebase that builds its UI with\n * innerHTML reports every static heading and spinner as XSS, and a rule\n * that flags 40 safe lines to catch one real one gets switched off.\n *\n * Two things this has to get right, and a `lineGuard` could get neither:\n *\n * A statement ends at its semicolon, not at the newline. Anchoring to `$`\n * held the exemption for `el.innerHTML = '';` alone on a line and dropped\n * it the moment anything followed:\n *\n * function hide() { out.hidden = true; out.innerHTML = ''; rendered = null; }\n *\n * — the same assignment, clearing a node, reported as high-severity XSS\n * because two neighbours shared its line.\n *\n * And an exemption must not become a line-wide amnesty. A guard is tested\n * against the whole line, so one safe clear would exonerate a real sink\n * beside it:\n *\n * a.innerHTML = ''; b.innerHTML = userInput;\n *\n * As a lookahead the regex decides at each `=` it reaches, so the first\n * assignment is exempt and the second is still reported.\n *\n * The whitespace after `=` is matched *inside* the lookahead rather than\n * before it. Left outside, `\\s*` backtracks to zero width, the lookahead\n * then starts on the space instead of the quote, fails to see a literal,\n * and the negative lookahead succeeds — reinstating every finding the\n * exemption was written to remove.\n */\n pattern:\n /\\bdangerouslySetInnerHTML\\s*=|\\.\\s*(?:innerHTML|outerHTML)\\s*=(?!\\s*(?:'[^'\\\\\\n]*'|\"[^\"\\\\\\n]*\"|`[^`$\\\\\\n]*`)\\s*(?:;|$))|\\bdocument\\s*\\.\\s*write(?:ln)?\\s*\\(|\\.\\s*insertAdjacentHTML\\s*\\(/,\n },\n {\n id: 'java-html-writer-concatenation',\n title: 'HTML written to the response by concatenation',\n consequence:\n 'The servlet writer performs no encoding; a value concatenated into markup is rendered as markup.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['java'],\n pattern: /\\b(?:println|print|write)\\s*\\(\\s*\"[^\"\\n]*<[^\"\\n]*\"\\s*\\+/,\n },\n {\n id: 'rb-unescaped-output',\n title: 'Rails output escaping bypassed',\n consequence:\n '`html_safe` and `raw` tell Rails the string is already safe. If it came from a parameter, it is not.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['ruby'],\n pattern: /\\.\\s*html_safe\\b|\\braw\\s*\\(\\s*(?:params|request|@)|\\blink_to\\s+[^,\\n]+,\\s*params\\s*\\[/,\n },\n {\n id: 'py-template-autoescape-off',\n title: 'template rendering with escaping disabled',\n consequence:\n 'With autoescape off — or a `|safe` filter — every interpolated value is rendered as markup.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['python'],\n pattern: /\\bEnvironment\\s*\\([^)]*\\bautoescape\\s*=\\s*False|\\|\\s*safe\\b|\\bMarkup\\s*\\(\\s*(?!['\"])/,\n },\n {\n id: 'py-template-from-input',\n title: 'template compiled from a non-literal source',\n consequence:\n 'Server-side template injection. In Jinja2 the sandbox is escapable, so this escalates from XSS to remote code execution.',\n cwe: 'CWE-1336',\n severity: 'critical',\n languages: ['python'],\n pattern: /\\bTemplate\\s*\\(\\s*(?!['\"])[a-zA-Z_]/,\n needsContext: true,\n },\n\n // ── Server-side request forgery ──────────────────────────────────────────\n {\n id: 'js-ssrf-outbound-request',\n title: 'outbound request to a non-constant URL',\n consequence:\n 'An attacker who controls the URL reaches the cloud metadata endpoint, localhost, and every service on the private network.',\n cwe: 'CWE-918',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\bfetch\\s*\\(\\s*[a-zA-Z_$][\\w$]*\\s*[,)]|\\bhttps?\\s*\\.\\s*(?:get|request)\\s*\\(\\s*[a-zA-Z_$][\\w$]*\\s*[,)]|\\baxios\\s*\\.\\s*get\\s*\\(\\s*[a-zA-Z_$][\\w$]*\\s*[,)]/,\n needsContext: true,\n },\n {\n id: 'py-ssrf-outbound-request',\n title: 'outbound request to a non-constant URL',\n consequence:\n 'An attacker who controls the URL reaches the cloud metadata endpoint, localhost, and every service on the private network.',\n cwe: 'CWE-918',\n severity: 'high',\n languages: ['python'],\n pattern:\n /\\brequests\\.(?:get|request|head)\\s*\\(\\s*[a-zA-Z_]\\w*\\s*[,)]|\\burlopen\\s*\\(\\s*[a-zA-Z_]\\w*\\s*[,)]|\\bhttpx\\.get\\s*\\(\\s*[a-zA-Z_]\\w*\\s*[,)]/,\n needsContext: true,\n },\n {\n id: 'go-ssrf-outbound-request',\n title: 'outbound request to a non-constant URL',\n consequence:\n 'An attacker who controls the URL reaches the cloud metadata endpoint, localhost, and every service on the private network.',\n cwe: 'CWE-918',\n severity: 'high',\n languages: ['go'],\n pattern: /\\bhttp\\.(?:Get|Post|Head)\\s*\\(\\s*(?:[a-zA-Z_]\\w*\\s*[,)]|\"[^\"]*\"\\s*\\+)/,\n needsContext: true,\n },\n\n // ── Open redirect ────────────────────────────────────────────────────────\n {\n id: 'js-open-redirect',\n title: 'redirect to a non-constant destination',\n consequence:\n 'Your domain becomes the credible first hop of a phishing chain; the victim sees your hostname in the link they clicked.',\n cwe: 'CWE-601',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\b(?:res|response)\\s*\\.\\s*redirect\\s*\\(\\s*[a-zA-Z_$][\\w$]*\\s*\\)|\\bwindow\\s*\\.\\s*location(?:\\s*\\.\\s*(?:href|replace))?\\s*(?:=\\s*[a-zA-Z_$]|\\(\\s*[a-zA-Z_$][\\w$]*\\s*\\))/,\n needsContext: true,\n },\n\n // ── Deserialisation ──────────────────────────────────────────────────────\n {\n id: 'py-unsafe-deserialization',\n title: 'deserialisation of untrusted data',\n consequence:\n '`pickle` and `yaml.load` instantiate arbitrary types during parsing — a crafted payload is remote code execution, not a parse error.',\n cwe: 'CWE-502',\n severity: 'critical',\n languages: ['python'],\n pattern: /\\bpickle\\.loads?\\s*\\(|\\bcPickle\\.loads?\\s*\\(|\\bmarshal\\.loads\\s*\\(|\\byaml\\.load\\s*\\(|\\bjsonpickle\\.decode\\s*\\(/,\n },\n {\n id: 'java-unsafe-deserialization',\n title: 'Java deserialisation without a class filter',\n consequence:\n 'A gadget chain in the classpath turns `readObject()` on attacker bytes into remote code execution.',\n cwe: 'CWE-502',\n severity: 'critical',\n languages: ['java'],\n pattern: /\\breadObject\\s*\\(\\s*\\)|\\bnew\\s+ObjectInputStream\\s*\\(/,\n guardBack: 8,\n // The stream is constructed, *then* filtered. Without a forward window the\n // guarded case matches on its constructor line and reports a correct\n // implementation as a finding.\n guardForward: 6,\n },\n {\n id: 'js-unsafe-yaml-load',\n title: 'YAML parsed with type resolution enabled',\n consequence: 'A crafted document can instantiate arbitrary types during parsing.',\n cwe: 'CWE-502',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\byaml\\s*\\.\\s*load\\s*\\((?![^)]*safe)|\\bloadAll\\s*\\([^)]*unsafe/i,\n },\n\n // ── XML external entities ────────────────────────────────────────────────\n //\n // Evidence that a file parses XML at all. The XXE rules match on receiver\n // *names* — `builder.parse(is)` is the shape the vulnerability actually takes,\n // and the declared type is rarely on that line — so without this the pattern\n // reads any `.parse()` on anything suffixed Builder, Parser or Reader as XML.\n // In practice that meant a hostname-mask parser (`HostMask.Parser.parse(...)`)\n // was reported as CWE-611 at high severity.\n //\n // An import is the cheapest honest signal: a file that parses XML says so at\n // the top, and one that never mentions XML is not parsing it.\n {\n id: 'java-xxe-parser-defaults',\n title: 'XML parser left on its insecure defaults',\n consequence:\n 'External entity expansion reads local files and makes outbound requests on the parser’s behalf — file disclosure and SSRF from a document.',\n cwe: 'CWE-611',\n severity: 'high',\n languages: ['java'],\n pattern:\n /\\b(?:DocumentBuilderFactory|SAXParserFactory|XMLInputFactory|TransformerFactory|SchemaFactory)\\s*\\.\\s*newInstance\\s*\\(\\s*\\)/,\n guard: XXE_GUARD,\n guardBack: 4,\n guardForward: 8,\n },\n {\n id: 'java-xxe-parse-call',\n title: 'XML parsed by a builder that was never hardened',\n consequence:\n 'The expansion happens at `parse()`. Flagging only the factory misses the line where the document is actually read.',\n cwe: 'CWE-611',\n severity: 'high',\n languages: ['java'],\n // Receiver-qualified so `LocalDate.parse(s)` and friends stay out of it.\n // The suffix alone is not enough — plenty of parsers parse things that are\n // not XML — so `fileRequires` decides whether the file is in scope at all.\n pattern: /\\b\\w*(?:[Bb]uilder|[Pp]arser|[Rr]eader)\\s*\\.\\s*parse\\s*\\(/,\n fileRequires: XML_PARSING_FILE,\n guard: XXE_GUARD,\n guardBack: 6,\n guardForward: 4,\n },\n\n // ── Path traversal ───────────────────────────────────────────────────────\n {\n id: 'py-path-traversal',\n title: 'file opened at a path built from input',\n consequence: 'A `../` sequence — or an absolute path — reads or writes outside the intended directory.',\n cwe: 'CWE-22',\n severity: 'high',\n languages: ['python'],\n pattern: /\\bopen\\s*\\(\\s*(?:os\\.path\\.join\\s*\\(|[a-zA-Z_]\\w*\\s*\\+|f['\"])/,\n needsContext: true,\n },\n {\n id: 'js-path-traversal',\n title: 'file path built from a variable',\n consequence: 'A `../` sequence in the value reads or writes outside the intended directory.',\n cwe: 'CWE-22',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\b(?:readFile|readFileSync|writeFile|writeFileSync|createReadStream|createWriteStream|unlink|unlinkSync|sendFile)\\s*\\(\\s*(?:`[^`]*\\$\\{|[a-zA-Z_$][\\w$]*\\s*\\+|path\\.join\\s*\\([^)]*(?:req|request)\\b)/,\n needsContext: true,\n },\n\n // ── Cryptography, tokens, randomness ─────────────────────────────────────\n {\n id: 'js-jwt-decode-without-verify',\n title: 'JWT decoded without verifying the signature',\n consequence:\n '`decode` parses the claims and checks nothing. Anyone can mint a token with any `sub` and any `role`.',\n cwe: 'CWE-347',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern: /\\bjwt\\s*\\.\\s*decode\\s*\\(|\\bjsonwebtoken\\s*\\.\\s*decode\\s*\\(|\\bdecodeJwt\\s*\\(/,\n },\n {\n id: 'tls-verification-disabled',\n inherent: true,\n title: 'TLS certificate verification disabled',\n consequence:\n 'Every connection made this way is trivially interceptable; the encryption is decorative.',\n cwe: 'CWE-295',\n severity: 'high',\n pattern:\n /rejectUnauthorized\\s*:\\s*false|NODE_TLS_REJECT_UNAUTHORIZED\\s*[=:]\\s*['\"]?0|strictSSL\\s*:\\s*false|\\bverify\\s*=\\s*False\\b|InsecureSkipVerify\\s*:\\s*true/,\n },\n {\n id: 'weak-hash-on-credential',\n title: 'broken hash used on a credential',\n consequence: 'MD5 and SHA-1 are fast and collision-prone; hashed passwords are recoverable.',\n cwe: 'CWE-327',\n severity: 'high',\n pattern:\n /(?:createHash|hashlib|MessageDigest\\.getInstance|Digest::)\\s*[.(]?\\s*['\"]?(?:md5|MD5|sha1|SHA-?1)['\"]?\\s*\\)?[\\s\\S]{0,80}(?:password|passwd|secret|token|credential)/i,\n },\n {\n id: 'insecure-randomness-for-secret',\n title: 'predictable randomness used for a security value',\n consequence:\n '`Math.random`/`random.random` are predictable; tokens, session ids and reset codes built from them are guessable.',\n cwe: 'CWE-338',\n severity: 'high',\n pattern:\n /(?:token|secret|password|salt|nonce|session|otp|reset|apikey|api_key)[\\w]*\\s*[:=][^;\\n]{0,60}(?:Math\\s*\\.\\s*random\\s*\\(|\\brandom\\s*\\.\\s*(?:random|randint|choice)\\s*\\(|\\brand\\s*\\()/i,\n },\n\n // ── Weak crypto: Python ──────────────────────────────────────────────────\n //\n // The generic rules above catch the credential case on the matched line.\n // These cover what they miss in Python, where the security role of a value is\n // set by the enclosing function rather than a same-line assignment — a\n // `random`-drawn token that is *returned*, an MD5 used to *verify* an\n // artifact — and the broken ciphers, which have no safe use at all.\n {\n id: 'py-broken-cipher',\n title: 'broken cipher or ECB mode',\n consequence:\n 'DES, RC2, RC4 and Blowfish are broken or too small to rely on, and ECB encrypts identical plaintext blocks to identical ciphertext, so structure in the data survives encryption. None of them provides the confidentiality their use implies.',\n cwe: 'CWE-327',\n severity: 'high',\n languages: ['python'],\n // PyCryptodome/PyCrypto constructors. The mode matters only for AES, whose\n // safe modes (GCM, CTR, CBC) are common — so AES matches solely on ECB,\n // while DES/RC4/Blowfish are broken by the algorithm regardless of mode.\n pattern:\n /\\b(?:DES|DES3|ARC2|RC2|ARC4|RC4|Blowfish|XOR)\\s*\\.\\s*new\\s*\\(|\\bAES\\s*\\.\\s*new\\s*\\([^)\\n]*\\bMODE_ECB\\b/,\n inherent: true,\n guard: false,\n },\n {\n id: 'py-weak-hash',\n title: 'broken hash algorithm',\n consequence:\n 'MD5 and SHA-1 have practical collisions, so a digest used for integrity or a signature can be forged to match a value the code trusts.',\n cwe: 'CWE-327',\n severity: 'medium',\n languages: ['python'],\n pattern: /\\bhashlib\\s*\\.\\s*(?:md5|sha1)\\s*\\(/,\n // Python 3.9+ marks a non-security digest — a cache key, an ETag — with\n // `usedforsecurity=False`, which is exactly the \"this MD5 is not a security\n // claim\" signal, so it exempts the line rather than being flagged.\n lineGuard: /usedforsecurity\\s*=\\s*False/,\n },\n {\n id: 'py-predictable-random-seed',\n title: 'PRNG seeded from a predictable value',\n consequence:\n 'Seeding `random` from the clock or the process id makes its whole sequence reproducible, so anything drawn from it afterwards — a token, an id, a shuffle — can be regenerated by guessing the seed.',\n cwe: 'CWE-338',\n severity: 'high',\n languages: ['python'],\n // A time- or pid-derived seed, which is the predictable kind. A fixed\n // integer seed (`random.seed(42)`) is deliberate reproducibility for tests\n // and simulations, so it is left alone. This needs no credential context:\n // seeding the global PRNG from the clock is a weakness on its own terms,\n // which is why the enclosing function's name — that this engine does not\n // read as evidence anyway — is not consulted.\n pattern:\n /\\brandom\\s*\\.\\s*seed\\s*\\([^)\\n]*(?:time\\s*\\.\\s*time|datetime|\\.\\s*now\\s*\\(|getpid)/,\n inherent: true,\n },\n {\n id: 'redos-nested-quantifier',\n title: 'regex with nested unbounded quantifiers',\n consequence:\n 'Catastrophic backtracking: a crafted input of a few dozen characters pins a CPU core for minutes.',\n cwe: 'CWE-1333',\n severity: 'medium',\n // Scoped, because unscoped this rule reads C as if it were a regex.\n //\n // `(void *)*memptr64` — a cast to a pointer type, then a dereference — is\n // the single most ordinary line in a C file, and it matches the first\n // alternative exactly: `(`, some text, `*`, `)`, `*`. Every `*(char *)*p`\n // in a codebase became a ReDoS finding. Caught on inspektor-gadget, where\n // the rule's one and only hit across 1186 files was a `bpf_probe_read_user`\n // call in an eBPF C program.\n //\n // Scoping is the fix rather than a cleverer pattern: C has no regex\n // literals, so there is nothing here for the rule to find no matter how\n // the pattern is written. `other` also covers C++, Rust and Zig, which\n // share the cast-then-deref spelling.\n languages: ['javascript', 'typescript', 'python', 'ruby', 'go', 'java', 'php'],\n pattern: /\\([^)\\n]*[+*]\\s*\\)\\s*[+*]|\\([^)\\n]*\\{\\d+,\\}\\s*\\)\\s*[+*{]/,\n },\n\n // ── Temporary files ──────────────────────────────────────────────────────\n {\n id: 'insecure-temp-file',\n title: 'predictable temporary file path',\n consequence:\n 'A predictable name in a world-writable directory is a symlink attack: an attacker pre-creates the path and your process writes through it.',\n cwe: 'CWE-377',\n severity: 'medium',\n // A hardcoded path under /tmp is the finding whether or not it is\n // formatted: `\"/tmp/application.log.tmp\"` is worse than the PID-based one,\n // because every process on the host can predict it exactly.\n pattern:\n /\\btempfile\\.mktemp\\s*\\(|\\bos\\.tmpnam\\s*\\(|['\"]\\/tmp\\/[^'\"\\n]+['\"]|['\"]\\/tmp\\/[^'\"\\n]*\\{|\\bFile\\.createTempFile\\s*\\(/,\n },\n\n // ── Information exposure ─────────────────────────────────────────────────\n {\n id: 'py-stack-trace-returned',\n title: 'stack trace returned to the caller',\n consequence:\n 'Tracebacks leak absolute paths, dependency versions and source fragments — the reconnaissance an attacker would otherwise have to guess at.',\n cwe: 'CWE-209',\n severity: 'medium',\n languages: ['python'],\n pattern: /\\breturn\\b[^\\n]*\\btraceback\\.(?:format_exc|format_exception|print_exc)\\s*\\(|\\breturn\\b[^\\n]*\\bstr\\s*\\(\\s*e\\s*\\)/,\n },\n {\n id: 'js-environment-exfiltration',\n title: 'process environment serialised into a payload',\n consequence:\n 'The environment is where every secret lives. Serialising it whole into a request body is credential exfiltration regardless of the endpoint.',\n cwe: 'CWE-532',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern: /\\bJSON\\.stringify\\s*\\(\\s*\\{?[^)]*\\bprocess\\.env\\b(?!\\s*\\.)/,\n guard: false,\n },\n {\n id: 'js-credential-logged',\n title: 'credential read from the environment into a log sink',\n consequence:\n 'CI retains job logs, and on public forks it publishes them. A token printed once is a token leaked permanently.',\n cwe: 'CWE-532',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\b(?:token|apiKey|api_key|secret|password|credential|auth)\\w*\\s*:\\s*process\\.env\\.\\w+/i,\n requires: EXFIL_SINK,\n guard: false,\n guardBack: 4,\n guardForward: 1,\n },\n\n // ── Prototype pollution ──────────────────────────────────────────────────\n {\n id: 'js-prototype-pollution',\n title: 'write to a prototype-reachable key',\n consequence:\n 'An attacker-supplied `__proto__` key changes behaviour for every object in the process, including ones it never touched.',\n cwe: 'CWE-1321',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\[\\s*['\"]__proto__['\"]\\s*\\]|\\bObject\\s*\\.\\s*assign\\s*\\(\\s*[\\w.$]*\\.prototype\\b|\\.\\s*__proto__\\s*=/,\n },\n\n // ── Shell ────────────────────────────────────────────────────────────────\n //\n // `shell` was a language the type system knew about and no rule targeted, so\n // a repository written entirely in bash got secret detection and nothing\n // else. Installers, CI helpers and packaging scripts are where a great deal\n // of privileged work actually happens, and they run as whoever invoked them.\n {\n id: 'sh-remote-script-execution',\n inherent: true,\n title: 'network output piped into a shell',\n consequence:\n 'Whatever that URL serves at the moment this runs is executed as the invoking user. There is no version, no signature, and no review — a compromise of the host, or anyone able to answer for it, is a compromise of every machine that runs the script.',\n cwe: 'CWE-494',\n severity: 'high',\n languages: ['shell'],\n // The pipe must be the *next* thing: `curl -o f url && sh f` is a different\n // (and checkable) shape, and `curl url | jq` is not an execution at all.\n pattern: /\\b(?:curl|wget)\\b[^|\\n]*\\|\\s*(?:sudo\\s+(?:-\\S+\\s+)*)?(?:\\/bin\\/|\\/usr\\/bin\\/)?(?:ba|da|k|z|a)?sh\\b/,\n // Nothing on this line can exonerate it. Integrity checking happens in a\n // separate step by construction, so a window guard would only mislead.\n guard: false,\n },\n {\n id: 'sh-eval-expansion',\n title: 'eval on an expanded string',\n consequence:\n 'The expansion is re-parsed as shell source, so a `;` or `$(…)` anywhere in the value runs as a command rather than arriving as data.',\n cwe: 'CWE-78',\n severity: 'high',\n languages: ['shell'],\n // Matched against eval's *argument*, not against the rest of the line.\n //\n // `\\beval\\b.*\\$` looks equivalent and is not: bash's ordinary dynamic-range\n // idiom, `eval echo {$((k + 1))..$((k + n))}`, contains `$k` inside the\n // arithmetic, so a line-wide search finds an expansion in a construct that\n // cannot carry a command — `$((…))` is parsed as an expression, where a `;`\n // is a syntax error rather than a second command. That spelling reported\n // 355 findings in one 3,500-line script, all of them the same safe loop.\n //\n // What is left is the form where eval is handed a value directly —\n // `eval \"$cmd\"`, `eval $cmd`, `eval \"$(…)\"` — which is the shape that\n // actually re-parses untrusted text as source. `eval echo $x` is not\n // covered; catching it without also catching the range idiom needs to know\n // which expansions are arithmetic, which is parsing, not matching.\n pattern: /\\beval\\s+(?:-\\S+\\s+)*(?:\"\\s*)?\\$(?:\\{?[A-Za-z_]\\w*|\\((?!\\())/,\n // The shell-init idiom `eval \"$(tool init -)\"` is the documented interface\n // of most version managers. It is still eval of program output, but the\n // program is a fixed local binary, and flagging it reports every developer\n // dotfile in existence.\n lineGuard:\n /\\beval\\s+\"?\\$\\(\\s*(?:ssh-agent|dircolors|direnv|rbenv|pyenv|nodenv|goenv|jenv|tfenv|opam|luarocks|conda|mamba|zoxide|starship|mise|asdf|fnm|nvm|brew|thefuck|register-python-argcomplete|_\\w+_completion)\\b/,\n },\n {\n id: 'sh-unquoted-expansion-destructive',\n title: 'unquoted expansion in a destructive command',\n consequence:\n 'An unquoted expansion is word-split and glob-expanded before the command sees it. A value with a space removes two paths instead of one; an empty value removes the argument entirely, which is how `rm -rf $DIR/` becomes `rm -rf /`.',\n cwe: 'CWE-78',\n severity: 'high',\n languages: ['shell'],\n // `[^\"'\\n]*?` cannot cross a quote, so `rm -rf \"$dir\"` — the correct form —\n // never reaches the `$` and never matches. Only a genuinely bare expansion\n // does. Restricted to recursive/forced removal: a bare `$f` in `rm $f` is\n // sloppy, but it is not the shape that erases a filesystem.\n pattern: /\\brm\\s+(?:-[a-zA-Z-]*[rRf][a-zA-Z-]*\\s+)+[^\"'\\n]*?\\$\\{?[A-Za-z_]/,\n },\n {\n id: 'sh-insecure-transport-flag',\n inherent: true,\n title: 'certificate verification disabled',\n consequence:\n 'Anyone positioned between this host and the server can substitute the response. When the response is a package, a key or a script, that is remote code execution with the transport doing nothing to stop it.',\n cwe: 'CWE-295',\n severity: 'high',\n languages: ['shell'],\n pattern:\n /\\b(?:curl|wget)\\b[^\\n|]*(?:\\s-k(?=\\s|$)|\\s--insecure\\b|\\s--no-check-certificate\\b)/,\n // Over plain HTTP there is no certificate to skip, so the flag is inert and\n // this rule has nothing to say — `sh-plaintext-download` is the finding\n // that fits. Reporting both put two entries on one line, one of which\n // recommended a fix that would change nothing.\n lineGuard: /^(?!.*https:\\/\\/).*\\bhttp:\\/\\//,\n },\n {\n id: 'sh-plaintext-download',\n inherent: true,\n title: 'download over plain HTTP',\n consequence:\n 'The response arrives unauthenticated over a channel any intermediary can rewrite. Where the payload is an archive, a package list or a key, substituting it is straightforward and leaves nothing for the script to notice.',\n cwe: 'CWE-319',\n severity: 'high',\n languages: ['shell'],\n pattern: /\\b(?:curl|wget)\\b[^\\n|]*\\bhttp:\\/\\//,\n // Loopback and link-local are not carried over a network anyone can sit on.\n lineGuard:\n /http:\\/\\/(?:localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|\\[::1\\]|169\\.254\\.|host\\.docker\\.internal)\\b/,\n },\n {\n id: 'sh-world-writable-permissions',\n inherent: true,\n title: 'world-writable permissions',\n consequence:\n 'Any local account can rewrite the file. If it is a script, a config or anything on a privileged path, the next process to read it runs someone else’s content.',\n cwe: 'CWE-732',\n severity: 'medium',\n languages: ['shell'],\n pattern: /\\bchmod\\s+(?:-[a-zA-Z-]+\\s+)*(?:0?777|a\\+rwx|ugo\\+rwx|a=rwx)\\b/,\n },\n {\n id: 'sh-predictable-temp-path',\n title: 'predictable temporary file',\n consequence:\n 'The name is guessable, so a local attacker can create it first — as a symlink to somewhere that matters — and the script writes through it with its own privileges.',\n cwe: 'CWE-377',\n severity: 'medium',\n languages: ['shell'],\n // Redirection or an explicit write into a literal `/tmp` path. A `$$` or\n // `$RANDOM` suffix is still predictable, so it is not treated as a fix;\n // `mktemp` is, and it is the guard below.\n pattern: /(?:>{1,2}\\s*|\\b(?:tee|touch|cp|mv|install)\\s+(?:-\\S+\\s+)*)\\/tmp\\/[\\w.$-]+/,\n guard: /\\bmktemp\\b/,\n guardBack: 6,\n guardForward: 2,\n },\n\n // ── PHP ──────────────────────────────────────────────────────────────────\n //\n // `php` was the second language in `ScanLanguage` that no rule targeted, for\n // the same reason `shell` was: nothing checks the two lists against each\n // other. `LANGUAGE_COVERAGE` in the tests does now.\n {\n id: 'php-sql-interpolation',\n title: 'SQL assembled by interpolation',\n consequence:\n 'PHP interpolates variables inside double-quoted strings, so the value is part of the statement before the driver ever sees it. A quote in the value ends the literal and the rest is parsed as SQL.',\n cwe: 'CWE-89',\n severity: 'critical',\n languages: ['php'],\n // Interpolation (`\"… $id …\"`, `\"… {$id} …\"`) or concatenation onto a SQL\n // string. A prepared statement passes placeholders and binds separately,\n // so its query string contains neither.\n pattern: new RegExp(\n `\\\\b(?:mysqli_query|mysql_query|pg_query|->\\\\s*(?:query|exec|unprepared))\\\\s*\\\\([^)]*(?:\"[^\"\\\\n]*(?:${SQL_KEYWORDS})\\\\b[^\"\\\\n]*(?:\\\\$\\\\w+|\\\\{\\\\$)|${SQL_STRING}\\\\s*\\\\.)`,\n 'i',\n ),\n },\n {\n id: 'php-shell-exec-interpolation',\n title: 'shell command built from a variable',\n consequence:\n 'The string is handed to `/bin/sh`, which interprets `;`, `|` and `$(…)` in whatever the variable held.',\n cwe: 'CWE-78',\n severity: 'critical',\n languages: ['php'],\n pattern:\n /\\b(?:exec|system|shell_exec|passthru|popen|proc_open|pcntl_exec)\\s*\\(\\s*(?:\"[^\"\\n]*(?:\\$\\w+|\\{\\$)|'[^'\\n]*'\\s*\\.|\\$\\w+\\s*\\.)/,\n // `escapeshellarg`/`escapeshellcmd` are the correct answer and are usually\n // applied inline, so a line-scoped guard is the right shape.\n lineGuard: /\\bescapeshell(?:arg|cmd)\\s*\\(/,\n },\n {\n id: 'php-dynamic-code-execution',\n title: 'dynamic code execution',\n consequence:\n 'Whatever reaches this call is executed as PHP source with the privileges of the web process.',\n cwe: 'CWE-95',\n severity: 'critical',\n languages: ['php'],\n pattern: /\\b(?:eval|assert|create_function)\\s*\\(\\s*(?:\\$\\w+|\"[^\"\\n]*(?:\\$\\w+|\\{\\$))/,\n guard: false,\n },\n {\n id: 'php-dynamic-file-inclusion',\n title: 'include path built from a variable',\n consequence:\n 'The included file is executed, not read. A traversal sequence reaches any file the process can open, and with a remote wrapper enabled the path need not be local at all.',\n cwe: 'CWE-98',\n severity: 'critical',\n languages: ['php'],\n pattern:\n /\\b(?:include|include_once|require|require_once)\\s*(?:\\(\\s*)?(?:\\$\\w+|\"[^\"\\n]*(?:\\$\\w+|\\{\\$)|'[^'\\n]*'\\s*\\.)/,\n // A basename-and-allow-list is the standard fix; `basename` alone still\n // leaves the extension open, but it defeats traversal, which is the part\n // this rule is about.\n lineGuard: /\\bbasename\\s*\\(/,\n },\n {\n id: 'php-unserialize-untrusted',\n title: 'unserialize on request data',\n consequence:\n 'PHP object deserialisation instantiates classes and runs their magic methods. With a suitable class in scope this is remote code execution, and no `unserialize` option short of `allowed_classes => false` prevents it.',\n cwe: 'CWE-502',\n severity: 'critical',\n languages: ['php'],\n pattern: /\\bunserialize\\s*\\(\\s*(?:\\$_(?:GET|POST|REQUEST|COOKIE)\\b|\\$\\w+)/,\n // The key is an array key and is normally quoted: `['allowed_classes' => false]`.\n lineGuard: /[\"']?allowed_classes[\"']?\\s*=>\\s*(?:false|\\[)/,\n needsContext: true,\n },\n {\n id: 'php-unescaped-output',\n title: 'request data echoed without escaping',\n consequence:\n 'The value is written into the response verbatim, so markup in it becomes markup in the page — script that runs with the victim’s session.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['php'],\n pattern:\n /\\b(?:echo|print)\\s+[^;\\n]*\\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\\b|<\\?=\\s*\\$_(?:GET|POST|REQUEST|COOKIE)\\b/,\n },\n {\n id: 'php-request-path-traversal',\n title: 'file path taken from the request',\n consequence:\n 'A `../` sequence in the value walks out of the intended directory, and the process reads or writes wherever it lands.',\n cwe: 'CWE-22',\n severity: 'high',\n languages: ['php'],\n pattern:\n /\\b(?:file_get_contents|file_put_contents|fopen|readfile|unlink|copy|rename|opendir|scandir)\\s*\\(\\s*[^)\\n]*\\$_(?:GET|POST|REQUEST|COOKIE)\\b/,\n lineGuard: /\\bbasename\\s*\\(|\\brealpath\\s*\\(/,\n },\n {\n id: 'php-variable-injection',\n title: 'request data expanded into local variables',\n consequence:\n '`extract` creates a variable per key, so a request can overwrite any local already in scope — including the one a subsequent authorisation check reads.',\n cwe: 'CWE-621',\n severity: 'high',\n languages: ['php'],\n pattern: /\\bextract\\s*\\(\\s*\\$_(?:GET|POST|REQUEST|COOKIE)\\b|\\bimport_request_variables\\s*\\(/,\n guard: false,\n },\n\n // ── Java and Go: classes the other languages already had ─────────────────\n //\n // Command injection, SSRF and path traversal were implemented for JavaScript\n // and, in part, for Go, and never for Java — so the same defect in the same\n // codebase was reported or not depending on which file it lived in. TLS\n // verification, weak hashing and insecure randomness are deliberately absent\n // here: `tls-verification-disabled`, `weak-hash-on-credential` and\n // `insecure-randomness-for-secret` are language-agnostic and already cover\n // both, including Go's `InsecureSkipVerify` and Java's `MessageDigest`.\n {\n id: 'java-runtime-exec-concatenation',\n title: 'Runtime.exec with a concatenated command',\n consequence:\n 'The single-string form of `exec` is split on whitespace and handed to the OS. A value carrying a space becomes extra arguments, and where a shell is invoked, `;` and `$(…)` become extra commands.',\n cwe: 'CWE-78',\n severity: 'critical',\n languages: ['java'],\n // The array form — `exec(new String[]{\"git\", arg})` — passes argv and is\n // the fix, so it is not matched: the `+` has to be inside the string\n // argument for this to fire.\n pattern:\n /\\b(?:Runtime\\s*\\.\\s*getRuntime\\s*\\(\\s*\\)\\s*\\.\\s*exec|ProcessBuilder)\\s*\\(\\s*(?:\"[^\"\\n]*\"\\s*\\+|\\w+\\s*\\+\\s*\")/,\n },\n {\n id: 'java-ssrf-outbound-request',\n title: 'outbound request to a computed URL',\n consequence:\n 'The destination is chosen by the caller, so the request can be aimed at internal services and cloud metadata endpoints that are reachable from this host and from nowhere else.',\n cwe: 'CWE-918',\n severity: 'high',\n languages: ['java'],\n pattern:\n /\\bnew\\s+URL\\s*\\(\\s*(?!\\s*\"[a-z]+:\\/\\/[^\"\\n]*\"\\s*\\))[^)\\n]*\\w|\\bHttpRequest\\s*\\.\\s*newBuilder\\s*\\(\\s*\\)\\s*\\.\\s*uri\\s*\\(\\s*URI\\s*\\.\\s*create\\s*\\(\\s*[^\"\\n)]/,\n needsContext: true,\n },\n {\n id: 'java-request-path-traversal',\n title: 'file path built from request data',\n consequence:\n 'A `../` sequence in the value walks out of the intended directory. The process then reads or writes wherever it lands, with its own privileges.',\n cwe: 'CWE-22',\n severity: 'high',\n languages: ['java'],\n pattern:\n /\\b(?:new\\s+File|new\\s+FileInputStream|new\\s+FileOutputStream|Paths\\s*\\.\\s*get|Files\\s*\\.\\s*(?:readAllBytes|newInputStream|newOutputStream|copy|delete))\\s*\\([^)\\n]*\\+/,\n // `getCanonicalPath().startsWith(base)` is the check that makes this safe,\n // and it is normally a line or two below the construction.\n guard: /getCanonicalPath|toRealPath|normalize\\s*\\(\\s*\\)|\\bstartsWith\\s*\\(/,\n guardForward: 4,\n needsContext: true,\n },\n {\n id: 'java-broken-cipher',\n inherent: true,\n title: 'broken cipher or ECB mode',\n consequence:\n 'DES, RC2, RC4 and Blowfish are broken or too small to rely on. ECB encrypts identical plaintext blocks to identical ciphertext blocks, so structure in the data survives encryption and is readable straight off the ciphertext.',\n cwe: 'CWE-327',\n severity: 'high',\n languages: ['java'],\n // Bare `\"AES\"` is included: the JCE resolves it to `AES/ECB/PKCS5Padding`,\n // so the default is the mode this rule exists to catch.\n pattern:\n /\\bCipher\\s*\\.\\s*getInstance\\s*\\(\\s*\"(?:DES|DESede|RC2|RC4|ARCFOUR|Blowfish)(?:\\/|\")|\\bCipher\\s*\\.\\s*getInstance\\s*\\(\\s*\"[^\"\\n]*\\/ECB\\/|\\bCipher\\s*\\.\\s*getInstance\\s*\\(\\s*\"AES\"\\s*\\)/,\n guard: false,\n },\n {\n id: 'go-request-path-traversal',\n title: 'file path built from request data',\n consequence:\n 'A `../` sequence in the value walks out of the intended directory, and the handler serves or writes whatever it reaches.',\n cwe: 'CWE-22',\n severity: 'high',\n languages: ['go'],\n pattern:\n /\\b(?:os\\s*\\.\\s*(?:Open|OpenFile|ReadFile|Create|Remove|WriteFile)|ioutil\\s*\\.\\s*(?:ReadFile|WriteFile)|http\\s*\\.\\s*ServeFile)\\s*\\([^)\\n]*(?:r\\s*\\.\\s*URL|FormValue|Query\\s*\\(\\s*\\)\\s*\\.\\s*Get|mux\\s*\\.\\s*Vars|\\bfilepath\\s*\\.\\s*Join\\s*\\([^)\\n]*\\w)/,\n // `filepath.Clean` alone does not bound the result to a directory, so it is\n // not a guard here — the containment check is.\n guard: /\\bstrings\\s*\\.\\s*HasPrefix\\s*\\(|\\bfilepath\\s*\\.\\s*Rel\\s*\\(|\\bfs\\s*\\.\\s*ValidPath\\s*\\(|\\bhttp\\s*\\.\\s*Dir\\b/,\n guardBack: 5,\n guardForward: 3,\n needsContext: true,\n },\n {\n id: 'go-template-escaping-bypass',\n title: 'value marked as pre-escaped HTML',\n consequence:\n '`template.HTML` tells `html/template` the value is already safe, which switches off the contextual escaping that makes the package worth using. Markup in the value reaches the page intact.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['go'],\n // A conversion of a *variable*. `template.HTML(\"<br>\")` on a literal is a\n // constant the author wrote and is not a finding.\n pattern: /\\btemplate\\s*\\.\\s*(?:HTML|JS|CSS|HTMLAttr|URL|Srcset)\\s*\\(\\s*(?!\\s*[`\"])/,\n needsContext: true,\n },\n\n // ── Misconfiguration, weak crypto and the rest of the injection family ────\n //\n // Each of these is a defect the *line* shows — a debug flag left on, a\n // wildcard CORS origin, a key literal, a fast password hash — so the safe\n // counterpart in the corpus differs on something visible here, not three\n // functions away. The classes that genuinely need whole-function reasoning\n // (CSRF, IDOR, TOCTOU, missing authorization) are deliberately still absent;\n // see KNOWN_GAPS.\n {\n id: 'py-framework-debug-enabled',\n title: 'debug mode enabled',\n consequence:\n 'Framework debug mode serves an interactive traceback console on any error — arbitrary code execution to whoever triggers it — and leaks source and configuration.',\n cwe: 'CWE-489',\n severity: 'high',\n languages: ['python'],\n pattern: /\\bDEBUG['\"\\]]*\\s*[=:]\\s*True\\b|\\.\\s*run\\s*\\([^)\\n]*\\bdebug\\s*=\\s*True\\b/,\n inherent: true,\n },\n {\n id: 'js-cors-wildcard-credentials',\n title: 'wildcard CORS origin with credentials',\n consequence:\n 'A `*` origin combined with credentials lets any site read authenticated responses on the victim’s behalf: the browser attaches their cookies and hands the result to the attacker’s page.',\n cwe: 'CWE-942',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /origin\\s*:\\s*['\"`]\\*['\"`][^\\n]*credentials\\s*:\\s*true|credentials\\s*:\\s*true[^\\n]*origin\\s*:\\s*['\"`]\\*['\"`]/,\n inherent: true,\n },\n {\n id: 'js-cookie-insecure-flag',\n title: 'cookie set with Secure disabled',\n consequence:\n 'Without Secure the cookie travels over plain HTTP, where anyone on the path reads it. A session cookie set this way is a session anyone can lift.',\n cwe: 'CWE-614',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n pattern: /\\.\\s*cookie\\s*\\([^\\n]*\\bsecure\\s*:\\s*false\\b/i,\n },\n {\n id: 'js-hardcoded-crypto-key',\n title: 'hardcoded key material',\n consequence:\n 'A key committed to source is a key everyone with the repo has. The encryption it backs protects nothing once the source is shared, forked or leaked.',\n cwe: 'CWE-321',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\b(?:key|secret|iv|passphrase|salt|hmac)\\w*\\s*=\\s*Buffer\\s*\\.\\s*from\\s*\\(\\s*['\"`]/i,\n fileRequires: /\\bcrypto\\b|createCipheriv|createDecipheriv|createHmac/,\n },\n {\n id: 'py-hardcoded-secret-key',\n title: 'hardcoded application secret',\n consequence:\n 'A signing secret in source lets anyone with the code forge what it signs — session cookies, tokens, password-reset links.',\n cwe: 'CWE-798',\n severity: 'high',\n languages: ['python'],\n // Assigned a *string literal*. A value from a provider call (`os.environ`,\n // `secret_provider(...)`) is the correct shape and starts with an\n // identifier after the `=`, not a quote.\n pattern:\n /\\b(?:SECRET_KEY|JWT_SECRET|SIGNING_KEY|SESSION_SECRET|PRIVATE_KEY)['\"\\]]*\\s*[=:]\\s*['\"`][^'\"`\\n]{6,}/,\n },\n {\n id: 'py-ldap-injection',\n title: 'LDAP filter built by interpolation',\n consequence:\n 'Unescaped input in an LDAP filter lets an attacker rewrite the query — widening a match, bypassing a check, or enumerating the directory.',\n cwe: 'CWE-90',\n severity: 'high',\n languages: ['python'],\n // An f-string whose content is an LDAP filter (`(&…` / `(|…`) with an\n // interpolation. One variant per quote so an inner `'` inside a `\"`-string\n // does not end the class early.\n pattern: /\\bf\"[^\"\\n]*\\([&|][^\"\\n]*\\{[^}\\n]+\\}|\\bf'[^'\\n]*\\([&|][^'\\n]*\\{[^}\\n]+\\}/,\n // The guard is an escaper *call*, not the mere presence of `escape` — the\n // module-level `from ldap.filter import escape_filter_chars` sits in every\n // window and would otherwise exonerate the unescaped filter too.\n guard: /\\bescape\\w*\\s*\\(/i,\n },\n {\n id: 'py-xpath-injection',\n title: 'XPath built by interpolation',\n consequence:\n 'Unescaped input in an XPath expression lets an attacker rewrite the query and read nodes it was meant to exclude.',\n cwe: 'CWE-643',\n severity: 'high',\n languages: ['python'],\n // Per-quote, so an inner `'` in a `\"`-delimited f-string (`text()='{x}'`)\n // does not truncate the match before the interpolation.\n pattern:\n /\\bf\"[^\"\\n]*(?:\\/\\/|\\/\\w+\\[)[^\"\\n]*\\{[^}\\n]+\\}|\\bf'[^'\\n]*(?:\\/\\/|\\/\\w+\\[)[^'\\n]*\\{[^}\\n]+\\}/,\n },\n {\n id: 'py-fast-password-hash',\n title: 'password hashed with a fast digest',\n consequence:\n 'SHA-2 is built to be fast, which is exactly wrong for a password: a leaked hash is brute-forced at billions of guesses a second. Passwords need a slow, salted KDF (bcrypt, scrypt, argon2, PBKDF2).',\n cwe: 'CWE-759',\n severity: 'high',\n languages: ['python'],\n pattern:\n /\\bhashlib\\s*\\.\\s*(?:sha224|sha256|sha384|sha512)\\s*\\([^)\\n]*(?:password|passwd|passphrase|pwd)/i,\n guard: /pbkdf2|scrypt|bcrypt|argon/i,\n },\n {\n id: 'py-plaintext-password-retained',\n title: 'plaintext password stored',\n consequence:\n 'A record that keeps the password itself, not a hash, turns one database leak into every user’s credential — reused across every other site they log into.',\n cwe: 'CWE-256',\n severity: 'high',\n languages: ['python'],\n pattern: /['\"]password['\"]\\s*:\\s*(?:form|request|req|data|payload|body|params)\\b/i,\n },\n {\n id: 'js-timing-unsafe-mac-compare',\n title: 'MAC or signature compared with ==',\n consequence:\n '`===` on a signature returns the moment a byte differs, so response time leaks how much of a forged signature is correct — enough to recover a valid one byte by byte. Use `crypto.timingSafeEqual`.',\n cwe: 'CWE-208',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\b\\w*(?:[Ss]ignature|[Hh]mac|[Dd]igest)\\s*===?\\s*\\w|\\w\\s*===?\\s*\\w*(?:[Ss]ignature|[Hh]mac|[Dd]igest)\\b/,\n // Comparing `.length` is the *safe* preamble to a constant-time check, not\n // the timing-unsafe value comparison this rule is about — and the\n // `timingSafeEqual` that follows it sits forward of the line, out of the\n // backward guard window.\n lineGuard: /\\.\\s*length\\b/,\n guard: /timingSafeEqual/,\n },\n {\n id: 'js-predictable-cipher-iv',\n title: 'static initialization vector',\n consequence:\n 'A fixed IV reused across encryptions leaks whether two plaintexts are equal and, in CBC/CTR, breaks confidentiality outright. The IV must be random per message.',\n cwe: 'CWE-329',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\b\\w*[Ii][Vv]\\s*=\\s*Buffer\\s*\\.\\s*(?:alloc|from)\\s*\\(/,\n fileRequires: /createCipheriv|\\bcrypto\\b/,\n guard: /randomBytes|randomFill/,\n },\n // A rule for `Math.random().toString(36)` was tried and dropped: the exact\n // shape generates security tokens *and* benign callback/correlation ids\n // (Capacitor's native bridge uses it for the latter), with no line-visible\n // signal between them. The credential-scoped `insecure-randomness-for-secret`\n // above still catches the `token = …Math.random…` case; the bare shape is\n // left alone rather than flagged on every id generator.\n {\n id: 'js-mass-assignment',\n title: 'mass assignment from request data',\n consequence:\n 'Copying the whole request body onto a record lets a caller set fields you never exposed — `isAdmin`, `role`, `balance` — because nothing stands between the input and the object.',\n cwe: 'CWE-915',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\bObject\\s*\\.\\s*assign\\s*\\([^,\\n]+,\\s*(?:req|request|ctx)\\s*\\.\\s*(?:body|query|params)\\b/,\n },\n {\n id: 'js-header-injection',\n title: 'response header set from request input',\n consequence:\n 'A CR/LF in the value splits the response — the attacker injects headers or a whole second response (cache poisoning, a forged Set-Cookie).',\n cwe: 'CWE-113',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\.\\s*(?:setHeader|header|set)\\s*\\(\\s*['\"`][^'\"`\\n]+['\"`]\\s*,\\s*(?:req|request|ctx)\\s*\\.\\s*(?:query|body|params|headers)\\b/,\n },\n {\n id: 'js-nosql-injection',\n title: 'NoSQL query built from request data',\n consequence:\n 'A request object passed straight to `find`/`update` lets the caller supply MongoDB operators — `{\"$ne\": null}`, `{\"$gt\": \"\"}`, `{\"$where\": \"…\"}` — turning a lookup into an authentication bypass or arbitrary query.',\n cwe: 'CWE-943',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\.\\s*(?:find|findOne|findOneAndUpdate|updateOne|updateMany|update|deleteOne|deleteMany|remove|count|countDocuments|aggregate)\\s*\\(\\s*(?:req|request|ctx)\\s*\\.\\s*(?:body|query|params)\\b/,\n },\n {\n id: 'js-host-header-trust',\n title: 'URL built from the Host header',\n consequence:\n 'The Host header is attacker-controlled. Building a link from it — a password-reset URL above all — lets an attacker point the victim’s reset token at a domain they control.',\n cwe: 'CWE-346',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\$\\{[^}\\n]*\\breq(?:uest)?\\s*\\.\\s*(?:headers\\s*\\.\\s*host|hostname|host)\\b|['\"`]\\s*\\+\\s*req(?:uest)?\\s*\\.\\s*(?:headers\\s*\\.\\s*host|hostname)\\b/,\n /**\n * Parsing the request's own URL is not building a link from the Host\n * header, even though it is spelled with one.\n *\n * const url = new URL(request.url, `http://${request.headers.host}`);\n * const token = url.searchParams.get('token');\n *\n * `request.url` on a Node server is a path — `/ws?token=…` — and `new URL`\n * refuses a relative input without a base. The base exists to satisfy the\n * parser and is thrown away; only the path and query are ever read. Every\n * Node HTTP handler that wants a query parameter is written this way, so\n * the rule fired on the framework idiom rather than on the defect.\n *\n * Narrow on purpose: the first argument must be `req.url` itself. The\n * dangerous shape passes a *path* the application chose —\n * `new URL('/reset?t=…', `https://${req.headers.host}`)` — and that is what\n * produces an attacker-controlled link. It does not match this guard.\n */\n lineGuard: /\\bnew\\s+URL\\s*\\(\\s*(?:req|request|ctx)(?:uest)?\\s*\\.\\s*url\\b\\s*,/,\n },\n // A recursive-merge prototype-pollution rule (`target[key] = source[key]`\n // with no `__proto__` guard) was built and dropped. The bare copy-by-key is\n // the safe allow-listed shape (`updates[field] = body[field]` over an\n // `allowedFields` list) as often as the vulnerable one; whether it is a sink\n // depends on where the key comes from and which of endless guard idioms\n // filters it — a whole-function question this line-oriented engine does not\n // answer. It flagged legitimate merges in Capacitor and in this repo's own\n // web app. `js-prototype-pollution` still catches the explicit `__proto__`\n // literal; the recursive-merge case is left to KNOWN_GAPS.\n\n // Node-ecosystem classes — vm2, Electron, JWT, archive extraction, headless\n // browsers — are kept in their own table because each has to know which\n // package it is looking at before it can claim anything. Folded in here so\n // there stays exactly one rule list for every consumer to iterate.\n ...NODE_RULES,\n];\n\n/**\n * Classes deliberately not implemented, and why.\n *\n * Recorded in code rather than in a document because the reason is a design\n * constraint, not a backlog item: each of these needs reasoning this scanner\n * does not do, and the line-oriented approximation of each one flags ordinary\n * software. A missing detection is a known number. A rule that fires on every\n * session read is a scanner nobody runs twice.\n */\nexport const KNOWN_GAPS: readonly { cwe: string; name: string; why: string }[] = [\n {\n cwe: 'CWE-352',\n name: 'Missing CSRF token',\n why: 'Requires knowing that a handler is state-changing and that no token check dominates the mutation. Line-locally, the vulnerable and the guarded handler are the same code.',\n },\n {\n cwe: 'CWE-362',\n name: 'Check-then-use race (TOCTOU)',\n why: 'Requires pairing a check with a later use of the same path across statements. A rule matching either half alone flags every `os.path.exists`.',\n },\n {\n cwe: 'CWE-190',\n name: 'Integer overflow / unchecked narrowing',\n why: 'Requires range reasoning about the operands. Flagging arithmetic on a request value would flag arithmetic.',\n },\n {\n cwe: 'CWE-1321',\n name: 'Prototype pollution via generic dynamic assignment',\n why: '`target[key] = source[key]` is both the vulnerable merge and the guarded one; only a denylist several lines away distinguishes them. The explicit `__proto__` shapes are covered.',\n },\n];\n\nexport interface MatchContext {\n /** All lines of the file, 0-indexed. */\n lines: readonly string[];\n /** 0-indexed position of the line being tested. */\n index: number;\n language: ScanLanguage;\n /**\n * Indexes inside a multi-line string or block comment, from `proseLines`.\n * Treated exactly like comment lines: not scanned, not guard evidence.\n */\n prose?: ReadonlySet<number>;\n}\n\nconst COMMENT_PREFIX = /^\\s*(?:\\/\\/|\\/\\*|\\*|#|--|<!--)/;\n\n/**\n * A line that introduces a name rather than doing something with it.\n *\n * Excluded from guard windows because a *name* is not evidence. The corpus\n * contains `def sanitize_path_vulnerable(path):` directly above three\n * catastrophic-backtracking regexes: reading that signature as proof of\n * sanitisation suppressed all three. Naming a function `sanitize` does not\n * sanitise anything, and neither does calling one `validate` or `escape`.\n */\nconst DEFINITION_PREFIX =\n /^\\s*(?:(?:export|public|private|protected|static|final|async|abstract)\\s+)*(?:def|function|func|class|module|interface|struct|impl|fn|sub)\\b/;\n\n/**\n * Comment lines are documentation, not code.\n *\n * Excluded from guard windows for a reason found the hard way: the testbed's\n * vulnerable cases carry comments like \"No `__proto__` guard\" and \"without\n * allow-list validation\". Reading those as evidence of a guard suppresses\n * exactly the findings the corpus exists to measure.\n */\nexport function isComment(line: string): boolean {\n return COMMENT_PREFIX.test(line);\n}\n\n/**\n * Line indexes belonging to multi-line strings and block comments.\n *\n * Python module docstrings are the case that forced this. Every file in the\n * testbed opens with a `\"\"\"…\"\"\"` header describing the vulnerability it\n * contains — `pickle.loads`, `(a+)+`, `autoescape=False` — and scanning that\n * prose produces findings *about the documentation*, reported at line 9 of a\n * file whose code starts at line 18. They are unattributable by construction,\n * and they are the scanner reading its own description back to itself.\n */\nexport function proseLines(lines: readonly string[]): Set<number> {\n const inside = new Set<number>();\n let delimiter: string | null = null;\n\n lines.forEach((line, index) => {\n if (delimiter) {\n inside.add(index);\n if (line.includes(delimiter)) delimiter = null;\n return;\n }\n for (const candidate of ['\"\"\"', \"'''\"]) {\n const start = line.indexOf(candidate);\n if (start === -1) continue;\n // A docstring opened and closed on one line encloses nothing.\n if (line.indexOf(candidate, start + candidate.length) !== -1) return;\n delimiter = candidate;\n inside.add(index);\n return;\n }\n });\n\n return inside;\n}\n\nfunction skippable(line: string, index: number, prose?: ReadonlySet<number>): boolean {\n return isComment(line) || DEFINITION_PREFIX.test(line) || (prose?.has(index) ?? false);\n}\n\nfunction windowText(\n lines: readonly string[],\n index: number,\n back: number,\n forward: number,\n prose?: ReadonlySet<number>,\n): string {\n const from = Math.max(0, index - back);\n const to = Math.min(lines.length - 1, index + forward);\n const collected: string[] = [];\n for (let i = from; i <= to; i += 1) {\n const line = lines[i] ?? '';\n if (i !== index && skippable(line, i, prose)) continue;\n collected.push(line);\n }\n return collected.join('\\n');\n}\n\n/**\n * Whole-file text, memoised on the `lines` array it came from.\n *\n * `fileRequires` asks a question no window can answer, but joining the file on\n * every line of every rule would make scanning quadratic in file length. The\n * caller already reuses one `lines` array for the whole file, so keying on its\n * identity gives one join per file. A `WeakMap` keeps nothing alive after the\n * file is done with.\n */\nconst FILE_TEXT = new WeakMap<readonly string[], string>();\n\nfunction fileTextOf(lines: readonly string[]): string {\n let text = FILE_TEXT.get(lines);\n if (text === undefined) {\n text = lines.join('\\n');\n FILE_TEXT.set(lines, text);\n }\n return text;\n}\n\nexport interface RuleMatch {\n rule: CodeRule;\n confidence: Confidence;\n severity: Severity;\n}\n\n/**\n * Test one rule against one line.\n *\n * Returns `null` when the rule does not apply, does not match, is guarded, or\n * needs context it cannot see.\n */\n/**\n * Blank out single-quoted spans before looking for untrusted input.\n *\n * The shell performs no expansion inside single quotes, so a `$1` there is the\n * two characters `$1` and never a positional parameter. Without this, an awk\n * or sed program written inline — `gawk -F '=' '{print $2}'` — reads as\n * attacker-controlled input.\n *\n * That was not theoretical. In `ralyodio/debtap` it escalated one `curl -k`\n * line to `contextual`, and the ±6-line window carried the escalation to four\n * neighbouring findings, so the same defect reported `high` on lines 103–111\n * and `medium` on 113, 120 and 128 — decided entirely by distance from an awk\n * one-liner. A `--fail-on high` gate would have caught five of eight identical\n * problems.\n */\nfunction withoutSingleQuoted(text: string): string {\n return text.replace(/'[^'\\n]*'/g, \"''\");\n}\n\n/**\n * The callees of every call still open at the start of this line.\n *\n * A bracket walk over the preceding window, skipping string bodies so that a\n * parenthesis inside a message — `log('oops :(')` — does not unbalance it.\n * Returned outermost-first; a rule usually only cares whether *any* of them\n * matches.\n *\n * The walk starts mid-file, so a `)` closing a call opened before the window\n * pops an empty stack. That direction is safe: it can only lose an enclosing\n * name, never invent one, and a lost name means the finding is still reported.\n */\n/**\n * The dotted name immediately left of `open`, walking backwards from it.\n *\n * A backwards scan rather than `/([\\w$.]*)\\s*$/` over `text.slice(0, open)`:\n * the slice copies the whole prefix and the match rescans it, once per\n * parenthesis, which is quadratic on a long window for an answer that is\n * always the last few characters.\n */\nfunction calleeEndingAt(text: string, open: number): string {\n let end = open;\n while (end > 0 && (text[end - 1] === ' ' || text[end - 1] === '\\t')) end -= 1;\n let start = end;\n while (start > 0 && /[\\w$.]/.test(text[start - 1]!)) start -= 1;\n return text.slice(start, end);\n}\n\nexport function enclosingCallees(\n lines: readonly string[],\n index: number,\n back: number,\n): string[] {\n const before = lines.slice(Math.max(0, index - back), index).join('\\n');\n const stack: string[] = [];\n let quote: string | null = null;\n\n for (let i = 0; i < before.length; i += 1) {\n const ch = before[i]!;\n if (quote) {\n if (ch === '\\\\') i += 1;\n else if (ch === quote) quote = null;\n continue;\n }\n if (ch === '\"' || ch === \"'\" || ch === '`') quote = ch;\n else if (ch === '(') stack.push(calleeEndingAt(before, i));\n else if (ch === ')') stack.pop();\n }\n return stack;\n}\n\n/**\n * Every `${…}` on the line, or `null` if there are none to account for.\n *\n * Scanned rather than matched. The obvious `/\\$\\{([^}]*)\\}/g` is polynomial —\n * on a line of many unclosed `${`, each start position rescans to the end —\n * and a scanner that can be stalled by the file it is reading is a denial of\n * service in a CI gate. This repository reports that class as\n * `redos-nested-quantifier`; it should not ship it.\n *\n * `null` for an unterminated `${`, which is the safe direction: the caller\n * exonerates only when it can account for *every* interpolation, so refusing\n * to answer leaves the finding reported.\n */\nfunction interpolations(line: string): string[] | null {\n const found: string[] = [];\n for (let i = 0; ; ) {\n const start = line.indexOf('${', i);\n if (start === -1) break;\n const end = line.indexOf('}', start + 2);\n if (end === -1) return null;\n found.push(line.slice(start + 2, end).trim());\n i = end + 1;\n }\n return found.length > 0 ? found : null;\n}\n\n/** Is `name` bound in this file to a `const` holding a plain string literal? */\nfunction isConstantString(name: string, fileText: string): boolean {\n const escaped = name.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n return new RegExp(\n `\\\\bconst\\\\s+${escaped}\\\\s*(?::[^=\\\\n]+)?=\\\\s*(?:'[^'\\\\n]*'|\"[^\"\\\\n]*\"|\\`[^\\`$\\\\n]*\\`)`,\n ).test(fileText);\n}\n\n/**\n * Does every interpolation on this line resolve to a file-local constant?\n *\n * False when there are no interpolations at all: the concatenation spellings\n * of the same rules (`exec('cmd ' + arg)`) have nothing to resolve and must\n * stay reported.\n */\nexport function interpolationsAreConstant(line: string, fileText: string): boolean {\n const found = interpolations(line);\n if (!found) return false;\n return found.every(\n (expr) => /^[A-Za-z_$][\\w$]*$/.test(expr) && isConstantString(expr, fileText),\n );\n}\n\n/**\n * How far below an allocation a fill is still credibly *the* fill for it.\n *\n * Sixteen because the shape that motivated this is a ring-buffer read: the\n * allocation, an early return for the empty case, three or four lines working\n * out the wrap-around offsets, then the copies. Ten lines was not enough for\n * it. Past this the write is more likely to belong to something else, and the\n * finding should stand.\n */\nconst FILL_LOOKAHEAD = 16;\n\n/**\n * An identifier, matched only where one can actually begin.\n *\n * The lookbehind is load-bearing rather than decoration. `[A-Za-z_$][\\w$]*`\n * can start at *every* position inside a run of `$`, so a long run costs a\n * restart per character and the match is quadratic in line length. This\n * repository reports that class as `redos-nested-quantifier` and CodeQL\n * reports it as `js/polynomial-redos`; it should not ship it.\n */\nconst NAME = String.raw`(?<![\\w$])([A-Za-z_$][\\w$]*)`;\n\nconst ALLOCATION_BINDING = new RegExp(\n `${NAME}\\\\s*=\\\\s*(?:new\\\\s+Buffer\\\\s*\\\\(|Buffer\\\\s*\\\\.\\\\s*allocUnsafe(?:Slow)?\\\\s*\\\\()`,\n);\n\n/**\n * The name an uninitialised allocation on this line is bound to, if any.\n *\n * Declarations and plain assignments both. A property target such as\n * `this.buf = Buffer.allocUnsafe(n)` reduces to `buf`, which is how the writes\n * that follow will spell it.\n */\nfunction allocationBinding(line: string): string | null {\n return ALLOCATION_BINDING.exec(line)?.[1] ?? null;\n}\n\n/**\n * The spellings that write into a buffer: copied into as a destination, filled\n * or written through its own methods, `set` from a typed array, or assigned\n * per index.\n *\n * Fixed patterns that *capture* a name, rather than a pattern built by\n * interpolating the binding into `new RegExp`. The first version did the\n * latter and went wrong three ways at once — the name had to be escaped, the\n * escaper missed backslashes, and the constructed pattern was itself\n * polynomial on a name of many `$`. All three stop existing once the name is\n * compared as a string instead of spliced into a regex.\n */\nconst WRITE_SHAPES: readonly RegExp[] = [\n // `src.copy(name, …)` — name is the destination.\n /\\.\\s*copy\\s*\\(\\s*([A-Za-z_$][\\w$]*)\\s*[,)]/g,\n // `name.fill(…)`, `name.write*(…)`, `name.set(…)`.\n new RegExp(`${NAME}\\\\s*\\\\.\\\\s*(?:fill|set|write[A-Za-z0-9]*)\\\\s*\\\\(`, 'g'),\n // `name[i] = …`, but not `name[i] === …`.\n new RegExp(`${NAME}\\\\s*\\\\[[^\\\\]\\\\n]*\\\\]\\\\s*=(?!=)`, 'g'),\n];\n\n/** Does anything in `text` write into the buffer bound to `name`? */\nfunction writesInto(text: string, name: string): boolean {\n for (const shape of WRITE_SHAPES) {\n // Module-level and `g`, so the cursor from the previous call is still on\n // it. Reset before use rather than allocating a regex per line.\n shape.lastIndex = 0;\n for (let found = shape.exec(text); found !== null; found = shape.exec(text)) {\n if (found[1] === name) return true;\n }\n }\n return false;\n}\n\n/**\n * True when the buffer allocated on this line is filled before it escapes.\n *\n * Looks forward only. Code that fills a buffer runs after the allocation, by\n * definition — there is nothing above it to find.\n */\nexport function bufferFilledBeforeUse(ctx: MatchContext): boolean {\n const line = ctx.lines[ctx.index] ?? '';\n\n // `Buffer.allocUnsafe(n).fill(0)` — filled in the same breath, and there is\n // no binding to follow because none is needed.\n if (/\\ballocUnsafe(?:Slow)?\\s*\\([^)\\n]*\\)\\s*\\.\\s*fill\\s*\\(/.test(line)) return true;\n\n const name = allocationBinding(line);\n if (!name) return false;\n\n // The allocation line itself first: `const b = Buffer.allocUnsafe(n); b.fill(0);`\n // is one line, and a rule that missed it would be answering a question about\n // formatting rather than about the code. Only the part after the `=`, so the\n // binding on the left is not read as a write to itself.\n if (writesInto(line.slice(line.indexOf('=') + 1), name)) return true;\n\n const last = Math.min(ctx.lines.length - 1, ctx.index + FILL_LOOKAHEAD);\n for (let i = ctx.index + 1; i <= last; i += 1) {\n const next = ctx.lines[i] ?? '';\n if (skippable(next, i, ctx.prose)) continue;\n if (writesInto(next, name)) return true;\n }\n return false;\n}\n\nexport function evaluateRule(rule: CodeRule, ctx: MatchContext): RuleMatch | null {\n if (rule.languages && !rule.languages.includes(ctx.language)) return null;\n\n const line = ctx.lines[ctx.index] ?? '';\n if (isComment(line) || ctx.prose?.has(ctx.index)) return null;\n if (!rule.pattern.test(line)) return null;\n\n // Before any window work: a rule whose file-level precondition fails does not\n // apply to this file at all.\n if (rule.fileRequires && !rule.fileRequires.test(fileTextOf(ctx.lines))) return null;\n\n const back = rule.guardBack ?? 8;\n const forward = rule.guardForward ?? 0;\n const context = windowText(ctx.lines, ctx.index, back, forward, ctx.prose);\n\n if (rule.requires && !rule.requires.test(context)) return null;\n\n if (rule.lineGuard?.test(line)) return null;\n\n if (rule.enclosingCallGuard) {\n const callees = enclosingCallees(ctx.lines, ctx.index, back);\n if (callees.some((callee) => rule.enclosingCallGuard!.test(callee))) return null;\n }\n\n if (rule.constantInterpolationGuard && interpolationsAreConstant(line, fileTextOf(ctx.lines))) {\n return null;\n }\n\n if (rule.filledBeforeUseGuard && bufferFilledBeforeUse(ctx)) return null;\n\n const guard = rule.guard === undefined ? GENERIC_GUARD : rule.guard;\n if (guard && (guard.test(line) || guard.test(context))) return null;\n\n const untrusted = untrustedPatternFor(ctx.language);\n const probeLine = ctx.language === 'shell' ? withoutSingleQuoted(line) : line;\n const probeContext = ctx.language === 'shell' ? withoutSingleQuoted(context) : context;\n const contextual = untrusted.test(probeLine) || untrusted.test(probeContext);\n if (rule.needsContext && !contextual) return null;\n\n // `inherent` short-circuits the whole context question. See the field's\n // documentation: for these rules the construct is the defect, so nearby\n // input cannot make it worse and its absence cannot make it better.\n const confidence: Confidence = rule.inherent\n ? 'evidence'\n : contextual\n ? 'contextual'\n : 'pattern';\n return { rule, confidence, severity: severityFor(rule.severity, confidence) };\n}\n","/**\n * Template-file rules: unescaped output, per engine.\n *\n * Why this is a separate engine\n * -----------------------------\n * `code-rules.ts` reasons about source code — it knows what a call looks like,\n * what a string literal looks like, and which identifiers carry request data.\n * A Handlebars file has none of that. It is markup with holes in it, and the\n * only security question worth asking is which holes skip escaping.\n *\n * That question is answered by *syntax*, and every engine spells it\n * differently: Handlebars has a triple-stache, Pug prefixes with `!`, EJS uses\n * a different tag character from the one that escapes, Dust hangs an `|s`\n * filter on the end. So a template rule is selected by file extension rather\n * than by language — the extension is what identifies the engine, and nothing\n * inside the file reliably does.\n *\n * Extension, not language, for a second reason: `.vue` and `.ejs` are already\n * mapped to `javascript` so their `<script>` halves get the full code rule\n * set. Remapping them to a `template` language to reach these rules would take\n * that away. Running the two engines over the same file, keyed differently, is\n * what njsscan does as well, and for the same reason.\n *\n * What these rules claim\n * ----------------------\n * Only that the interpolation does not escape. Not that the value is\n * attacker-controlled — a template cannot show that, and the variable is very\n * often a CMS body that was sanitised on the way in, which is the legitimate\n * reason to reach for unescaped output at all.\n *\n * So every rule here reports at confidence `pattern`, which the shared cap in\n * `types.ts` holds at `medium` however high the rule declares itself. That is\n * the honest ceiling for \"this line opts out of the engine's escaping\" with no\n * further evidence, and it keeps a template-heavy repository from filling a\n * report with `high` findings that nobody can triage.\n *\n * Provenance: the set of engines covered was chosen by looking at what njsscan\n * (LGPL-3.0) reports on, so this MIT package would not have a blind spot an\n * established Node scanner covers. The patterns, guards and prose are written\n * from scratch — see the note at the top of `node-rules.ts`.\n */\n\nimport type { Severity } from './types';\nimport { severityFor } from './types';\n\nexport interface TemplateRule {\n id: string;\n title: string;\n consequence: string;\n cwe: string;\n severity: Severity;\n /** Extensions this engine owns, lowercase and dot-prefixed. */\n extensions: readonly string[];\n pattern: RegExp;\n /** Evidence on the matched line that this occurrence is not user data. */\n lineGuard?: RegExp;\n}\n\n/**\n * The layout slot, which is not a variable.\n *\n * `{{{body}}}` in a Handlebars layout is where the rendered child template is\n * spliced in — it is unescaped because it is already HTML, by design, and\n * every project using layouts has exactly one. Reporting it means every\n * express-handlebars app opens its report with a false positive.\n */\nconst LAYOUT_SLOT = /\\{\\{\\{\\s*(?:body|content|outlet|children)\\s*\\}\\}\\}/;\n\nconst XSS_CONSEQUENCE =\n 'The value is written into the page as markup rather than as text, so a `<script>` or an `onerror=` attribute in it executes in the visitor’s session — with their cookies, and their privileges.';\n\nexport const TEMPLATE_RULES: readonly TemplateRule[] = [\n {\n id: 'tpl-handlebars-unescaped',\n title: 'Handlebars/Mustache interpolation that skips escaping',\n consequence: XSS_CONSEQUENCE,\n cwe: 'CWE-79',\n severity: 'high',\n extensions: ['.hbs', '.handlebars', '.hdbs', '.mustache', '.ms'],\n // Two spellings of the same opt-out: the triple-stache and the `&` prefix.\n pattern: /\\{\\{\\{(?!\\{)[^}]*\\}\\}\\}|\\{\\{\\s*&\\s*[^}]+\\}\\}/,\n lineGuard: LAYOUT_SLOT,\n },\n {\n id: 'tpl-vue-v-html',\n title: '`v-html` binding',\n consequence: XSS_CONSEQUENCE,\n cwe: 'CWE-79',\n severity: 'high',\n extensions: ['.vue', '.html', '.htm'],\n pattern: /\\bv-html\\s*=|\\s:inner-html\\.prop\\s*=/,\n },\n {\n id: 'tpl-pug-unescaped',\n title: 'Pug/Jade unescaped interpolation',\n consequence: XSS_CONSEQUENCE,\n cwe: 'CWE-79',\n severity: 'high',\n extensions: ['.pug', '.jade'],\n // `!{…}` is unescaped interpolation anywhere on the line. `!=` is\n // unescaped buffered code, but only in the tag position — anchored to the\n // start of the line and preceded by nothing but tag, class and id\n // characters, so the `!==` inside `- if (a !== b)` cannot reach it.\n pattern: /!\\{[^}\\n]*\\}|^\\s*[\\w.#%-]*!=(?!=)\\s*\\S/,\n },\n {\n id: 'tpl-ejs-raw-output',\n title: 'EJS/ECT raw output tag',\n consequence: XSS_CONSEQUENCE,\n cwe: 'CWE-79',\n severity: 'high',\n extensions: ['.ejs', '.ect'],\n // In EJS `<%= %>` escapes and `<%-` does not, which is the reverse of\n // Underscore's convention — see KNOWN_GAPS.\n pattern: /<%-(?!\\s*(?:include|-))/,\n // `<%- include('partial') %>` splices another template, not user data.\n lineGuard: /<%-\\s*(?:include|partial)\\s*\\(/,\n },\n {\n id: 'tpl-dust-escape-filter-off',\n title: 'Dust reference with escaping suppressed',\n consequence: XSS_CONSEQUENCE,\n cwe: 'CWE-79',\n severity: 'high',\n extensions: ['.dust', '.tl'],\n // The `|s` filter means \"suppress the default HTML escape\".\n pattern: /\\{[^{}\\n]+\\|\\s*s\\s*\\}/,\n },\n {\n id: 'tpl-jinja-safe-filter',\n title: 'Nunjucks/Twig/Jinja `safe` filter or autoescape block off',\n consequence: XSS_CONSEQUENCE,\n cwe: 'CWE-79',\n severity: 'high',\n extensions: ['.njk', '.nunjucks', '.twig', '.jinja', '.jinja2', '.j2'],\n pattern: /\\|\\s*(?:safe|raw)\\s*(?:\\}\\}|\\|)|\\{%\\s*autoescape\\s+(?:false|off)\\s*%\\}/,\n },\n {\n id: 'tpl-haml-unescaped',\n title: 'Haml unescaped output',\n consequence: XSS_CONSEQUENCE,\n cwe: 'CWE-79',\n severity: 'high',\n extensions: ['.haml'],\n pattern: /^\\s*[\\w.#%-]*!=(?!=)\\s*\\S/,\n },\n];\n\n/** Extensions any template rule owns. Folded into `SCAN_EXTENSIONS`. */\nexport const TEMPLATE_EXTENSIONS: ReadonlySet<string> = new Set(\n TEMPLATE_RULES.flatMap((rule) => rule.extensions),\n);\n\nexport interface TemplateMatch {\n rule: TemplateRule;\n severity: Severity;\n line: number;\n}\n\n/**\n * Run the rules that own this extension over the file's lines.\n *\n * Returns matches rather than findings so the caller keeps sole ownership of\n * how a finding is shaped — the same split the code rules use.\n */\nexport function evaluateTemplateRules(\n extension: string,\n lines: readonly string[],\n): TemplateMatch[] {\n const ext = extension.toLowerCase();\n const applicable = TEMPLATE_RULES.filter((rule) => rule.extensions.includes(ext));\n if (applicable.length === 0) return [];\n\n const matches: TemplateMatch[] = [];\n lines.forEach((line, index) => {\n for (const rule of applicable) {\n if (!rule.pattern.test(line)) continue;\n if (rule.lineGuard?.test(line)) continue;\n matches.push({\n rule,\n // A template cannot show that the value is untrusted, so the claim\n // never rises above `pattern` and the shared cap holds it at medium.\n severity: severityFor(rule.severity, 'pattern'),\n line: index + 1,\n });\n }\n });\n return matches;\n}\n\n/**\n * KNOWN_GAPS — template classes deliberately not covered.\n *\n * Underscore / Lodash templates\n * `<%= %>` is *unescaped* in Underscore and *escaped* in EJS, and the two\n * share the `.html` and `.tpl` extensions. Since the engine is what\n * decides which meaning applies, and nothing in the file says which engine\n * will render it, a rule for either convention is wrong half the time.\n *\n * Liquid\n * Liquid does not escape by default at all, so every interpolation would\n * match. A rule that fires on every line of every template is a rule\n * nobody leaves switched on.\n *\n * Whether the interpolated value is attacker-controlled\n * Needs the controller that renders the template, which is a different\n * file. This is the reason for the confidence ceiling, not an oversight.\n */\n","/**\n * Missing security controls: findings about what is *not* there.\n *\n * Every other rule in this package reports a construct it can point at. This\n * one reports an absence — no rate limiter anywhere in an HTTP service, no\n * CSRF token, no security headers — which is a different kind of claim and\n * needs different handling in three ways.\n *\n * **It is whole-project, not per-line.** A rate limiter installed in\n * `app.js` protects a route defined in `routes/admin.js`. Any per-file rule\n * would report the second file while the first sits three directories away\n * with the answer in it. So this accumulates across the whole walk and\n * reports once, at the end.\n *\n * **It is weaker evidence.** \"We did not see a CSRF token\" is not the same\n * statement as \"we saw a SQL query built by concatenation\". The control may\n * be installed by a framework, by a reverse proxy, by an API gateway, or by\n * a package whose name nobody here has heard of. So these are opt-in — the\n * CLI asks for them with `--missing-controls` — and they report at\n * confidence `pattern`, which the shared cap in `types.ts` holds at medium.\n *\n * **It needs an applicability test.** \"This library has no CSRF protection\"\n * is not a finding, it is a category error. Nothing is reported unless the\n * tree contains something that answers HTTP requests.\n *\n * Provenance: the idea of inverting rules to report absent controls is\n * njsscan's, and the four controls checked here are the ones it covers. The\n * mechanism is not — njsscan detects controls with its ordinary rule engine\n * and subtracts the hits afterwards, while this accumulates evidence during\n * the walk so no file has to be held in memory. Patterns and prose are\n * original; see the licence note at the top of `node-rules.ts`.\n */\n\nimport type { ScanFinding, Severity } from './types';\nimport { severityFor } from './types';\n\nexport interface SecurityControl {\n id: string;\n title: string;\n /** What the absence costs. */\n consequence: string;\n cwe: string;\n severity: Severity;\n /** Anything matching this, anywhere in the tree, counts as installed. */\n evidence: RegExp;\n}\n\n/**\n * Evidence that this tree serves HTTP.\n *\n * The gate for the whole module. A CLI, a library or a batch job has no\n * business being told it is missing a CSRF token, and reporting one is the\n * fastest way to teach an operator that these findings are noise.\n *\n * Deliberately narrow: constructing the server, not merely importing\n * something HTTP-shaped. A build script that requires `express` to type a\n * config object is not a web service.\n */\nconst SERVER_FRAMEWORK =\n /\\bexpress\\s*\\(\\s*\\)|\\bnew\\s+Koa\\s*\\(|\\bfastify\\s*\\(|\\brequire\\s*\\(\\s*['\"](?:express|koa|@hapi\\/hapi|restify)['\"]\\s*\\)|\\bfrom\\s+['\"](?:express|koa|@hapi\\/hapi|restify)['\"]|\\bhttp\\s*\\.\\s*createServer\\s*\\(|\\bNestFactory\\s*\\.\\s*create\\s*\\(/;\n\nexport const SECURITY_CONTROLS: readonly SecurityControl[] = [\n {\n id: 'control-security-headers-absent',\n title: 'no security header middleware',\n consequence:\n 'Without them the browser applies no framing protection, sniffs content types, sends full referrers cross-origin and never learns to require HTTPS — a set of defences that cost one line to enable.',\n cwe: 'CWE-693',\n severity: 'medium',\n evidence:\n /\\bhelmet\\b|\\bkoa-helmet\\b|\\b@fastify\\/helmet\\b|\\blusca\\b|Strict-Transport-Security|Content-Security-Policy|X-Frame-Options|X-Content-Type-Options/i,\n },\n {\n id: 'control-anti-csrf-absent',\n title: 'no cross-site request forgery protection',\n consequence:\n 'A cookie-authenticated endpoint with no token check can be driven by a form on any other site — the browser attaches the session automatically, so the victim only has to visit a page.',\n cwe: 'CWE-352',\n severity: 'medium',\n // SameSite counts. A cookie the browser refuses to send cross-site is not\n // reachable by the attack this control exists to stop, so a project that\n // chose that route instead of tokens has the control, not a gap.\n evidence:\n /\\bcsurf\\b|\\bcsrf\\b|\\bxsrf\\b|\\blusca\\b|\\b@fastify\\/csrf\\b|\\bdouble-csrf\\b|\\bsameSite\\s*:\\s*['\"](?:strict|lax)['\"]/i,\n },\n {\n id: 'control-rate-limiting-absent',\n title: 'no request rate limiting',\n consequence:\n 'Login and password-reset endpoints with no limiter can be tried at the speed of the network — credential stuffing, token brute force and enumeration all become a matter of waiting.',\n cwe: 'CWE-770',\n severity: 'medium',\n evidence:\n /\\bexpress-rate-limit\\b|\\brateLimit\\b|\\brate-limiter\\b|\\bratelimit\\b|\\bexpress-slow-down\\b|\\bslowDown\\b|\\bbottleneck\\b|\\bthrottle\\b/i,\n },\n {\n id: 'control-body-size-limit-absent',\n title: 'no request body size limit',\n consequence:\n 'The body is parsed into memory before any handler — and before any authentication check — so unbounded parsing lets a few concurrent requests exhaust the process.',\n cwe: 'CWE-400',\n severity: 'medium',\n evidence: /\\blimit\\s*:\\s*['\"]?\\d+\\s*(?:kb|mb|b)\\b|\\bbodyLimit\\b|\\bmaxRequestBodySize\\b|\\bclient_max_body_size\\b/i,\n },\n];\n\n/**\n * Accumulates control evidence over a walk, then reports what was never seen.\n *\n * Holds four booleans and one path, not the files — a whole-project question\n * answered without a whole-project buffer, which matters because the walker is\n * otherwise streaming and a repository can be large.\n */\nexport class ControlAudit {\n private readonly seen = new Set<string>();\n /** Where the server is built. Anchors the findings somewhere meaningful. */\n private serverFile: string | null = null;\n\n observe(relativePath: string, text: string): void {\n if (this.serverFile === null && SERVER_FRAMEWORK.test(text)) {\n this.serverFile = relativePath;\n }\n for (const control of SECURITY_CONTROLS) {\n if (this.seen.has(control.id)) continue;\n if (control.evidence.test(text)) this.seen.add(control.id);\n }\n }\n\n /** Controls with no evidence anywhere. Empty when the tree serves no HTTP. */\n missing(): readonly SecurityControl[] {\n if (this.serverFile === null) return [];\n return SECURITY_CONTROLS.filter((control) => !this.seen.has(control.id));\n }\n\n findings(): ScanFinding[] {\n const anchor = this.serverFile;\n if (anchor === null) return [];\n\n return this.missing().map((control) => ({\n ruleId: control.id,\n title: control.title,\n file: anchor,\n line: 1,\n // `pattern` is doing real work here: it caps the severity, and it says\n // in the report itself how much the scanner is claiming. An absence is\n // never `evidence`.\n severity: severityFor(control.severity, 'pattern'),\n confidence: 'pattern' as const,\n message: `${control.title} — no evidence of one anywhere in the scanned tree (${control.cwe})`,\n consequence: control.consequence,\n cwe: control.cwe,\n excerpt: '',\n category: 'code' as const,\n }));\n }\n}\n","/**\n * Dependency-manifest rules — typosquats, dependency confusion, and\n * install-time lifecycle scripts.\n *\n * This is the one detector here that does not need a vulnerability to exist\n * yet. `event-stream` (2018), `ua-parser-js` (2021) and `node-ipc` (2022) were\n * all advisory-clean at the moment they were installed; the advisory gets\n * written *after* somebody notices. What they shared was a name you would\n * misread and a lifecycle script that ran with the installing user's\n * privileges. Both are visible in the manifest, before anything is fetched.\n */\n\nimport type { Severity } from './types';\n\nexport interface ManifestFinding {\n ruleId: string;\n title: string;\n line: number;\n severity: Severity;\n cwe: string;\n message: string;\n consequence: string;\n excerpt: string;\n}\n\n/**\n * Popular package names, by ecosystem.\n *\n * Not a registry mirror and not trying to be. It is the set of names worth\n * *impersonating* — a typosquat only pays off against a package people install\n * without looking. A longer list would not find more attacks; it would find\n * more legitimate packages that happen to sit one edit from something famous.\n */\nconst POPULAR_NPM = [\n 'react', 'react-dom', 'lodash', 'express', 'axios', 'chalk', 'commander', 'debug',\n 'moment', 'dayjs', 'uuid', 'dotenv', 'typescript', 'webpack', 'vite', 'rollup',\n 'eslint', 'prettier', 'jest', 'vitest', 'mocha', 'chai', 'sinon', 'request',\n 'node-fetch', 'cross-env', 'rimraf', 'glob', 'minimist', 'yargs', 'inquirer',\n 'colors', 'ora', 'semver', 'ws', 'socket.io', 'mongoose', 'sequelize', 'knex',\n 'pg', 'mysql', 'mysql2', 'redis', 'ioredis', 'jsonwebtoken', 'bcrypt', 'passport',\n 'cors', 'helmet', 'morgan', 'body-parser', 'multer', 'nodemailer', 'puppeteer',\n 'playwright', 'cheerio', 'sharp', 'canvas', 'esbuild', 'babel', 'postcss',\n 'tailwindcss', 'next', 'nuxt', 'vue', 'svelte', 'angular', 'rxjs', 'zod',\n];\n\nconst POPULAR_PYPI = [\n 'requests', 'urllib3', 'numpy', 'pandas', 'scipy', 'flask', 'django', 'fastapi',\n 'sqlalchemy', 'pydantic', 'click', 'jinja2', 'pyyaml', 'boto3', 'botocore',\n 'setuptools', 'wheel', 'pip', 'six', 'certifi', 'idna', 'chardet', 'attrs',\n 'python-dateutil', 'pytz', 'pytest', 'tox', 'black', 'flake8', 'mypy', 'isort',\n 'beautifulsoup4', 'lxml', 'pillow', 'matplotlib', 'seaborn', 'scikit-learn',\n 'tensorflow', 'torch', 'transformers', 'openai', 'anthropic', 'httpx', 'aiohttp',\n 'celery', 'redis', 'psycopg2', 'pymongo', 'cryptography', 'paramiko', 'colorama',\n];\n\n/**\n * Names that read as belonging to a private registry.\n *\n * A manifest that asks a public index for a package whose name announces it is\n * internal is the dependency-confusion setup: whoever registers the name\n * publicly first wins, and the build takes their copy.\n */\nconst INTERNAL_MARKER = /(?:^|[-_/@])(?:internal|private|corp|intranet|inhouse|confidential)(?:$|[-_/])/i;\n\n/** Strip the separators a squatter varies but a reader does not notice. */\nfunction normalizeName(name: string): string {\n return name.toLowerCase().replace(/^@/, '').replace(/[-_.\\s]/g, '');\n}\n\n/**\n * Damerau-Levenshtein distance, capped.\n *\n * Damerau rather than plain Levenshtein because the single most common\n * typosquat is a transposition — `lodahs` for `lodash`, `reqeust` for\n * `request`. Levenshtein scores those as 2, the same as two unrelated edits,\n * which puts them below any threshold tight enough to be useful.\n */\nexport function editDistance(a: string, b: string, cap = 3): number {\n if (a === b) return 0;\n if (Math.abs(a.length - b.length) > cap) return cap + 1;\n\n const rows: number[][] = [];\n for (let i = 0; i <= a.length; i += 1) {\n rows.push(new Array<number>(b.length + 1).fill(0));\n rows[i]![0] = i;\n }\n for (let j = 0; j <= b.length; j += 1) rows[0]![j] = j;\n\n for (let i = 1; i <= a.length; i += 1) {\n for (let j = 1; j <= b.length; j += 1) {\n const cost = a[i - 1] === b[j - 1] ? 0 : 1;\n let best = Math.min(\n rows[i - 1]![j]! + 1,\n rows[i]![j - 1]! + 1,\n rows[i - 1]![j - 1]! + cost,\n );\n if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {\n best = Math.min(best, rows[i - 2]![j - 2]! + 1);\n }\n rows[i]![j] = best;\n }\n }\n return rows[a.length]![b.length]!;\n}\n\nexport interface SquatVerdict {\n impersonates: string;\n /** `separator` when only punctuation differs, `edit` when a character does. */\n kind: 'separator' | 'edit';\n}\n\n/**\n * Whether `name` looks like an attempt to be mistaken for a popular package.\n *\n * Exact matches return null first, always. The check that follows is\n * deliberately asymmetric: a name is suspicious for being *close to* a popular\n * package, never for being popular itself.\n */\nexport function detectTyposquat(name: string, ecosystem: 'npm' | 'pypi'): SquatVerdict | null {\n const popular = ecosystem === 'npm' ? POPULAR_NPM : POPULAR_PYPI;\n const lower = name.toLowerCase();\n\n // A scoped name is left alone, scope and all.\n //\n // Discarding the scope before comparing was this rule's largest source of\n // false positives, and it fired on some of the most widely installed packages\n // there are: `@babel/core`, `@angular/core`, `@nestjs/core` and\n // `@capacitor/core` all reduce to `core`, which sits one edit from `cors`.\n //\n // Scopes are owned. Publishing `@babel/anything` requires control of the\n // `@babel` scope, so a squat cannot be planted inside a legitimate one, and\n // nobody typing `npm i cors` arrives at `@capacitor/core` by accident. The\n // misreading this rule exists to catch does not cross the scope boundary, so\n // a name that has one is not a candidate.\n //\n // The scoped attack that *is* real is a lookalike scope — `@babeljs/core` for\n // `@babel/core`. Catching it means comparing scopes against a list of popular\n // scopes, which is a different check than this one rather than a variation on\n // it. Stripping the scope never performed that check; it only compared the\n // part after the slash, so nothing is lost here.\n if (/^@[^/]+\\//.test(lower)) return null;\n\n if (popular.includes(lower)) return null;\n if (lower.length < 4) return null;\n\n const normalized = normalizeName(lower);\n for (const candidate of popular) {\n const candidateNormalized = normalizeName(candidate);\n // `urllib-3` and `pythondateutil` normalise onto their targets exactly.\n // Nothing legitimate reaches a popular package's spelling by deleting or\n // inserting punctuation.\n if (normalized === candidateNormalized) return { impersonates: candidate, kind: 'separator' };\n if (editDistance(normalized, candidateNormalized, 1) === 1) {\n return { impersonates: candidate, kind: 'edit' };\n }\n }\n return null;\n}\n\nconst LIFECYCLE_SCRIPTS = ['preinstall', 'install', 'postinstall', 'prepare', 'prepublish'];\n\n/**\n * Scan a `package.json`.\n *\n * Text-oriented rather than object-oriented so every finding can carry the\n * line it came from. A finding an operator cannot navigate to is a finding\n * they will not act on.\n */\nexport function scanPackageJson(text: string): ManifestFinding[] {\n const findings: ManifestFinding[] = [];\n const lines = text.split('\\n');\n\n let parsed: Record<string, unknown>;\n try {\n parsed = JSON.parse(text) as Record<string, unknown>;\n } catch {\n return findings;\n }\n\n const lineOf = (needle: string): number => {\n const index = lines.findIndex((line) => line.includes(`\"${needle}\"`));\n return index === -1 ? 1 : index + 1;\n };\n\n const depBuckets = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];\n for (const bucket of depBuckets) {\n const deps = parsed[bucket];\n if (!deps || typeof deps !== 'object') continue;\n for (const name of Object.keys(deps as Record<string, unknown>)) {\n const line = lineOf(name);\n\n if (INTERNAL_MARKER.test(name)) {\n findings.push({\n ruleId: 'manifest-dependency-confusion',\n title: 'internal-looking package resolved from a public registry',\n line,\n severity: 'critical',\n cwe: 'CWE-1357',\n message: `\"${name}\" names itself as internal but carries no registry pin`,\n consequence:\n 'Whoever registers this name publicly first wins the resolution, and their code runs in your build.',\n excerpt: (lines[line - 1] ?? '').trim(),\n });\n continue;\n }\n\n const squat = detectTyposquat(name, 'npm');\n if (squat) {\n findings.push({\n ruleId: 'manifest-typosquat',\n title: 'dependency name close to a popular package',\n line,\n severity: 'high',\n cwe: 'CWE-1357',\n message:\n squat.kind === 'separator'\n ? `\"${name}\" differs from \"${squat.impersonates}\" only in punctuation`\n : `\"${name}\" is one edit from \"${squat.impersonates}\"`,\n consequence:\n 'A reviewer scanning a diff reads the name they expected. The package that installs is the one that was written.',\n excerpt: (lines[line - 1] ?? '').trim(),\n });\n }\n }\n }\n\n const scripts = parsed.scripts;\n if (scripts && typeof scripts === 'object') {\n for (const [name, body] of Object.entries(scripts as Record<string, unknown>)) {\n if (!LIFECYCLE_SCRIPTS.includes(name)) continue;\n findings.push({\n ruleId: 'manifest-install-lifecycle-script',\n title: 'install-time lifecycle script',\n line: lineOf(name),\n severity: 'medium',\n cwe: 'CWE-506',\n message: `\"${name}\" runs automatically on install: ${String(body).slice(0, 120)}`,\n consequence:\n 'Lifecycle scripts run with the installing user’s privileges and network access, before any code is reviewed. It is the execution vector every notable npm compromise has used.',\n excerpt: (lines[lineOf(name) - 1] ?? '').trim(),\n });\n }\n }\n\n return findings;\n}\n\n/** Scan a `requirements.txt`. Same checks, different grammar. */\nexport function scanRequirementsTxt(text: string): ManifestFinding[] {\n const findings: ManifestFinding[] = [];\n const lines = text.split('\\n');\n\n lines.forEach((raw, index) => {\n const line = raw.trim();\n if (!line || line.startsWith('#') || line.startsWith('-')) return;\n\n const match = /^([A-Za-z0-9_.-]+)\\s*(?:[=<>!~]=|@|$)/.exec(line);\n const name = match?.[1];\n if (!name) return;\n\n if (INTERNAL_MARKER.test(name)) {\n findings.push({\n ruleId: 'manifest-dependency-confusion',\n title: 'internal-looking package resolved from a public index',\n line: index + 1,\n severity: 'critical',\n cwe: 'CWE-1357',\n message: `\"${name}\" names itself as internal but carries no index pin`,\n consequence:\n 'pip resolves the highest version across every configured index, so a public package of the same name shadows the private one.',\n excerpt: line,\n });\n return;\n }\n\n const squat = detectTyposquat(name, 'pypi');\n if (squat) {\n findings.push({\n ruleId: 'manifest-typosquat',\n title: 'dependency name close to a popular package',\n line: index + 1,\n severity: 'high',\n cwe: 'CWE-1357',\n message:\n squat.kind === 'separator'\n ? `\"${name}\" differs from \"${squat.impersonates}\" only in punctuation`\n : `\"${name}\" is one edit from \"${squat.impersonates}\"`,\n consequence:\n 'A reviewer scanning a diff reads the name they expected. The package that installs is the one that was written.',\n excerpt: line,\n });\n }\n });\n\n return findings;\n}\n","/**\n * Credential-shape rules for `threatcrush scan`.\n *\n * These are the rules ThreatCrush already scored 0.0% false positives on\n * against the public testbed's control group, so the bar for changing one is\n * high: a secret rule earns its place by matching material that is a\n * credential, not by matching material that looks vaguely random.\n *\n * The distinction that keeps the false-positive rate at zero is *shape with a\n * vendor prefix*. `AKIA…`, `ghp_…`, `xoxb-…`, `sk_live_…` are issued formats —\n * nothing else produces them. Entropy alone is not a rule here, because\n * entropy alone flags every UUID, hash and minified bundle in the tree.\n *\n * Two lines in the testbed corpus are the reason for that discipline. Both\n * live in the same `.env` file as five real credentials:\n *\n * AWS_ROLE_ARN=arn:aws:iam::123456789012:role/app-runtime\n * DATABASE_URL_SSM_PARAMETER=/prod/app/database-url\n *\n * An identifier and a lookup path. Both sit under secret-shaped variable\n * names, and neither is a credential. A rule keyed on the variable name would\n * flag both.\n */\n\nimport type { Severity } from './types';\n\nexport interface SecretRule {\n id: string;\n /** Vendor-facing name, e.g. \"AWS Access Key\". */\n name: string;\n pattern: RegExp;\n severity: Severity;\n cwe: string;\n /** What an attacker does with it. */\n consequence: string;\n /**\n * Does this rule key on a *keyword* rather than on an issued format?\n *\n * `AKIA…` and `ghp_…` are minted by a vendor: nobody types one by accident,\n * so a match is a credential wherever it appears — including in a test, where\n * it is reported at `low` but still reported. The keyword-shaped rules are\n * the opposite. `password = '…'` fires on the *variable name*, and the value\n * beside it in a test file is a fixture in overwhelming proportion.\n *\n * Only rules marked here are eligible for the test-fixture exemption in\n * `isTestFixtureValue`. The distinction is the whole reason that exemption is\n * safe: it can never silence a vendor-issued key.\n */\n keywordShaped?: boolean;\n}\n\nexport const SECRET_RULES: readonly SecretRule[] = [\n {\n id: 'secret-aws-access-key',\n name: 'AWS Access Key',\n pattern: /\\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\\b/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Paired with a secret key, grants the API access of whatever IAM principal issued it.',\n },\n {\n id: 'secret-aws-secret-key',\n name: 'AWS Secret Access Key',\n pattern:\n /(?:aws_secret_access_key|AWS_SECRET(?:_ACCESS_KEY)?)\\s*[=:]\\s*['\"]?([A-Za-z0-9/+=]{40})['\"]?/i,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'The other half of an AWS credential pair; on its own it is still the hard half to guess.',\n },\n {\n id: 'secret-github-token',\n name: 'GitHub Token',\n pattern: /\\b(?:ghp_[A-Za-z0-9]{36}|gho_[A-Za-z0-9]{36}|ghu_[A-Za-z0-9]{36}|ghs_[A-Za-z0-9]{36}|ghr_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{60,})\\b/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Repository read or write as the issuing account, including the ability to push workflow changes.',\n },\n {\n id: 'secret-npm-token',\n name: 'npm Token',\n pattern: /\\bnpm_[A-Za-z0-9]{36}\\b/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Publish rights to every package the account owns — a supply-chain compromise in one command.',\n },\n {\n id: 'secret-private-key',\n name: 'Private Key',\n pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Key material, committed. Rotation is the only remediation.',\n },\n {\n id: 'secret-slack-token',\n name: 'Slack Token',\n pattern: /\\bxox[bpoasr]-[A-Za-z0-9-]{10,}/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Read and post access to the workspace as the installing app.',\n },\n {\n id: 'secret-slack-webhook',\n name: 'Slack Webhook URL',\n pattern: /https:\\/\\/hooks\\.slack\\.com\\/services\\/[A-Za-z0-9_+\\/-]{6,}/,\n severity: 'high',\n cwe: 'CWE-798',\n consequence: 'The URL *is* the credential — anyone holding it can post to that channel.',\n },\n {\n id: 'secret-stripe-key',\n name: 'Stripe Key',\n pattern: /\\b(?:sk_live_|rk_live_|sk_test_|rk_test_)[A-Za-z0-9]{20,}\\b/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Charge, refund and customer-data access against the account.',\n },\n {\n id: 'secret-sendgrid-key',\n name: 'SendGrid API Key',\n pattern: /\\bSG\\.[A-Za-z0-9_-]{16,}\\.[A-Za-z0-9_-]{16,}\\b/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Send mail as the domain — the credential behind most convincing phishing from a real sender.',\n },\n {\n id: 'secret-google-api-key',\n name: 'Google API Key',\n pattern: /\\bAIza[0-9A-Za-z_-]{35}\\b/,\n severity: 'high',\n cwe: 'CWE-798',\n consequence: 'Quota theft at minimum; API access to whatever the key was scoped to at worst.',\n },\n {\n id: 'secret-openai-key',\n name: 'OpenAI API Key',\n pattern: /\\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}\\b/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Billed inference against the owner’s account, with no per-key spend limit by default.',\n },\n {\n id: 'secret-anthropic-key',\n name: 'Anthropic API Key',\n pattern: /\\bsk-ant-(?:api\\d{2}-)?[A-Za-z0-9_-]{32,}\\b/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Billed inference against the owner’s account.',\n },\n {\n id: 'secret-database-url',\n name: 'Database URL with credentials',\n // Requires a credential segment before the `@` — `postgres://localhost/db`\n // is a hostname, not a secret.\n pattern: /\\b(?:postgres(?:ql)?|mysql|mongodb(?:\\+srv)?|redis|amqp|clickhouse):\\/\\/[^\\s'\"@\\/]*:[^\\s'\"@\\/]*@[^\\s'\"]+/i,\n severity: 'high',\n cwe: 'CWE-798',\n consequence: 'Direct database access, usually bypassing every application-level authorisation check.',\n },\n {\n id: 'secret-jwt',\n name: 'JSON Web Token',\n pattern: /\\beyJ[A-Za-z0-9_-]{8,}\\.eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_.+/=-]*/,\n severity: 'medium',\n cwe: 'CWE-798',\n consequence: 'Session or service identity until it expires — and committed tokens are usually long-lived.',\n keywordShaped: true,\n },\n {\n id: 'secret-generic-api-key',\n name: 'Generic API Key',\n // Quoted assignment only. An unquoted value in a `.env` is covered by the\n // vendor-prefixed rules above; matching it here is what starts flagging\n // ARNs and parameter-store paths.\n pattern: /(?:api[_-]?key|apikey|access[_-]?token|auth[_-]?token)\\s*[=:]\\s*['\"]([A-Za-z0-9\\-_.]{20,})['\"]/i,\n severity: 'high',\n cwe: 'CWE-798',\n consequence: 'Whatever the third-party service lets the key do, for as long as it stays valid.',\n keywordShaped: true,\n },\n {\n id: 'secret-generic-credential',\n name: 'Hardcoded Credential',\n pattern: /(?:secret|password|passwd|pwd|token)\\s*[=:]\\s*['\"]([^'\"\\s]{8,})['\"]/i,\n severity: 'high',\n cwe: 'CWE-798',\n consequence: 'A password in source is a password in every clone, fork and CI cache of that source.',\n keywordShaped: true,\n },\n {\n id: 'secret-hex-token',\n name: 'High-entropy Hex Token',\n pattern: /(?:token|key|secret|auth|signing)\\w*\\s*[=:]\\s*['\"]?([0-9a-f]{32,})['\"]?/i,\n severity: 'medium',\n cwe: 'CWE-798',\n consequence: 'Signing secrets and session keys are usually hex; a leaked one forges anything they sign.',\n keywordShaped: true,\n },\n];\n\n/**\n * Values that satisfy a credential shape but are not credentials.\n *\n * Kept deliberately short. Every entry is a documented, publicly-published\n * placeholder — not a guess that something \"looks like a test value\". A\n * generous allow-list here is how a scanner talks itself out of a real finding.\n */\nconst KNOWN_PLACEHOLDERS = [\n // Deliberately NOT here: AWS's published documentation key/secret pair\n // (`AKIAIOSFODNN7EXAMPLE`, `wJalrXUtnFEMI/…`). GitHub allow-lists them, and\n // the argument for following suit is that they authenticate nothing. The\n // argument against is stronger: they appear in a repository because someone\n // pasted a credentials template and left it there, and the remediation —\n // move this to the secret manager — is identical to the one for a live key.\n // Exempting them means the scanner goes quiet on the file most likely to\n // acquire a real key next.\n /\\bEXAMPLE_?KEY\\b/i,\n /\\bYOUR_[A-Z_]*(?:KEY|TOKEN|SECRET|PASSWORD)\\b/,\n /\\b(?:xxx+|X{4,}|\\*{4,}|<[a-z-]+>)\\b/,\n /\\bchangeme\\b/i,\n // The metasyntactic pair in a connection string, `postgres://user:pass@host`.\n // This is not the AWS case above and the distinction is the whole reason it\n // is allowed: `AKIAIOSFODNN7EXAMPLE` is a real credential *format* carrying a\n // fake value, so it arrives by way of a pasted template. `user:pass` is the\n // English words sitting where a credential goes, which is how every database\n // driver writes its DSN in its own README, and nobody pastes that out of a\n // secret manager.\n //\n // Both halves have to be metasyntactic. `root:hunter2@` is not exempt, since\n // a real password beside a common username is the case this must not swallow.\n /:\\/\\/(?:user(?:name)?|admin|root|dbuser|myuser):(?:pass(?:word|wd)?|secret|dbpass|mypassword)@/i,\n];\n\n/**\n * Whether the matched text is a documented placeholder rather than material.\n *\n * Note what this does *not* do: it does not exempt a value for being all\n * zeros, all A's, or otherwise \"obviously fake\". Those shapes are exactly what\n * the testbed's fixtures use, deliberately, and a scanner that skips them\n * scores zero on a corpus of real credential formats. Only values a vendor has\n * published as examples are exempt.\n */\nexport function isKnownPlaceholder(text: string): boolean {\n return KNOWN_PLACEHOLDERS.some((pattern) => pattern.test(text));\n}\n\n/*\n * Deliberately absent: a rule exempting a *typed sequence*.\n *\n * mulgadc/spinifex's API documentation is built out of an `ASIA` prefix\n * followed by `1A2B3C4D5E6F7890` — digits running 1234567890, letters running\n * ABCDEF, a person walking two keyboards at once. Six of them sit in `docs/`,\n * and because a documented key is neither a fixture nor annotated nor\n * self-describing, those six are every remaining critical on that repository.\n * Detecting the two monotonic runs is easy, and it was written, measured and\n * removed again.\n *\n * It cannot be had. `false-positives.test.ts` pins an `AKIA` prefix followed by\n * `1234567890ABCDEF` as a key that must never be exempted however it is named,\n * and that value *is* a typed sequence — the same shape, indistinguishable by\n * any rule that is not simply a list of the two literals. The header above says\n * why the test is right: the corpus this scanner is measured against builds its\n * fixtures out of exactly these shapes, so a scanner that skips them scores zero\n * on a corpus of real credential formats. Quiet documentation is not worth that\n * trade.\n *\n * The noise is real and stays. It is a cost of keying on value rather than on\n * path, which remains the correct axis — see `isDocPath`.\n */\n\n/**\n * Is the value the example text an empty input field shows?\n *\n * `placeholder` is the one HTML attribute whose contents are, by definition,\n * not data — it is the grey hint that disappears the moment a user types. A\n * credential-shaped string there is the interface telling somebody what to\n * paste, which is the same reason spinifex's cert-import dialog holds\n * `placeholder=\"-----BEGIN PRIVATE KEY-----\"`: a banner with no key under it.\n *\n * Both of those were criticals, and a critical is what a maintainer reads\n * first. Softened rather than skipped, like everything else here — a real key\n * left in a placeholder is rendered to every visitor, so it stays in the report.\n */\nexport function isPlaceholderAttribute(line: string, value: string): boolean {\n const at = line.lastIndexOf(value);\n if (at === -1) return false;\n return /(?:^|\\s)(?:aria-)?placeholder\\s*=\\s*[{(\"'`]*$/i.test(line.slice(0, at));\n}\n\n/**\n * Is the matched value a variable reference rather than a literal?\n *\n * The highest-volume false positive outside test files, and the one that needs\n * no judgement to dismiss: a value made entirely of an expansion holds nothing.\n *\n * SUPABASE_ACCESS_TOKEN=\"${SUPABASE_ACCESS_TOKEN:-}\"\n * TWILIO_AUTH_TOKEN=\"${TWILIO_AUTH_TOKEN:-}\"\n *\n * Those two lines are the canonical shape of a script that *refuses* to default\n * a secret — the `:-` with an empty right-hand side exists precisely so the\n * script fails when the variable is unset. Reporting them as hardcoded\n * credentials flags the remediation as the defect.\n *\n * The one thing this must not swallow is an expansion with a real fallback.\n * `${DB_PASSWORD:-hunter2}` *is* a hardcoded credential — it is the default the\n * process runs with — so a literal on the right of `:-` disqualifies the value.\n * A fallback that is itself another variable carries no literal and stays\n * exempt.\n */\nexport function isVariableReference(value: string): boolean {\n const trimmed = value.trim();\n\n // `${NAME}`, `${NAME:-}`, `${NAME:-$OTHER}` — shell parameter expansion, and\n // the same syntax a JavaScript template literal uses.\n const braced = /^\\$\\{\\s*([A-Za-z_][\\w.]*)\\s*(?::?[-=+?]([\\s\\S]*))?\\}$/.exec(trimmed);\n if (braced) {\n const fallback = braced[2];\n if (fallback === undefined || fallback.trim() === '') return true;\n return /^\\$\\{?[A-Za-z_][\\w.]*\\}?$/.test(fallback.trim());\n }\n\n return (\n /^\\$[A-Za-z_]\\w*$/.test(trimmed) || // $VAR\n /^\\$\\([\\s\\S]*\\)$/.test(trimmed) || // $(command substitution)\n /^%[A-Za-z_]\\w*%$/.test(trimmed) || // %VAR% on Windows\n /^\\{\\{[\\s\\S]*\\}\\}$/.test(trimmed) || // {{ template }}\n /^#\\{[\\s\\S]*\\}$/.test(trimmed) || // #{ruby}\n /^<%=?[\\s\\S]*%>$/.test(trimmed) // <%= erb %>\n );\n}\n\n/** Stems that announce a value as scaffolding rather than material. */\nconst FIXTURE_STEMS = [\n 'test', 'mock', 'fake', 'dummy', 'stub', 'sample', 'example', 'placeholder',\n 'fixture', 'invalid', 'expired', 'forged', 'bogus', 'notreal', 'nonexistent',\n 'changeme', 'foobar', 'lorem',\n];\n\n/**\n * Words that appear in every declaration and say nothing about the value.\n *\n * Without this, `const` in the key and any value containing the letters\n * \"const\" would agree, and more usefully: a keyword shared by all declarations\n * is not evidence that the value echoes the *name*.\n */\nconst KEY_NOISE = new Set(['const', 'this', 'return', 'await', 'async', 'expect', 'value']);\n\n/** Alphabetic runs, splitting snake_case, kebab-case and camelCase alike. */\nfunction words(text: string): string[] {\n return text\n .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n .replace(/[^A-Za-z]+/g, ' ')\n .toLowerCase()\n .split(' ')\n .filter(Boolean);\n}\n\n/**\n * In a test file, does this value describe itself as a fixture?\n *\n * Applied only to `keywordShaped` rules and only under `isTestPath`, which is\n * what keeps it from being the generous allow-list the header warns about. Two\n * signals, both read off the value rather than off the variable holding it:\n *\n * 1. A word of it begins with a fixture stem — `test-token`,\n * `mock-session-token`, `testpassword123`, `forgedToken`. Matching a stem\n * at the start of a *word* rather than anywhere in the string is what\n * keeps `latest` and `contest` from reading as \"test\".\n * 2. It repeats a word from its own key — `access_token: 'access-token'`,\n * `const password = 'mySecurePassword123'`, `testGPGPassword:\n * 'gpgPassword456'`. A credential that spells out the word \"password\" is\n * a description of one, not one.\n *\n * The second signal is capped at 48 characters, and that cap is load-bearing.\n * Base64 is dense enough that a long blob contains a four-letter word by\n * accident — a 200-character service JWT would eventually \"echo\" any key you\n * put beside it and exempt itself. Real credentials are long and fixtures are\n * short, so the cap costs nothing and closes the hole.\n *\n * What stays reported, deliberately: a value with neither signal. In the\n * corpus this was written against that left four findings out of seventy-nine,\n * one of them a real Supabase service JWT pasted into a debug script — which\n * is exactly the one worth a human's attention.\n */\nexport function isTestFixtureValue(line: string, value: string): boolean {\n const valueWords = words(value);\n if (valueWords.some((word) => FIXTURE_STEMS.some((stem) => word.startsWith(stem)))) return true;\n\n return describesItsOwnKey(line, value);\n}\n\n/**\n * Does the value repeat a word from the name of the thing holding it?\n *\n * Signal 2 of `isTestFixtureValue`, lifted out because the reasoning behind it\n * was never about tests. `access_token: 'access-token'` is a description of a\n * credential rather than a credential in a test file and in production code\n * alike — the difference is only what to do about it, and that is the caller's\n * decision, not this function's.\n *\n * Outside a test the caller downgrades instead of skipping, which is what makes\n * generalising it safe. `DB_PASSWORD = \"password123\"` echoes its key and is\n * also a real, terrible, hardcoded credential; it stays in the report.\n *\n * This is the third of the three structural false-positive causes measured on\n * Go repositories, and on a cloud project it is the loudest. An AWS-compatible\n * API surface is built out of constants that name credentials without being\n * them:\n *\n * ErrExpiredToken = \"ExpiredToken\" // an API error code\n * pathToken = \"/latest/api/token\" // a URL path\n * hdrToken = \"X-aws-ec2-metadata-token\" // a header name\n * CommandSetMasterPassword = \"set-master-password\" // a CLI verb\n *\n * Every one matches `secret-generic-credential`, which keys on the *word*\n * `token` or `password` next to a quoted string and never looks at what the\n * string is. Every one repeats its own key.\n *\n * The 48-character cap is load-bearing and is explained on `isTestFixtureValue`:\n * base64 is dense enough that a long blob eventually contains a four-letter\n * word by accident and would exempt itself.\n */\nexport function describesItsOwnKey(line: string, value: string): boolean {\n if (value.length > 48) return false;\n\n const valueAt = line.lastIndexOf(value);\n const key = valueAt === -1 ? line : line.slice(0, valueAt);\n const flattened = words(value).join('');\n\n return words(key)\n .filter((word) => word.length >= 4 && !KEY_NOISE.has(word))\n .some((word) => flattened.includes(word));\n}\n\n/**\n * Replace anything that looks like credential material with asterisks.\n *\n * Applied to every excerpt on a secret finding before it reaches a terminal, a\n * SARIF file, a CI log or a PR comment. A scanner that prints the secret it\n * found has moved the secret somewhere new, and CI logs are retained and, on\n * public forks, published.\n */\nexport function redactSecret(line: string): string {\n return line.replace(/([A-Za-z0-9+/=_.-]{12,})/g, (match) => {\n if (match.length <= 12) return match;\n return `${match.slice(0, 3)}${'*'.repeat(Math.min(16, match.length - 3))}`;\n });\n}\n\n/** Files whose mere presence is worth reporting, independent of content. */\nexport const SENSITIVE_FILES: readonly { pattern: string; message: string; severity: Severity }[] = [\n { pattern: '.env', message: 'Environment file committed — the usual home of every runtime credential', severity: 'high' },\n { pattern: '.env.local', message: 'Local environment file committed', severity: 'high' },\n { pattern: '.env.production', message: 'Production environment file committed', severity: 'critical' },\n { pattern: 'id_rsa', message: 'Private SSH key committed', severity: 'critical' },\n { pattern: 'id_ed25519', message: 'Private SSH key committed', severity: 'critical' },\n { pattern: 'id_ecdsa', message: 'Private SSH key committed', severity: 'critical' },\n { pattern: '.pem', message: 'PEM certificate or key file committed', severity: 'high' },\n { pattern: '.p12', message: 'PKCS#12 keystore committed', severity: 'high' },\n { pattern: '.pfx', message: 'PKCS#12 keystore committed', severity: 'high' },\n { pattern: '.keystore', message: 'Java keystore committed', severity: 'high' },\n // Deliberately not `.npmrc`. Its presence is normal; only an `_authToken`\n // line in it is a credential, and that is a content match, not a filename\n // match. Reporting the file itself trades a real finding for a chore.\n];\n","/**\n * The scan engine, minus the filesystem: run every rule set over text.\n *\n * Kept free of I/O entirely — no reading, no printing, no exit codes, no\n * SARIF. The command layer decides how to present what this returns, which is\n * what lets the same scan feed a terminal, a SARIF file and a daemon run\n * without three implementations drifting apart.\n *\n * The absence of `node:` imports here is load-bearing, not incidental. This\n * module is the package's default entry point, and the browser surfaces —\n * web, extension, desktop renderer — import it directly. A single\n * `import … from 'node:fs'` anywhere in this file's dependency graph breaks\n * every one of their bundles, so the tree walker lives in `./node/walk.ts`\n * and everything here works on strings that somebody else read.\n */\n\nimport { CODE_RULES, evaluateRule, proseLines } from './code-rules';\nimport { scanPackageJson, scanRequirementsTxt } from './manifest-rules';\nimport {\n describesItsOwnKey,\n isKnownPlaceholder,\n isPlaceholderAttribute,\n isTestFixtureValue,\n isVariableReference,\n redactSecret,\n SECRET_RULES,\n} from './secret-rules';\nimport { evaluateTemplateRules, TEMPLATE_EXTENSIONS } from './template-rules';\nimport type { ScanFinding, ScanLanguage, Severity } from './types';\nimport { severityRank } from './types';\n\n/**\n * `extname` and `basename`, reimplemented in three lines each.\n *\n * Importing them from `node:path` is what would otherwise put this module —\n * and therefore the package's whole default entry point — out of reach of a\n * browser bundle, for two functions that are pure string arithmetic.\n *\n * Semantics match the originals on the inputs that reach them: a leading dot\n * is not an extension, so `.env` has none, and a name with no dot has none\n * either. Only `/` is treated as a separator, which is what the callers pass —\n * repository-relative paths and shebang interpreter paths.\n */\nfunction baseNameOf(path: string): string {\n return path.slice(path.lastIndexOf('/') + 1);\n}\n\nfunction extensionOf(path: string): string {\n const base = baseNameOf(path);\n const dot = base.lastIndexOf('.');\n return dot <= 0 ? '' : base.slice(dot);\n}\n\nexport const SKIP_DIRS = new Set([\n 'node_modules', '.git', '.next', '.nuxt', 'dist', 'build', 'out', '__pycache__',\n '.venv', 'venv', 'vendor', '.terraform', 'coverage', '.cache', '.pnpm-store',\n 'target', '.gradle', '.idea', '.vscode', 'bower_components', '.svelte-kit',\n]);\n\nexport const SCAN_EXTENSIONS = new Set([\n '.ts', '.js', '.tsx', '.jsx', '.mjs', '.cjs', '.mts', '.cts',\n '.py', '.rb', '.go', '.java', '.kt', '.scala', '.php', '.rs',\n '.c', '.cc', '.cpp', '.h', '.hpp', '.cs', '.swift',\n '.yml', '.yaml', '.json', '.toml', '.ini', '.cfg', '.conf', '.env',\n '.sh', '.bash', '.zsh', '.tf', '.hcl', '.xml', '.properties', '.gradle',\n '.txt', '.md', '.sql', '.erb', '.ejs', '.vue', '.svelte',\n // Template files, so the engine in `template-rules.ts` has something to\n // read. Sourced from the rules themselves rather than repeated here: an\n // engine added there becomes scannable without a second edit that could be\n // forgotten, which is how a rule ends up quietly never firing.\n ...TEMPLATE_EXTENSIONS,\n]);\n\nconst LANGUAGE_BY_EXTENSION: Record<string, ScanLanguage> = {\n '.js': 'javascript', '.jsx': 'javascript', '.mjs': 'javascript', '.cjs': 'javascript',\n '.ts': 'typescript', '.tsx': 'typescript', '.mts': 'typescript', '.cts': 'typescript',\n '.vue': 'javascript', '.svelte': 'javascript', '.ejs': 'javascript',\n '.py': 'python',\n '.rb': 'ruby', '.erb': 'ruby',\n '.go': 'go',\n '.java': 'java', '.kt': 'java', '.scala': 'java',\n '.php': 'php',\n '.sh': 'shell', '.bash': 'shell', '.zsh': 'shell',\n '.yml': 'config', '.yaml': 'config', '.json': 'config', '.toml': 'config',\n '.ini': 'config', '.cfg': 'config', '.conf': 'config', '.env': 'config',\n '.tf': 'config', '.hcl': 'config', '.properties': 'config',\n};\n\nexport function languageOf(filename: string): ScanLanguage {\n if (filename.startsWith('.env') || filename.endsWith('.env')) return 'config';\n return LANGUAGE_BY_EXTENSION[extensionOf(filename).toLowerCase()] ?? 'other';\n}\n\n/** Interpreters worth recognising, by the language their scripts are written in. */\nconst LANGUAGE_BY_INTERPRETER: Record<string, ScanLanguage> = {\n sh: 'shell', bash: 'shell', zsh: 'shell', dash: 'shell', ksh: 'shell', ash: 'shell',\n python: 'python', python2: 'python', python3: 'python',\n ruby: 'ruby',\n node: 'javascript', nodejs: 'javascript', deno: 'javascript', bun: 'javascript',\n php: 'php',\n};\n\n/**\n * The language a `#!` line declares, or `null` if the line is not a shebang.\n *\n * An executable in a repository root is routinely named for the command it\n * provides rather than the language it is written in — `debtap`, `configure`,\n * `gradlew`. Extension-based detection skips every one of them, which is worst\n * exactly where it matters: a project whose entire source is one extensionless\n * script gets a clean scan because nothing was read.\n *\n * The shebang is the authoritative answer to a question the filename cannot\n * answer, and the kernel already treats it that way.\n */\nexport function languageOfShebang(firstLine: string): ScanLanguage | null {\n const match = /^#!\\s*(\\S+)(?:\\s+(.+?))?\\s*$/.exec(firstLine);\n if (!match) return null;\n\n // `#!/usr/bin/env bash` names the interpreter in the argument, not the path.\n const command = baseNameOf(match[1]!);\n const args = match[2]?.trim().split(/\\s+/) ?? [];\n const splitString = args[0] === '-S' || args[0] === '--split-string';\n const name = command === 'env' ? baseNameOf(args[splitString ? 1 : 0] ?? '') : command;\n\n const exact = LANGUAGE_BY_INTERPRETER[name];\n if (exact) return exact;\n\n // `python3.11` and `bash5` are the same interpreters with a version glued on.\n const stripped = name.replace(/[\\d.]+$/, '');\n return (stripped ? LANGUAGE_BY_INTERPRETER[stripped] : undefined) ?? null;\n}\n\n\n/**\n * Inline suppression, matching the convention `modules/code-scanner` already\n * uses so a repository does not learn two syntaxes for the same idea.\n *\n * // threatcrush-disable-next-line secret-aws-access-key fixture, not a key\n * // threatcrush-disable-line\n *\n * The rule id is optional; without one the whole line is suppressed. This\n * exists because the highest-volume false positive in practice is a scanner's\n * own test fixtures — a file of deliberately-malformed credentials is\n * indistinguishable from a file of leaked ones, and only the author knows\n * which. Suppressions are counted and reported: a quiet scan full of\n * suppressions is not a clean one.\n */\nconst SUPPRESS_NEXT = /threatcrush-disable-next-line(?:\\s+([\\w-]+))?/;\nconst SUPPRESS_LINE = /threatcrush-disable-line(?:\\s+([\\w-]+))?/;\n\n/**\n * Another linter's suppression, naming the linter that means \"security\" in that\n * linter's own vocabulary.\n *\n * A repository that has already triaged a finding did so in the one place a\n * reviewer will look, which is the line itself. Re-raising it at full severity\n * asks the operator to make the same decision a second time in a different\n * tool, and printing an excerpt whose own text reads \"G101 false positive:\n * HTTP header name, not a credential\" is the clearest possible signal that\n * nothing read it.\n *\n * This used to insist the *rule* be named — `gosec` and `G101` both. That was\n * the wrong half of the annotation to key on, and it is the single biggest\n * source of noise on a mature Go repository. Measured on mulgadc/spinifex:\n * nine of its twenty-one `InsecureSkipVerify` lines carry a bare\n * `//nolint:gosec` with a written reason beside it —\n *\n * InsecureSkipVerify: true, //nolint:gosec // self-signed per-node certs\n *\n * — and every one was re-reported at high. Go projects overwhelmingly write the\n * bare form; requiring `G101` meant honouring the annotation almost nowhere it\n * is actually written, while claiming in the docstring to honour it.\n *\n * Naming the *linter* is still required, and that is what keeps this from\n * becoming a way to hide findings. `gosec` and `nosec` are a security linter\n * and its inline directive: a line carrying one has been looked at by a human\n * asking a security question. A bare `//nolint` is a statement about something,\n * with no reason to think it is about security at all, and `//nolint:errcheck`\n * is a statement about error handling. Neither counts.\n *\n * And the finding is downgraded rather than dropped, the way `isTestPath`\n * downgrades a fixture, so it stays in the report for anyone auditing the\n * suppressions themselves.\n */\nconst FOREIGN_SECURITY = /\\b(?:nolint:[\\w,]*gosec|nosec)\\b/;\n\nexport function foreignSecurityMark(line: string): boolean {\n return FOREIGN_SECURITY.test(line);\n}\n\nexport interface Suppressions {\n /** line index → set of rule ids, or `*` for every rule. */\n byLine: Map<number, Set<string>>;\n count: number;\n}\n\nexport function collectSuppressions(lines: readonly string[]): Suppressions {\n const byLine = new Map<number, Set<string>>();\n let count = 0;\n\n const add = (index: number, ruleId: string | undefined): void => {\n const existing = byLine.get(index) ?? new Set<string>();\n existing.add(ruleId ?? '*');\n byLine.set(index, existing);\n count += 1;\n };\n\n lines.forEach((line, index) => {\n const next = SUPPRESS_NEXT.exec(line);\n if (next) add(index + 1, next[1]);\n const same = SUPPRESS_LINE.exec(line);\n // `disable-next-line` also matches the `disable-line` substring, so only\n // treat it as a same-line directive when the longer form did not match.\n if (same && !next) add(index, same[1]);\n });\n\n return { byLine, count };\n}\n\nfunction isSuppressed(suppressions: Suppressions, index: number, ruleId: string): boolean {\n const rules = suppressions.byLine.get(index);\n if (!rules) return false;\n return rules.has('*') || rules.has(ruleId);\n}\n\n/**\n * Does this path hold tests or fixtures?\n *\n * Used to soften credential findings, never to hide them. A secret in a test\n * is nearly always a fixture — often a deliberately real-looking one, because\n * the test exists to prove the real path is guarded — but \"nearly always\" is\n * not \"always\", and a genuine key does get pasted into a test. So these are\n * still reported, at a severity that does not block a merge, rather than\n * dropped where nobody would ever see them.\n */\nexport function isTestPath(relativePath: string): boolean {\n const p = relativePath.replace(/\\\\/g, '/');\n return (\n /(?:^|\\/)(?:tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|e2e|testdata|testutils?|harness)\\//i.test(p) ||\n /(?:^|\\/)(?:test|conftest)_[^/]+$/i.test(p) ||\n /[._-](?:test|spec)\\.[a-z]+$/i.test(p) ||\n /_test\\.[a-z]+$/i.test(p)\n );\n}\n\n/**\n * Does this path hold documentation or illustrative code?\n *\n * The same softening as `isTestPath`, and for the *code* rules only. A fenced\n * block in a README is a transcript of a command someone might run, not a\n * program that runs: `go run . -log-dir /tmp/artifacts` in a usage example is\n * not a symlink attack on anybody, because nothing executes it.\n *\n * Deliberately not applied to the credential rules, which is the opposite of\n * what the volume on a documentation tree first suggests. Their noise is a\n * property of the *value*, and value is the axis they are keyed on:\n * `limen-regression.test.ts` pins a README quoting `postgres://user:pass@host`\n * as silent while a real DSN in that same README still reports at `high`, and a\n * path rule would give that up. A README is a perfectly ordinary place to leak\n * a key.\n *\n * mulgadc/spinifex matches the AWS key rule ninety-six times. Ninety of those\n * are in test paths and were already `low`; the remaining six are in `docs/`,\n * and they are every critical left on that repository after this change. See\n * the note in `secret-rules.ts` on typed sequences for why the value-side fix\n * that would have silenced them cannot be had without giving up real detection.\n */\nexport function isDocPath(relativePath: string): boolean {\n const p = relativePath.replace(/\\\\/g, '/');\n return (\n /(?:^|\\/)(?:docs?|examples?|samples?)\\//i.test(p) ||\n /\\.(?:md|mdx|markdown|rst|adoc)$/i.test(p)\n );\n}\n\n/**\n * Why a finding is being reported at `low` rather than at its rule's severity.\n *\n * Five contexts, one mechanism. Each says something about the *setting* of a\n * match rather than about the construct itself, so none of them may ever drop\n * a finding — a softened finding is still counted, still printed, still in the\n * SARIF, and `--fail-on low` still stops on it. The severity is the claim being\n * weakened, not the report.\n *\n * That is the line this must not cross. Every one of these is a heuristic about\n * where code lives or what it is named, and heuristics of that kind are wrong\n * often enough that they may inform a severity and never a verdict.\n */\ntype Softening = 'test' | 'docs' | 'suppressed' | 'placeholder' | 'self-describing';\n\n/** Most specific evidence first, so it is the reason the operator is shown. */\nconst SOFTENING_ORDER: readonly Softening[] = [\n 'suppressed',\n 'placeholder',\n 'self-describing',\n 'test',\n 'docs',\n];\n\nfunction softening(reasons: Partial<Record<Softening, boolean>>): Softening | null {\n return SOFTENING_ORDER.find((reason) => reasons[reason]) ?? null;\n}\n\n/** The clause completing \"Possible AWS Access Key detected …\" on a secret. */\nconst SECRET_SOFTENING: Record<Softening, string> = {\n test: 'in a test file — usually a fixture, still worth confirming it is not a live credential',\n docs: 'in documentation — usually an illustrative example, still worth confirming it is not a live credential',\n suppressed: \"on a line already marked as a false positive for another linter's security rule\",\n placeholder: 'in example text an empty input field shows, not in data',\n 'self-describing':\n 'in a value that repeats the name of the field holding it — usually a description of a credential rather than one',\n};\n\n/** The clause appended to a code finding's message to say why it was softened. */\nconst CODE_SOFTENING: Record<Softening, string> = {\n test: 'in a test file, where the construct is ordinary',\n docs: 'in documentation or example code, which nothing runs',\n suppressed: \"on a line another linter's security suppression already covers\",\n placeholder: 'in example text rather than in data',\n 'self-describing': 'in a value that describes itself',\n};\n\n/** Scan a single file's text. Exposed for tests and for single-file callers. */\nexport function scanText(\n relativePath: string,\n text: string,\n language: ScanLanguage = languageOf(relativePath),\n): ScanFinding[] {\n const findings: ScanFinding[] = [];\n const lines = text.split('\\n');\n const suppressions = collectSuppressions(lines);\n const inTests = isTestPath(relativePath);\n const inDocs = isDocPath(relativePath);\n\n // ── Credentials ────────────────────────────────────────────────────────\n lines.forEach((line, index) => {\n for (const rule of SECRET_RULES) {\n const match = rule.pattern.exec(line);\n if (!match) continue;\n if (isKnownPlaceholder(match[0])) continue;\n if (isSuppressed(suppressions, index, rule.id)) continue;\n\n // The value the rule actually captured, falling back to the whole match\n // for the vendor-prefixed rules, which have no capture group because the\n // format *is* the value.\n const value = match[1] ?? match[0];\n\n // An expansion is not a literal, in a test file or anywhere else.\n if (isVariableReference(value)) continue;\n\n // Fixtures, and only in files that are fixtures by construction. See\n // `isTestFixtureValue` for why this cannot reach a vendor-issued key.\n if (inTests && rule.keywordShaped && isTestFixtureValue(line, value)) continue;\n\n // A value that repeats its own key is a description of a credential\n // rather than one — and unlike the fixture exemption above, that is true\n // outside a test too, so it softens rather than skips. See\n // `describesItsOwnKey`.\n //\n // Note the `false` where the code rules below pass `inDocs`. Documentation\n // noise is a *value* problem for the credential rules and is solved by\n // `isKnownPlaceholder`, deliberately: `limen-regression.test.ts` pins the\n // behaviour that a README quoting `postgres://user:pass@host` is silent\n // while a real DSN in the same README is still `high`. Softening secrets\n // by path would take that guarantee away, and a README is a perfectly\n // ordinary place to leak a key.\n const soft = softening({\n test: inTests,\n suppressed: foreignSecurityMark(line),\n placeholder: isPlaceholderAttribute(line, value),\n 'self-describing': rule.keywordShaped === true && describesItsOwnKey(line, value),\n });\n\n findings.push({\n ruleId: rule.id,\n title: rule.name,\n file: relativePath,\n line: index + 1,\n // Reported but not blocking wherever context weakens the claim — see\n // `softening`. Never dropped: the count is the same either way.\n severity: soft ? 'low' : rule.severity,\n // A matched credential format is the finding, not a proxy for one.\n confidence: 'evidence',\n message: soft\n ? `Possible ${rule.name} detected ${SECRET_SOFTENING[soft]}`\n : `Possible ${rule.name} detected`,\n consequence: rule.consequence,\n cwe: rule.cwe,\n excerpt: redactSecret(line.trim()).slice(0, 200),\n sensitive: true,\n category: 'secret',\n });\n }\n });\n\n // ── Code-level constructs ──────────────────────────────────────────────\n const prose = proseLines(lines);\n lines.forEach((_line, index) => {\n for (const rule of CODE_RULES) {\n if (isSuppressed(suppressions, index, rule.id)) continue;\n const match = evaluateRule(rule, { lines, index, language, prose });\n if (!match) continue;\n\n // The context the credential rules above have always read, applied to the\n // code rules for the first time. Leaving it off them was the second of\n // the three structural false-positive causes and much the largest: on\n // mulgadc/spinifex it is 104 findings, every one of them a code rule\n // reporting at full severity from inside a test — `\"/tmp/test-wal\"` in a\n // table-driven fixture, `exec.Command(\"sh\", \"-c\", \"exit 42\")` in a\n // process-supervision test, `InsecureSkipVerify` against the harness's own\n // self-signed certificate. Each is the normal way to write that test.\n const soft = softening({\n test: inTests,\n docs: inDocs,\n suppressed: foreignSecurityMark(lines[index] ?? ''),\n });\n\n findings.push({\n ruleId: rule.id,\n title: rule.title,\n file: relativePath,\n line: index + 1,\n severity: soft ? 'low' : match.severity,\n confidence: match.confidence,\n message: soft ? `${rule.title} (${rule.cwe}) — ${CODE_SOFTENING[soft]}` : `${rule.title} (${rule.cwe})`,\n consequence: rule.consequence,\n cwe: rule.cwe,\n excerpt: (lines[index] ?? '').trim().slice(0, 200),\n category: 'code',\n });\n }\n });\n\n // ── Template output ────────────────────────────────────────────────────\n //\n // Keyed on the extension rather than on `language`, because the extension is\n // what names the engine and the engine is what decides which syntax skips\n // escaping. This runs *in addition to* the code rules above, so a `.vue`\n // file is checked both as JavaScript and as a template.\n for (const match of evaluateTemplateRules(extensionOf(relativePath), lines)) {\n const index = match.line - 1;\n if (isSuppressed(suppressions, index, match.rule.id)) continue;\n\n const soft = softening({\n test: inTests,\n docs: inDocs,\n suppressed: foreignSecurityMark(lines[index] ?? ''),\n });\n\n findings.push({\n ruleId: match.rule.id,\n title: match.rule.title,\n file: relativePath,\n line: match.line,\n severity: soft ? 'low' : match.severity,\n confidence: 'pattern',\n message: soft\n ? `${match.rule.title} (${match.rule.cwe}) — ${CODE_SOFTENING[soft]}`\n : `${match.rule.title} (${match.rule.cwe})`,\n consequence: match.rule.consequence,\n cwe: match.rule.cwe,\n excerpt: (lines[index] ?? '').trim().slice(0, 200),\n category: 'code',\n });\n }\n\n return findings;\n}\n\nexport function scanManifest(relativePath: string, filename: string, text: string): ScanFinding[] {\n const manifestFindings =\n filename === 'package.json'\n ? scanPackageJson(text)\n : filename === 'requirements.txt'\n ? scanRequirementsTxt(text)\n : [];\n\n return manifestFindings.map((finding) => ({\n ruleId: finding.ruleId,\n title: finding.title,\n file: relativePath,\n line: finding.line,\n severity: finding.severity,\n confidence: 'evidence' as const,\n message: finding.message,\n consequence: finding.consequence,\n cwe: finding.cwe,\n excerpt: finding.excerpt.slice(0, 200),\n category: 'manifest' as const,\n }));\n}\n\n\n\n/** Highest severity present, or null for a clean scan. */\nexport function peakSeverity(findings: readonly ScanFinding[]): Severity | null {\n let peak: Severity | null = null;\n for (const finding of findings) {\n if (!peak || severityRank(finding.severity) > severityRank(peak)) peak = finding.severity;\n }\n return peak;\n}\n\n/** True when any finding is at or above `threshold`. Drives `--fail-on`. */\nexport function meetsFailThreshold(\n findings: readonly ScanFinding[],\n threshold: readonly Severity[],\n): boolean {\n if (threshold.length === 0) return false;\n const floor = Math.min(...threshold.map(severityRank));\n return findings.some((finding) => severityRank(finding.severity) >= floor);\n}\n","/**\n * The filesystem half of the scan engine: walk a tree, read what is scannable,\n * hand the text to the rules.\n *\n * Split from `../text.ts` because this file imports `node:fs` and that one must\n * not. The package's default entry point is consumed by browser bundles, and a\n * single filesystem import anywhere in its graph breaks all of them. Everything\n * that needs a disk lives behind the `./node` entry point instead.\n */\n\nimport {\n closeSync, fstatSync, openSync, readdirSync, readFileSync, readSync, statSync,\n} from 'node:fs';\nimport { basename, dirname, extname, join, relative, sep } from 'node:path';\nimport { ControlAudit } from '../controls';\nimport { SENSITIVE_FILES } from '../secret-rules';\nimport {\n collectSuppressions,\n languageOf,\n languageOfShebang,\n SCAN_EXTENSIONS,\n scanManifest,\n scanText,\n SKIP_DIRS,\n} from '../text';\nimport type { ScanFinding, ScanLanguage } from '../types';\nimport { severityRank } from '../types';\n\nexport interface ScanOptions {\n /** Skip files larger than this. Defaults to 1 MiB. */\n maxFileBytes?: number;\n /** Called once per file actually read, for progress reporting. */\n onFile?: (path: string) => void;\n /** Restrict to these rule categories. Defaults to all. */\n categories?: readonly ScanFinding['category'][];\n /**\n * Paths to skip, as globs over repository-relative POSIX paths.\n *\n * Merged with a `.threatcrushignore` file at the scan root, if present. The\n * intended use is generated output, vendored trees, and — the case that\n * prompted this — a scanner's own rule definitions and test fixtures, which\n * are vulnerable-looking by design and otherwise dominate its self-scan.\n *\n * Excluding is not the same as finding nothing: the count of skipped paths\n * is reported (`ScanReport.excluded`) and surfaced, so a scan silenced by a\n * broad glob cannot be mistaken for a clean one.\n */\n exclude?: readonly string[];\n /**\n * Also report security controls the tree has no evidence of.\n *\n * Opt-in, because an absence is a weaker claim than a present defect and\n * this one is answered from the whole tree rather than from a line — see\n * `../controls.ts`. Silently produces nothing when the tree serves no HTTP.\n */\n missingControls?: boolean;\n}\n\n/**\n * Compile exclusion globs into one predicate over relative POSIX paths.\n *\n * gitignore-flavoured: `*` matches within a path segment, `**` across\n * segments, `?` a single non-slash character. A pattern with no `/` matches by\n * name at any depth — `__tests__` excludes every directory so named — while a\n * pattern containing `/` is anchored to the scan root. Blank lines and `#`\n * comments are ignored, so a `.threatcrushignore` file can be passed straight\n * in. Exported for its own tests.\n */\nexport function compileExcludes(patterns: readonly string[]): (relPath: string) => boolean {\n const matchers = patterns\n .map((p) => p.trim())\n .filter((p) => p.length > 0 && !p.startsWith('#'))\n .map(compilePattern);\n if (matchers.length === 0) return () => false;\n return (relPath) => {\n const segs = relPath.split('/');\n return matchers.some((m) => m(segs));\n };\n}\n\n/**\n * Matching is done segment by segment, in code, rather than by compiling the\n * glob into one big regex.\n *\n * A cross-segment regex — `(?:[^/]+/)*` for depth, a dot-star for `**` — is the\n * shape that backtracks quadratically on a path full of slashes, the\n * polynomial-ReDoS CodeQL flags and this scanner has its own rule for. There is\n * no way to feed a whole path through a single generated pattern without that\n * risk. Splitting both the pattern and the path on `/` and walking them with a\n * two-pointer (the classic `**` alignment) removes it entirely: each per-segment\n * regex is a trivial `^…$` with a single quantifier and is tested against one\n * bounded segment, never the whole path.\n */\nconst GLOBSTAR = Symbol('globstar');\ntype SegMatcher = RegExp | typeof GLOBSTAR;\n\nfunction compilePattern(pattern: string): (segs: readonly string[]) => boolean {\n // Trailing slashes are trimmed without a regex: `/\\/+$/` is unanchored, so\n // `replace` retries at every start position and is quadratic on a value that\n // is all slashes — the very polynomial-ReDoS this file is avoiding.\n const withoutLead = pattern.replace(/^\\.?\\//, '');\n let end = withoutLead.length;\n while (end > 0 && withoutLead[end - 1] === '/') end -= 1;\n const p = withoutLead.slice(0, end);\n\n // A pattern with no `/` matches by name at any depth: excluded if any single\n // segment matches it.\n if (!p.includes('/')) {\n if (p === '**') return () => true;\n const rx = segToRegExp(p);\n return (segs) => segs.some((s) => rx.test(s));\n }\n\n const raw = p.split('/');\n // A trailing `**` means \"the contents of\", so it must not match the directory\n // itself — the path has to be strictly deeper than the leading parts.\n const trailingGlobstar = raw[raw.length - 1] === '**';\n const core = trailingGlobstar ? raw.slice(0, -1) : raw;\n const parts: SegMatcher[] = core.map((s) => (s === '**' ? GLOBSTAR : segToRegExp(s)));\n\n return (segs) => {\n const end = matchPrefix(parts, segs);\n if (end < 0) return false;\n // `end` is where the pattern stopped; everything past it is the pruned\n // subtree. A prefix match covers the path and all of its descendants;\n // `dir/**` additionally requires at least one descendant.\n return trailingGlobstar ? end < segs.length : true;\n };\n}\n\n/** `*` within a segment, `?` one character; a segment contains no slash. */\nfunction segToRegExp(seg: string): RegExp {\n let body = '';\n for (let i = 0; i < seg.length; i += 1) {\n const c = seg[i]!;\n if (c === '*') {\n // Collapse a run of `*` into one `[^/]*`; `[^/]*[^/]*` is two adjacent\n // stars over the same characters, which backtracks quadratically.\n while (seg[i + 1] === '*') i += 1;\n body += '[^/]*';\n } else if (c === '?') {\n body += '[^/]';\n } else {\n body += c.replace(/[.+^${}()|[\\]\\\\]/g, '\\\\$&');\n }\n }\n return new RegExp(`^${body}$`);\n}\n\n/**\n * Align `parts` against a prefix of `segs`, `GLOBSTAR` consuming zero or more\n * segments. Returns the index in `segs` where the match ends, or -1. A\n * two-pointer with one backtrack point for the active globstar — O(segments),\n * no catastrophic backtracking.\n */\nfunction matchPrefix(parts: readonly SegMatcher[], segs: readonly string[]): number {\n let pi = 0;\n let si = 0;\n let star = -1;\n let starSi = -1;\n\n while (pi < parts.length) {\n const part = parts[pi]!;\n if (part === GLOBSTAR) {\n star = pi;\n starSi = si;\n pi += 1;\n } else if (si < segs.length && part.test(segs[si]!)) {\n pi += 1;\n si += 1;\n } else if (star !== -1 && starSi < segs.length) {\n starSi += 1;\n si = starSi;\n pi = star + 1;\n } else {\n return -1;\n }\n }\n return si;\n}\n\n/** The globs in a `.threatcrushignore` at `root`, or `[]` if there is none. */\nfunction readIgnoreFile(root: string): string[] {\n try {\n return readFileSync(join(root, '.threatcrushignore'), 'utf-8').split('\\n');\n } catch {\n return [];\n }\n}\n\nexport interface ScanReport {\n findings: ScanFinding[];\n filesScanned: number;\n /**\n * How many inline suppressions were honoured. Reported, never hidden: a\n * scan that came back quiet because someone silenced forty rules is a\n * different result from a scan that came back quiet.\n */\n suppressed: number;\n /**\n * Directory that finding paths are relative to. Equal to the target for a\n * directory scan, its parent for a single-file scan. SARIF URI resolution\n * needs this — guessing it from the target is what produces file URIs that\n * resolve to nothing.\n */\n root: string;\n /**\n * Files matched by extension but unreadable. Reported rather than swallowed:\n * a scan that could not read a file has not cleared it, and \"0 findings\"\n * over an unread tree is the failure this scanner exists to avoid.\n */\n unreadable: string[];\n /**\n * How many paths an exclusion glob skipped — a pruned directory counts once,\n * not per file inside it. Reported for the same reason `suppressed` is: a\n * quiet scan produced by a broad `.threatcrushignore` is not a clean scan.\n */\n excluded: number;\n}\n\nexport function scanPath(targetPath: string, options: ScanOptions = {}): ScanReport {\n const maxFileBytes = options.maxFileBytes ?? 1024 * 1024;\n const allowed = options.categories ? new Set(options.categories) : null;\n const findings: ScanFinding[] = [];\n const controls = new ControlAudit();\n const unreadable: string[] = [];\n let filesScanned = 0;\n let suppressed = 0;\n let excluded = 0;\n\n // A file target is not a degenerate directory target. `readdirSync` on a\n // file throws ENOTDIR, which the walker below treats as an unreadable\n // directory — so `threatcrush scan app.js` reported a clean scan of a file\n // it never opened. Resolve the shape first, and walk only what is walkable.\n const rootIsDirectory = (() => {\n try {\n return statSync(targetPath).isDirectory();\n } catch {\n return true;\n }\n })();\n const walkRoot = rootIsDirectory ? targetPath : dirname(targetPath);\n\n // Exclusions come from both the caller and a committed `.threatcrushignore`,\n // so a repository can carry its own ignore list without every invocation\n // repeating `--exclude`. Compiled once for the whole walk.\n const isExcluded = compileExcludes([...(options.exclude ?? []), ...readIgnoreFile(walkRoot)]);\n\n const scanFile = (fullPath: string, filename: string): void => {\n const relativePath = toRelative(walkRoot, fullPath);\n const extension = extname(filename).toLowerCase();\n const isManifest = filename === 'package.json' || filename === 'requirements.txt';\n const scannable = SCAN_EXTENSIONS.has(extension) || filename.startsWith('.env');\n\n // A file with no extension gets one question asked of it before being\n // dismissed: does it start with a shebang? Executables are habitually named\n // for what they do rather than what they are written in, and skipping them\n // silently is how a repository whose only source file is `debtap` scans\n // clean. Files that carry an unrecognised extension are still skipped —\n // `.png` is not a script, and sniffing every one of them would mean reading\n // the whole tree.\n const mayDeclareInterpreter = !scannable && !isManifest && extension === '';\n\n if (!scannable && !isManifest && !mayDeclareInterpreter) {\n recordSensitiveFile(filename, relativePath, findings, []);\n return;\n }\n\n // Size-check and read through one descriptor.\n //\n // `statSync(path)` followed by `readFileSync(path)` is check-then-use: the\n // path can be replaced between the two calls, so the size that was checked\n // is not necessarily the size that gets read. Opening once and calling\n // `fstatSync` on the descriptor removes the window — the descriptor refers\n // to the same inode for both operations, whatever happens to the name.\n //\n // A scanner walking directories it does not control is exactly where this\n // matters, and CWE-362 is a class this tool reports on. Worth getting\n // right in its own walker.\n let text: string;\n let handle: number;\n let declared: ScanLanguage | null = null;\n try {\n handle = openSync(fullPath, 'r');\n } catch {\n unreadable.push(relativePath);\n return;\n }\n\n try {\n if (fstatSync(handle).size > maxFileBytes) return;\n\n // Sniff the shebang from a short prefix rather than the whole file, so an\n // extensionless blob — a checked-in binary, a data file — costs one small\n // read instead of a megabyte decoded as UTF-8 and thrown away.\n if (mayDeclareInterpreter) {\n const prefix = Buffer.alloc(128);\n const read = readSync(handle, prefix, 0, prefix.length, 0);\n declared = languageOfShebang(prefix.subarray(0, read).toString('utf-8').split('\\n', 1)[0] ?? '');\n if (!declared) return;\n }\n\n text = readFileSync(handle, 'utf-8');\n } catch {\n unreadable.push(relativePath);\n return;\n } finally {\n try {\n closeSync(handle);\n } catch {\n /* the descriptor is going away regardless */\n }\n }\n\n filesScanned += 1;\n options.onFile?.(relativePath);\n suppressed += collectSuppressions(text.split('\\n')).count;\n\n // Observed before the per-file rules run, and unconditionally: the audit\n // keeps four booleans, so the cost of always collecting is nil, and\n // gating it on the option would make the evidence depend on flag order.\n controls.observe(relativePath, text);\n\n const fileFindings = [\n ...scanText(relativePath, text, declared ?? languageOf(filename)),\n ...(isManifest ? scanManifest(relativePath, filename, text) : []),\n ];\n\n findings.push(...fileFindings);\n recordSensitiveFile(filename, relativePath, findings, fileFindings);\n };\n\n const walk = (currentPath: string): void => {\n let entries;\n try {\n entries = readdirSync(currentPath, { withFileTypes: true });\n } catch {\n unreadable.push(toRelative(walkRoot, currentPath));\n return;\n }\n\n for (const entry of entries) {\n const fullPath = join(currentPath, entry.name);\n const relativePath = toRelative(walkRoot, fullPath);\n\n if (entry.isDirectory()) {\n if (SKIP_DIRS.has(entry.name)) continue;\n // A directory match prunes the whole subtree and counts once, rather\n // than descending it to skip each file — the point is not to read it.\n if (isExcluded(relativePath)) {\n excluded += 1;\n continue;\n }\n walk(fullPath);\n continue;\n }\n if (!entry.isFile()) continue;\n if (isExcluded(relativePath)) {\n excluded += 1;\n continue;\n }\n\n scanFile(fullPath, entry.name);\n }\n };\n\n if (rootIsDirectory) {\n walk(targetPath);\n } else if (isExcluded(toRelative(walkRoot, targetPath))) {\n excluded += 1;\n } else {\n scanFile(targetPath, basename(targetPath));\n }\n\n // After the walk, because the question is \"anywhere in this tree\" and only\n // the last file can settle it.\n if (options.missingControls) findings.push(...controls.findings());\n\n const filtered = allowed ? findings.filter((f) => allowed.has(f.category)) : findings;\n filtered.sort(\n (a, b) =>\n severityRank(b.severity) - severityRank(a.severity) ||\n a.file.localeCompare(b.file) ||\n a.line - b.line,\n );\n\n return { findings: filtered, filesScanned, unreadable, suppressed, excluded, root: walkRoot };\n}\n\n/**\n * Report a file whose *name* is the finding — but only when its contents\n * produced nothing.\n *\n * A `.env` full of detected credentials does not also need \"this is a .env\n * file\" stapled to line 1. The filename finding exists for the case the\n * content rules cannot cover: an env file whose values are shapes no vendor\n * rule matches, which is still an env file that should not be committed.\n */\nfunction recordSensitiveFile(\n filename: string,\n relativePath: string,\n sink: ScanFinding[],\n fileFindings: readonly ScanFinding[],\n): void {\n if (fileFindings.length > 0) return;\n\n for (const sensitive of SENSITIVE_FILES) {\n const matches = filename === sensitive.pattern || filename.endsWith(sensitive.pattern);\n if (!matches) continue;\n sink.push({\n ruleId: 'sensitive-file-committed',\n title: 'Sensitive file',\n file: relativePath,\n line: 1,\n severity: sensitive.severity,\n confidence: 'evidence',\n message: sensitive.message,\n consequence: 'Anything in this file is in every clone, fork and CI cache of the repository.',\n cwe: 'CWE-538',\n excerpt: '',\n sensitive: true,\n category: 'file',\n });\n return;\n }\n}\n\nfunction toRelative(base: string, target: string): string {\n const rel = relative(base, target);\n return (rel === '' ? target : rel).split(sep).join('/');\n}\n","/**\n * Dependency advisory lookup against OSV.dev (PRD 06).\n *\n * Split out of `commands/scan.ts` unchanged in behaviour. It is the only part\n * of a scan that makes network calls, and that difference is worth a module\n * boundary: the pattern rules are deterministic and fast, this is neither, and\n * CI wants to choose. `runScan` keeps calling it (the daemon has always\n * included advisories); the CLI asks for it with `--deps`.\n *\n * The lockfile list and the parser used to disagree. `pnpm-lock.yaml`,\n * `yarn.lock` and `Pipfile.lock` were listed as supported, matched by\n * filename, and then fell through a parser that only implemented\n * `package-lock.json` and `requirements.txt` — so they resolved to zero\n * dependencies and the scan reported nothing. Not \"could not parse this\n * lockfile\": nothing, which reads exactly like a clean result. A pnpm\n * repository (this one included) got a dependency scan that never asked OSV a\n * single question.\n *\n * So every entry in `LOCKFILES` now names the function that parses it. Adding\n * a filename without a parser is a type error rather than a silent hole.\n */\n\nimport { existsSync, readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport type { ScanFinding, Severity } from '../types';\n\ninterface OsvVulnerability {\n id: string;\n summary?: string;\n details?: string;\n severity?: Array<{ type: string; score: string }>;\n}\n\nexport interface LockedDependency {\n name: string;\n version: string;\n}\n\ntype LockfileParser = (content: string) => LockedDependency[];\n\ninterface LockfileSupport {\n file: string;\n ecosystem: string;\n parse: LockfileParser;\n}\n\n/** Cap per lockfile, so a first run on a neglected tree summarises rather than floods OSV. */\nconst MAX_DEPS_PER_LOCKFILE = 50;\n\nexport async function scanDependencies(targetPath: string): Promise<ScanFinding[]> {\n const findings: ScanFinding[] = [];\n\n for (const { file, ecosystem, parse } of LOCKFILES) {\n const lockPath = join(targetPath, file);\n if (!existsSync(lockPath)) continue;\n\n let deps: LockedDependency[];\n try {\n deps = dedupe(parse(readFileSync(lockPath, 'utf-8')));\n } catch {\n continue;\n }\n\n // A lockfile that parsed to nothing is a parser problem, not an empty\n // project — real lockfiles have entries. Say so rather than moving on,\n // because the alternative is a scan that reports clean without asking.\n if (deps.length === 0) {\n findings.push(incompleteFinding(file, 'No dependencies could be read from this lockfile.'));\n continue;\n }\n\n if (deps.length > MAX_DEPS_PER_LOCKFILE) {\n findings.push(\n incompleteFinding(\n file,\n `Only the first ${MAX_DEPS_PER_LOCKFILE} of ${deps.length} locked packages were checked against OSV.`,\n ),\n );\n }\n\n for (const dep of deps.slice(0, MAX_DEPS_PER_LOCKFILE)) {\n let vulns: OsvVulnerability[];\n try {\n vulns = await queryOsv(dep.name, dep.version, ecosystem);\n } catch {\n continue;\n }\n\n for (const vuln of vulns) {\n const cvss = vuln.severity?.find((entry) => entry.type === 'CVSS_V3')?.score;\n findings.push({\n ruleId: 'dependency-known-vulnerability',\n title: 'Dependency CVE',\n file,\n line: 1,\n severity: severityFromCvss(cvss),\n confidence: 'evidence',\n message: `${dep.name}@${dep.version}: ${vuln.summary ?? vuln.id}`,\n consequence: 'A published advisory exists for the exact version resolved in this lockfile.',\n excerpt: `${vuln.id}${cvss ? ` (CVSS: ${cvss})` : ''}`,\n category: 'dependency',\n });\n }\n }\n }\n\n return findings;\n}\n\n/**\n * Coverage the operator did not get. Low severity because nothing dangerous\n * has been found; the point is that the absence of findings for this file\n * carries no information, and a clean report should not imply otherwise.\n */\nfunction incompleteFinding(file: string, message: string): ScanFinding {\n return {\n ruleId: 'dependency-scan-incomplete',\n title: 'Dependency scan incomplete',\n file,\n line: 1,\n severity: 'low',\n confidence: 'evidence',\n message,\n consequence: 'Advisories affecting the unchecked packages would not appear in this report.',\n excerpt: file,\n category: 'dependency',\n };\n}\n\nfunction severityFromCvss(score: string | undefined): Severity {\n if (!score) return 'medium';\n const value = Number.parseFloat(score);\n if (Number.isNaN(value)) return 'medium';\n if (value >= 9) return 'critical';\n if (value >= 7) return 'high';\n if (value >= 4) return 'medium';\n return 'low';\n}\n\n/**\n * One query per distinct name@version. Lockfiles repeat a package once per\n * dependent, and a 900-line `yarn.lock` can resolve to a few hundred unique\n * packages — the duplicates would spend the per-file cap on questions already\n * asked.\n */\nfunction dedupe(deps: LockedDependency[]): LockedDependency[] {\n const seen = new Set<string>();\n const unique: LockedDependency[] = [];\n for (const dep of deps) {\n const key = `${dep.name}@${dep.version}`;\n if (seen.has(key)) continue;\n seen.add(key);\n unique.push(dep);\n }\n return unique;\n}\n\n/**\n * Split `name@version` where the name may itself begin with `@`.\n *\n * `@babel/core@7.24.7` has two `@`, and only the last one separates. Anything\n * without a separating `@` is a spec this parser does not understand, and is\n * dropped rather than guessed at.\n */\nfunction splitNameVersion(spec: string): LockedDependency | null {\n const at = spec.lastIndexOf('@');\n if (at <= 0) return null;\n const name = spec.slice(0, at);\n const version = spec.slice(at + 1);\n if (!name || !version) return null;\n return { name, version };\n}\n\n/**\n * A resolved version, or null if the string is a range, a tag or a URL.\n *\n * OSV answers questions about exact versions. `^7.0.0`, `next` and\n * `github:owner/repo` are not versions, and sending them produces a confident\n * empty answer — the worst possible result, because it looks like \"no known\n * advisories\".\n */\nfunction exactVersion(raw: string): string | null {\n const version = raw.trim().replace(/^[=v]+/, '');\n return /^[0-9][0-9a-zA-Z.+-]*$/.test(version) ? version : null;\n}\n\nfunction parsePackageLock(content: string): LockedDependency[] {\n const lock = JSON.parse(content) as {\n packages?: Record<string, { version?: string }>;\n dependencies?: Record<string, { version?: string }>;\n };\n const packages = lock.packages ?? lock.dependencies ?? {};\n const deps: LockedDependency[] = [];\n for (const [key, value] of Object.entries(packages)) {\n // v2+ keys are paths (`node_modules/a/node_modules/b`); the package is the\n // last segment, not the whole path.\n const name = key.replace(/^.*node_modules\\//, '');\n const version = value?.version;\n if (name && version && !name.startsWith('.')) deps.push({ name, version });\n }\n return deps;\n}\n\n/**\n * pnpm writes its resolved tree as keys under `packages:`, and has changed the\n * shape of those keys three times:\n *\n * v5 `/@babel/core/7.24.7:`\n * v6 `/@babel/core@7.24.7:`\n * v9 `'@babel/core@7.24.7':`\n *\n * All three are handled by normalising the key rather than by detecting the\n * lockfile version, because a scanner that recognises only the version it was\n * written against fails silently on the next one — which is the failure this\n * file exists to fix.\n *\n * Peer-dependency suffixes (`(react@18.3.1)`, `_react@17.0.2`) are stripped:\n * they describe the resolution context, not the package.\n */\nfunction parsePnpmLock(content: string): LockedDependency[] {\n const deps: LockedDependency[] = [];\n let inPackages = false;\n\n for (const line of content.split('\\n')) {\n if (/^[a-zA-Z]/.test(line)) {\n inPackages = line.startsWith('packages:');\n continue;\n }\n if (!inPackages) continue;\n\n // Entries sit exactly one level in. Deeper lines are the entry's fields.\n const match = /^ {2}(?! )(.+):\\s*$/.exec(line);\n if (!match?.[1]) continue;\n\n let key = match[1].trim().replace(/^['\"]|['\"]$/g, '');\n key = key.replace(/^\\//, '');\n // Parentheses cannot occur in a package name, so the v6/v9 peer suffix can\n // be cut from the whole key.\n key = key.replace(/\\(.*$/, '');\n\n // v5 separated the version with a slash. It is split here rather than\n // rewritten into the `@` form, because a v5 peer suffix (`_react@17.0.2`)\n // contains an `@` of its own and would capture the generic splitter.\n let name: string;\n let rawVersion: string;\n const slashed = /^(@?[^@]+)\\/([0-9][^/]*)$/.exec(key);\n if (slashed?.[1] && slashed[2]) {\n name = slashed[1];\n rawVersion = slashed[2];\n } else {\n const dep = splitNameVersion(key);\n if (!dep) continue;\n name = dep.name;\n rawVersion = dep.version;\n }\n\n // The v5 peer suffix is an underscore, which *is* legal in a package name\n // — so it is only ever stripped from the version, never from the name.\n const version = exactVersion(rawVersion.replace(/_.*$/, ''));\n if (version) deps.push({ name, version });\n }\n\n return deps;\n}\n\n/**\n * Both yarn dialects, which differ in punctuation rather than structure:\n *\n * v1 `\"@babel/core@^7.0.0\":` then ` version \"7.24.7\"`\n * berry `\"@babel/core@npm:^7.0.0\":` then ` version: 7.24.7`\n *\n * The header carries the name and the indented `version` carries the truth, so\n * the parser holds the last header and waits.\n */\nfunction parseYarnLock(content: string): LockedDependency[] {\n const deps: LockedDependency[] = [];\n let pendingName: string | null = null;\n\n for (const line of content.split('\\n')) {\n if (line.startsWith('#') || line.trim() === '') continue;\n\n if (!/^\\s/.test(line)) {\n pendingName = null;\n const header = line.replace(/:\\s*$/, '');\n // Multiple specs share one entry; they name the same package, so the\n // first is enough.\n const first = header.split(',')[0]?.trim().replace(/^['\"]|['\"]$/g, '');\n if (!first) continue;\n // `__metadata:` and other berry bookkeeping blocks are not packages.\n if (!first.includes('@') || first === '__metadata') continue;\n // Anything resolved by a non-registry protocol is local to this\n // checkout — the workspace root resolves to `0.0.0-use.local`, which is\n // a well-formed version of a package no registry has ever heard of.\n // Asking OSV about it spends the per-file cap on a guaranteed miss.\n if (/@(?:workspace|file|link|portal|exec|patch):/.test(first)) continue;\n const dep = splitNameVersion(first.replace(/@npm:/, '@'));\n if (dep) pendingName = dep.name;\n continue;\n }\n\n if (!pendingName) continue;\n const version = /^\\s+version:?\\s+[\"']?([^\"'\\s]+)[\"']?\\s*$/.exec(line);\n if (!version?.[1]) continue;\n const exact = exactVersion(version[1]);\n if (exact) deps.push({ name: pendingName, version: exact });\n pendingName = null;\n }\n\n return deps;\n}\n\n/** Pipenv's lockfile is JSON, with versions written as the `==x.y.z` specifier. */\nfunction parsePipfileLock(content: string): LockedDependency[] {\n const lock = JSON.parse(content) as Record<string, Record<string, { version?: string }>>;\n const deps: LockedDependency[] = [];\n\n for (const section of ['default', 'develop']) {\n const packages = lock[section];\n if (!packages || typeof packages !== 'object') continue;\n for (const [name, value] of Object.entries(packages)) {\n // VCS and file entries carry a ref instead of a version. There is no\n // version to ask OSV about, so they are skipped.\n const version = exactVersion(String(value?.version ?? '').replace(/^==/, ''));\n if (name && version) deps.push({ name, version });\n }\n }\n\n return deps;\n}\n\n/**\n * Only `==` pins are usable. A range gives OSV nothing to answer against, and\n * the previous `([0-9.]+)` version pattern also silently dropped every\n * pre-release and post-release pin PEP 440 allows (`2.0.0rc1`, `1.4.post1`),\n * which are ordinary in pinned production requirements.\n */\nfunction parseRequirementsTxt(content: string): LockedDependency[] {\n const deps: LockedDependency[] = [];\n\n for (const raw of content.split('\\n')) {\n // Environment markers and comments both describe the pin rather than\n // being part of it.\n const line = raw.split('#')[0]?.split(';')[0]?.trim();\n if (!line || line.startsWith('-')) continue;\n\n const match = /^([a-zA-Z0-9._-]+)\\s*(?:\\[[^\\]]*\\])?\\s*==\\s*([^\\s,]+)/.exec(line);\n if (!match?.[1] || !match[2]) continue;\n // A wildcard pin (`==1.4.*`) is a range wearing an equals sign.\n const version = exactVersion(match[2]);\n if (version) deps.push({ name: match[1], version });\n }\n\n return deps;\n}\n\nconst LOCKFILES: readonly LockfileSupport[] = [\n { file: 'package-lock.json', ecosystem: 'npm', parse: parsePackageLock },\n { file: 'pnpm-lock.yaml', ecosystem: 'npm', parse: parsePnpmLock },\n { file: 'yarn.lock', ecosystem: 'npm', parse: parseYarnLock },\n { file: 'requirements.txt', ecosystem: 'PyPI', parse: parseRequirementsTxt },\n { file: 'Pipfile.lock', ecosystem: 'PyPI', parse: parsePipfileLock },\n];\n\n/** Exposed so the parsers can be tested without a network or a fixture tree. */\nexport const LOCKFILE_PARSERS: Readonly<Record<string, LockfileParser>> = Object.fromEntries(\n LOCKFILES.map((entry) => [entry.file, entry.parse]),\n);\n\n/** Package names and versions are validated before they reach the query body. */\nfunction isValidPackageName(name: string): boolean {\n return /^[@a-zA-Z0-9_.\\-/]{1,214}$/.test(name);\n}\n\nfunction isValidVersion(version: string): boolean {\n return /^[0-9a-zA-Z._\\-+]{1,50}$/.test(version);\n}\n\nasync function queryOsv(name: string, version: string, ecosystem: string): Promise<OsvVulnerability[]> {\n if (!isValidPackageName(name) || !isValidVersion(version)) return [];\n\n try {\n const response = await fetch('https://api.osv.dev/v1/query', {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ package: { name, ecosystem }, version }),\n signal: AbortSignal.timeout(5000),\n });\n if (!response.ok) return [];\n const data = (await response.json()) as { vulns?: OsvVulnerability[] };\n return data.vulns ?? [];\n } catch {\n return [];\n }\n}\n","/**\n * SARIF 2.1.0 output.\n *\n * Why native, rather than converting the CLI's terminal output: a text parser\n * sitting between a scanner and its consumer fails in the one way that matters\n * — silently. `profullstack/malware-test-prs` documents three separate bugs its\n * `threatcrush-to-sarif.py` hit, and one of them (paths relative to the scan\n * root, unprefixed) made a working scan report a 0% true-positive rate. The\n * scan was fine. The pipe was lying.\n *\n * Emitting SARIF from the process that found the finding removes that class of\n * failure. It also makes the output portable: GitHub's Security tab, the\n * testbed's coverage validator, and any other SARIF consumer read the same\n * bytes, and none of them has to know what a ThreatCrush terminal line looks\n * like.\n *\n * Two details the spec is strict about and consumers are not forgiving about:\n *\n * - `startLine` must be >= 1. Whole-file findings carry no line, so they are\n * clamped rather than emitted as 0, which fails schema validation.\n * - `artifactLocation.uri` must be relative to something the consumer can\n * resolve. Absolute paths from a CI runner (`/home/runner/work/…`) match\n * nothing in the repository view, so every finding lands \"outside\" whatever\n * the consumer was scoping to.\n */\n\nimport { createHash } from 'node:crypto';\nimport { isAbsolute, relative, resolve, sep } from 'node:path';\nimport type { ScanFinding, Severity } from '../types';\n\n/**\n * The key our fingerprint is published under.\n *\n * Deliberately *not* `primaryLocationLineHash`. That name is reserved: the\n * CodeQL upload action computes its own value for it and logs\n *\n * Calculated fingerprint of 13bfd14c5cc763c:1 for file debtap line 104,\n * but found existing inconsistent fingerprint value <ours>\n *\n * for every finding whose value differs from what it derived — which is any\n * value we supply, whatever it contains. The first attempt at this replaced\n * the old `ruleId:file:line` with a content hash and still logged the warning,\n * because the collision is over the *key*, not the format.\n *\n * Namespacing it leaves GitHub to compute the fingerprint it wants while other\n * SARIF consumers keep a stable identity from us. The version suffix is there\n * so the hash input can change later without silently redefining what an\n * existing value meant.\n */\nconst FINGERPRINT_KEY = 'threatcrush/contentHash/v1';\n\n/**\n * A stable identity for a finding, for `partialFingerprints`.\n *\n * The line number is deliberately not part of it. It used to be — the value\n * was `ruleId:file:line` — which meant adding an import at the top of a file\n * re-fingerprinted every finding below it. A consumer that tracks findings by\n * fingerprint then treats them as new: previously dismissed ones come back,\n * and review comments detach from the code they were written about. Hashing\n * the rule, the file and the matched text instead keeps one finding identified\n * as one finding while it moves around the file.\n *\n * Whitespace is normalised so reindentation does not count as a new finding.\n * Two identical lines in one file collide onto one fingerprint, which is the\n * right trade: they are the same defect, and SARIF locations still tell them\n * apart.\n */\nexport function fingerprintOf(finding: ScanFinding): string {\n const content = finding.excerpt.replace(/\\s+/g, ' ').trim();\n return createHash('sha256')\n .update(`${finding.ruleId}\\n${finding.file}\\n${content}`)\n .digest('hex')\n .slice(0, 32);\n}\n\nexport const SARIF_VERSION = '2.1.0';\nexport const SARIF_SCHEMA =\n 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json';\n\nexport type SarifLevel = 'error' | 'warning' | 'note' | 'none';\n\n/**\n * SARIF has three levels; ThreatCrush has five severities. The mapping is\n * lossy in the direction that matters least — the exact severity survives in\n * `properties.severity` and in `security-severity`, which is what GitHub's\n * Security tab actually sorts on.\n */\nexport function sarifLevel(severity: Severity): SarifLevel {\n switch (severity) {\n case 'critical':\n case 'high':\n return 'error';\n case 'medium':\n return 'warning';\n case 'low':\n return 'note';\n default:\n return 'none';\n }\n}\n\n/** GitHub reads this to place a finding on its own severity scale. */\nexport function securitySeverity(severity: Severity): string {\n switch (severity) {\n case 'critical':\n return '9.0';\n case 'high':\n return '7.0';\n case 'medium':\n return '5.0';\n case 'low':\n return '3.0';\n default:\n return '1.0';\n }\n}\n\n/**\n * Turn a finding's path into a SARIF artifact URI.\n *\n * Findings carry paths relative to the *scan root*; consumers resolve URIs\n * against the *repository root*. Those are the same directory only when the\n * scan target is `.`, and the difference is silent — `secrets/x.env` matches\n * nothing in a repository that holds `vulns/secrets/x.env`, so a working scan\n * reports every finding as out-of-scope. `root` closes that gap by\n * reconstructing the absolute path before making it relative to `base`.\n *\n * Files outside `base` keep an absolute POSIX path rather than acquiring a run\n * of `../` segments no consumer resolves usefully.\n */\nexport function toArtifactUri(\n filePath: string,\n base: string,\n prefix = '',\n root = base,\n): string {\n const absolute = isAbsolute(filePath) ? filePath : resolve(root, filePath);\n const relativePath = relative(base, absolute);\n const escapedOut = relativePath.startsWith('..') || relativePath === '';\n const chosen = escapedOut ? absolute : relativePath;\n const posix = chosen.split(sep).join('/').replace(/^\\.\\//, '');\n if (!prefix || escapedOut) return posix;\n const trimmed = prefix.replace(/^\\/+|\\/+$/g, '');\n return trimmed ? `${trimmed}/${posix}` : posix;\n}\n\nexport interface SarifOptions {\n /** Version string reported as the tool's. */\n toolVersion: string;\n /**\n * Prepended to every relative URI. Covers the one case `root` cannot: a\n * scan run from *inside* the directory it is scanning, where the repository\n * root is not an ancestor of the working directory in any way the process\n * can observe.\n */\n pathPrefix?: string;\n /** Absolute path the URIs are made relative to. Defaults to `process.cwd()`. */\n base?: string;\n /** Absolute scan root that finding paths are relative to. Defaults to `base`. */\n root?: string;\n}\n\ninterface SarifRule {\n id: string;\n name: string;\n shortDescription: { text: string };\n fullDescription: { text: string };\n help: { text: string; markdown: string };\n defaultConfiguration: { level: SarifLevel };\n properties: {\n tags: string[];\n 'security-severity': string;\n precision: string;\n };\n}\n\n/**\n * Build a complete SARIF log.\n *\n * Always returns a valid run, including for zero findings — an empty `results`\n * array is a meaningful statement (\"looked, found nothing\") and consumers\n * distinguish it from a missing file.\n */\nexport function buildSarif(findings: readonly ScanFinding[], options: SarifOptions): unknown {\n const rules = new Map<string, SarifRule>();\n\n for (const finding of findings) {\n if (rules.has(finding.ruleId)) continue;\n const tags = ['security'];\n if (finding.cwe) tags.push(`external/cwe/${finding.cwe.toLowerCase()}`);\n tags.push(`threatcrush/${finding.category}`);\n\n const description = finding.consequence\n ? `${finding.title}. ${finding.consequence}`\n : finding.title;\n\n rules.set(finding.ruleId, {\n id: finding.ruleId,\n name: finding.ruleId,\n shortDescription: { text: finding.title },\n fullDescription: { text: description },\n help: {\n text: description,\n markdown: finding.consequence\n ? `**${finding.title}**\\n\\n${finding.consequence}`\n : `**${finding.title}**`,\n },\n defaultConfiguration: { level: sarifLevel(finding.severity) },\n properties: {\n tags,\n 'security-severity': securitySeverity(finding.severity),\n // SARIF's vocabulary for how much the rule is claiming. It lines up\n // with the confidence model: a bare construct match is `medium`, a\n // match with visible untrusted input is `high`.\n precision: finding.confidence === 'pattern' ? 'medium' : 'high',\n },\n });\n }\n\n const base = options.base ?? process.cwd();\n const root = options.root ?? base;\n\n const results = findings.map((finding) => ({\n ruleId: finding.ruleId,\n level: sarifLevel(finding.severity),\n message: { text: finding.message },\n locations: [\n {\n physicalLocation: {\n artifactLocation: {\n uri: toArtifactUri(finding.file, base, options.pathPrefix, root),\n uriBaseId: '%SRCROOT%',\n },\n region: {\n // Clamped, never 0. A whole-file finding has no line; SARIF has no\n // way to say that, and 0 fails validation outright.\n startLine: Math.max(1, finding.line),\n snippet: { text: finding.excerpt },\n },\n },\n },\n ],\n partialFingerprints: {\n [FINGERPRINT_KEY]: fingerprintOf(finding),\n },\n properties: {\n severity: finding.severity,\n confidence: finding.confidence,\n category: finding.category,\n ...(finding.cwe ? { cwe: finding.cwe } : {}),\n },\n }));\n\n return {\n $schema: SARIF_SCHEMA,\n version: SARIF_VERSION,\n runs: [\n {\n tool: {\n driver: {\n name: 'ThreatCrush',\n version: options.toolVersion,\n informationUri: 'https://threatcrush.com',\n rules: [...rules.values()],\n },\n },\n results,\n columnKind: 'utf16CodeUnits',\n },\n ],\n };\n}\n","import { execSync } from 'node:child_process';\nimport chalk from 'chalk';\nimport ora from 'ora';\nimport { banner, logger } from '../core/logger.js';\nimport type { RunResult, StructuredFinding } from '../core/run-result.js';\nimport { summarize } from '../core/run-result.js';\n\ninterface PentestResult {\n url: string;\n type: string;\n severity: 'low' | 'medium' | 'high' | 'critical';\n message: string;\n details?: string;\n}\n\n// Basic vulnerability tests\nconst PENTEST_CHECKS = [\n {\n name: 'XSS Reflected',\n test: (html: string) => /<script>alert\\(1\\)<\\/script>|<img\\s+src=x\\s+onerror=alert/i.test(html),\n severity: 'critical' as const,\n message: 'Reflected XSS payload rendered in response',\n },\n {\n name: 'Open Redirect',\n test: (url: string, body: string) => body.includes('location.href') || body.includes('window.location'),\n severity: 'medium' as const,\n message: 'Potential open redirect detected',\n },\n {\n name: 'Missing Security Headers',\n test: (_url: string, _body: string, headers: Record<string, string>) => {\n const required = ['x-content-type-options', 'x-frame-options', 'strict-transport-security'];\n const missing = required.filter(h => !headers[h.toLowerCase()]);\n return missing.length > 2;\n },\n severity: 'low' as const,\n message: 'Missing critical security headers (X-Content-Type-Options, X-Frame-Options, HSTS)',\n },\n {\n name: 'Server Version Disclosure',\n test: (_url: string, _body: string, headers: Record<string, string>) => {\n return !!(headers['server'] && /apache|nginx|iis|tomcat/i.test(headers['server']));\n },\n severity: 'low' as const,\n message: 'Server version disclosed in response header',\n },\n {\n name: 'Directory Listing',\n test: (html: string) => /Index of\\s*\\/|<title>Directory Listing/i.test(html),\n severity: 'medium' as const,\n message: 'Directory listing enabled',\n },\n {\n name: 'Error Page Information Disclosure',\n test: (html: string) => /stack trace|traceback|exception|at\\s+\\w+\\.\\w+\\(/i.test(html),\n severity: 'medium' as const,\n message: 'Error page reveals internal information',\n },\n // PRD 07: Additional checks\n {\n name: 'CORS Misconfiguration',\n test: (_url: string, _body: string, headers: Record<string, string>) => {\n const acao = headers['access-control-allow-origin'];\n return acao === '*' || acao === 'null';\n },\n severity: 'medium' as const,\n message: 'CORS allows any origin (Access-Control-Allow-Origin: *)',\n },\n {\n name: 'Cookie Security',\n test: (_url: string, _body: string, headers: Record<string, string>) => {\n const setCookie = headers['set-cookie'] || '';\n return setCookie.length > 0 && (!setCookie.includes('HttpOnly') || !setCookie.includes('Secure'));\n },\n severity: 'medium' as const,\n message: 'Cookies missing HttpOnly or Secure flags',\n },\n {\n name: 'Content Security Policy',\n test: (_url: string, _body: string, headers: Record<string, string>) => {\n return !headers['content-security-policy'];\n },\n severity: 'low' as const,\n message: 'No Content-Security-Policy header set',\n },\n {\n name: 'Sensitive Path Exposure',\n test: (html: string) => /\\.env|wp-admin|phpinfo|\\.git\\/config|server-status/i.test(html),\n severity: 'high' as const,\n message: 'Response references sensitive paths or admin endpoints',\n },\n];\n\nexport async function runPentest(rawUrl: string): Promise<RunResult> {\n const targetUrl = rawUrl.startsWith('http') ? rawUrl : `https://${rawUrl}`;\n const results = await collectPentestResults(targetUrl);\n const structured: StructuredFinding[] = results.map((r) => ({\n type: r.type,\n severity: r.severity === 'low' ? 'low' : (r.severity as StructuredFinding['severity']),\n message: r.message,\n location: r.url,\n details: r.details ? { detail: r.details } : undefined,\n }));\n const counts = summarize(structured);\n return {\n type: 'pentest',\n target: targetUrl,\n findings: structured,\n severity_summary: counts,\n summary: structured.length === 0\n ? 'No vulnerabilities detected'\n : `${structured.length} issue(s): ${counts.critical}C ${counts.high}H ${counts.medium}M ${counts.low}L`,\n };\n}\n\nasync function collectPentestResults(targetUrl: string): Promise<PentestResult[]> {\n const results: PentestResult[] = [];\n try {\n const resp = await fetch(targetUrl, { redirect: 'manual' });\n const headers: Record<string, string> = {};\n resp.headers.forEach((v, k) => { headers[k] = v; });\n const body = await resp.text();\n for (const check of PENTEST_CHECKS) {\n try {\n if (check.test(body, body, headers)) {\n results.push({ url: targetUrl, type: check.name, severity: check.severity, message: check.message });\n }\n } catch { /* skip */ }\n }\n } catch {\n return results;\n }\n\n const sqliPayloads = [\"' OR 1=1--\", \"1' UNION SELECT NULL--\", \"' AND '1'='1\"];\n for (const payload of sqliPayloads) {\n try {\n const testUrl = `${targetUrl}?id=${encodeURIComponent(payload)}`;\n const resp = await fetch(testUrl, { redirect: 'manual', signal: AbortSignal.timeout(5000) });\n const body = await resp.text();\n if (/sql\\s+(syntax|error|exception)|mysql|postgres|ORA-\\d+/i.test(body)) {\n results.push({ url: testUrl, type: 'SQL Injection', severity: 'critical', message: `SQL error with payload: ${payload}` });\n }\n } catch { /* skip */ }\n }\n\n const traversalPaths = ['../../etc/passwd', '..%2F..%2Fetc%2Fpasswd', '....//....//etc/passwd'];\n for (const path of traversalPaths) {\n try {\n const testUrl = `${targetUrl}/${path}`;\n const resp = await fetch(testUrl, { redirect: 'manual', signal: AbortSignal.timeout(5000) });\n const body = await resp.text();\n if (/root:.*:0:0:|daemon:.*:1:1:|nobody:.*:65534/i.test(body)) {\n results.push({ url: testUrl, type: 'Path Traversal', severity: 'critical', message: `Possible /etc/passwd disclosure: ${path}` });\n }\n } catch { /* skip */ }\n }\n\n const methods = ['OPTIONS', 'TRACE', 'DELETE', 'PUT'];\n for (const method of methods) {\n try {\n const resp = await fetch(targetUrl, { method, signal: AbortSignal.timeout(5000) });\n if (resp.status < 400 && method !== 'OPTIONS') {\n results.push({ url: targetUrl, type: `Unsafe HTTP Method: ${method}`, severity: 'medium', message: `${method} allowed (status ${resp.status})` });\n }\n if (method === 'OPTIONS') {\n const allow = resp.headers.get('allow');\n if (allow && /DELETE|PUT|TRACE/i.test(allow)) {\n results.push({ url: targetUrl, type: 'HTTP Methods', severity: 'low', message: `Allowed methods: ${allow}` });\n }\n }\n } catch { /* skip */ }\n }\n\n return results;\n}\n\nexport async function pentestCommand(targetUrl: string): Promise<RunResult> {\n banner();\n\n // Ensure URL has protocol\n if (!targetUrl.startsWith('http')) {\n targetUrl = `https://${targetUrl}`;\n }\n\n logger.info(`Penetration testing ${chalk.white(targetUrl)}...\\n`);\n\n const results: PentestResult[] = [];\n\n // Test 1: Basic response analysis\n const spinner = ora({ text: 'Fetching target...', color: 'green' }).start();\n try {\n const resp = await fetch(targetUrl, { redirect: 'manual' });\n const headers: Record<string, string> = {};\n resp.headers.forEach((v, k) => { headers[k] = v; });\n const body = await resp.text();\n\n spinner.succeed(`Got ${resp.status} response\\n`);\n\n // Run all checks\n for (const check of PENTEST_CHECKS) {\n try {\n if (check.test(body, body, headers)) {\n results.push({\n url: targetUrl,\n type: check.name,\n severity: check.severity,\n message: check.message,\n });\n }\n } catch {\n // Skip check on error\n }\n }\n } catch (err) {\n spinner.fail(`Failed to reach target: ${(err as Error).message}`);\n console.log(chalk.gray(' Check the URL and try again.\\n'));\n return {\n type: 'pentest',\n target: targetUrl,\n findings: [],\n severity_summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },\n summary: `Failed to reach target: ${(err as Error).message}`,\n error: (err as Error).message,\n };\n }\n\n // Test 2: SQL injection probe\n const sqliSpinner = ora({ text: 'Testing SQL injection vectors...', color: 'green' }).start();\n const sqliPayloads = [\"' OR 1=1--\", \"1' UNION SELECT NULL--\", \"' AND '1'='1\"];\n for (const payload of sqliPayloads) {\n try {\n const testUrl = `${targetUrl}?id=${encodeURIComponent(payload)}`;\n const resp = await fetch(testUrl, { redirect: 'manual', signal: AbortSignal.timeout(5000) });\n const body = await resp.text();\n if (/sql\\s+(syntax|error|exception)|mysql|postgres|ORA-\\d+/i.test(body)) {\n results.push({\n url: testUrl,\n type: 'SQL Injection',\n severity: 'critical',\n message: `SQL error response detected with payload: ${payload}`,\n });\n }\n } catch {\n // Skip on timeout/network error\n }\n }\n sqliSpinner.succeed('SQL injection tests complete\\n');\n\n // Test 3: Path traversal probe\n const pathSpinner = ora({ text: 'Testing path traversal...', color: 'green' }).start();\n const traversalPaths = ['../../etc/passwd', '..%2F..%2Fetc%2Fpasswd', '....//....//etc/passwd'];\n for (const path of traversalPaths) {\n try {\n const testUrl = `${targetUrl}/${path}`;\n const resp = await fetch(testUrl, { redirect: 'manual', signal: AbortSignal.timeout(5000) });\n const body = await resp.text();\n if (/root:.*:0:0:|daemon:.*:1:1:|nobody:.*:65534/i.test(body)) {\n results.push({\n url: testUrl,\n type: 'Path Traversal',\n severity: 'critical',\n message: `Possible /etc/passwd disclosure via: ${path}`,\n });\n }\n } catch {\n // Skip on timeout/network error\n }\n }\n pathSpinner.succeed('Path traversal tests complete\\n');\n\n // Test 4: HTTP methods\n const methodSpinner = ora({ text: 'Testing HTTP methods...', color: 'green' }).start();\n const methods = ['OPTIONS', 'TRACE', 'DELETE', 'PUT'];\n for (const method of methods) {\n try {\n const resp = await fetch(targetUrl, { method, signal: AbortSignal.timeout(5000) });\n if (resp.status < 400 && method !== 'OPTIONS') {\n results.push({\n url: targetUrl,\n type: `Unsafe HTTP Method: ${method}`,\n severity: 'medium',\n message: `${method} method is allowed (status ${resp.status})`,\n });\n }\n if (method === 'OPTIONS') {\n const allow = resp.headers.get('allow');\n if (allow && /DELETE|PUT|TRACE/i.test(allow)) {\n results.push({\n url: targetUrl,\n type: 'HTTP Methods',\n severity: 'low',\n message: `Allowed methods: ${allow}`,\n });\n }\n }\n } catch {\n // Skip on error\n }\n }\n methodSpinner.succeed('HTTP method tests complete\\n');\n\n const structured: StructuredFinding[] = results.map((r) => ({\n type: r.type,\n severity: r.severity as StructuredFinding['severity'],\n message: r.message,\n location: r.url,\n details: r.details ? { detail: r.details } : undefined,\n }));\n const sevCounts = summarize(structured);\n\n // Print results\n if (results.length === 0) {\n console.log(chalk.green.bold(' ✓ No vulnerabilities detected in basic scan!'));\n console.log(chalk.dim(' Note: This is a basic scan. Full pentest requires manual review.\\n'));\n return {\n type: 'pentest',\n target: targetUrl,\n findings: [],\n severity_summary: sevCounts,\n summary: 'No vulnerabilities detected',\n };\n }\n\n const critical = results.filter(r => r.severity === 'critical');\n const high = results.filter(r => r.severity === 'high');\n const medium = results.filter(r => r.severity === 'medium');\n const low = results.filter(r => r.severity === 'low');\n\n console.log(chalk.white.bold(' Penetration Test Results'));\n console.log(chalk.gray(' ' + '─'.repeat(70)));\n console.log(\n ` ${chalk.red.bold(critical.length + ' critical')} ` +\n `${chalk.red(high.length + ' high')} ` +\n `${chalk.yellow(medium.length + ' medium')} ` +\n `${chalk.gray(low.length + ' low')}`,\n );\n console.log(chalk.gray(' ' + '─'.repeat(70)));\n console.log();\n\n const sorted = [...critical, ...high, ...medium, ...low];\n for (const r of sorted) {\n const sev =\n r.severity === 'critical' ? chalk.bgRed.white.bold(` ${r.severity.toUpperCase()} `) :\n r.severity === 'high' ? chalk.red(`[${r.severity.toUpperCase()}]`) :\n r.severity === 'medium' ? chalk.yellow(`[${r.severity.toUpperCase()}]`) :\n chalk.gray(`[${r.severity.toUpperCase()}]`);\n\n console.log(` ${sev} ${chalk.white.bold(r.type)}`);\n console.log(` ${chalk.gray('URL:')} ${chalk.cyan(r.url)}`);\n console.log(` ${chalk.gray('Info:')} ${r.message}`);\n if (r.details) console.log(` ${chalk.gray('Details:')} ${r.details}`);\n console.log();\n }\n\n console.log(chalk.gray(' ' + '─'.repeat(70)));\n console.log(` ${chalk.white.bold(`${results.length} issue(s) found`)}`);\n console.log(chalk.dim(' Note: This is an automated basic scan. Manual review recommended.\\n'));\n\n return {\n type: 'pentest',\n target: targetUrl,\n findings: structured,\n severity_summary: sevCounts,\n summary: `${results.length} issue(s): ${sevCounts.critical}C ${sevCounts.high}H ${sevCounts.medium}M ${sevCounts.low}L`,\n };\n}\n","import type { EventBus } from '../event-bus.js';\nimport { readCliConfig, authHeaders, isLoggedIn } from '../../core/cli-config.js';\nimport { runScan } from '../../commands/scan.js';\nimport { runPentest } from '../../commands/pentest.js';\nimport { workerId, type RunResult } from '../../core/run-result.js';\n\nconst API_URL = process.env.THREATCRUSH_API_URL || 'https://threatcrush.com';\nconst POLL_INTERVAL_MS = 30_000;\nconst SCHEDULE_INTERVAL_MS = 120_000;\n\ninterface ClaimedRun {\n id: string;\n org_id: string;\n property_id: string;\n type: 'scan' | 'pentest';\n property: { id: string; name: string; kind: string; target: string } | null;\n}\n\n/**\n * Polls the server for queued property runs belonging to orgs the logged-in\n * user is a member of, claims them atomically, executes them locally, and\n * posts the result back.\n *\n * No-op unless `~/.threatcrush/config.json` contains a valid bearer token.\n */\nexport class RunsWorker {\n private pollTimer: NodeJS.Timeout | null = null;\n private scheduleTimer: NodeJS.Timeout | null = null;\n private running = false;\n private orgIds: string[] = [];\n\n constructor(private bus: EventBus) {}\n\n async start(): Promise<void> {\n if (!isLoggedIn()) return;\n\n try {\n await this.refreshOrgs();\n } catch {\n // First fetch may fail if the network is down; the tick loop will retry.\n }\n\n this.bus.announceModule('runs-worker', 'running', `poll ${POLL_INTERVAL_MS / 1000}s`);\n this.tick();\n this.scheduleTick();\n this.pollTimer = setInterval(() => this.tick(), POLL_INTERVAL_MS);\n this.scheduleTimer = setInterval(() => this.scheduleTick(), SCHEDULE_INTERVAL_MS);\n }\n\n stop(): void {\n if (this.pollTimer) clearInterval(this.pollTimer);\n if (this.scheduleTimer) clearInterval(this.scheduleTimer);\n this.pollTimer = null;\n this.scheduleTimer = null;\n this.bus.announceModule('runs-worker', 'stopped');\n }\n\n private async scheduleTick(): Promise<void> {\n if (!isLoggedIn()) return;\n try {\n if (this.orgIds.length === 0) await this.refreshOrgs();\n for (const orgId of this.orgIds) {\n try {\n await fetch(`${API_URL}/api/orgs/${orgId}/schedules/tick`, {\n method: 'POST',\n headers: authHeaders(),\n });\n } catch {\n // ignore transient network errors\n }\n }\n } catch {\n // swallow — retry next interval\n }\n }\n\n private async tick(): Promise<void> {\n if (this.running) return;\n if (!isLoggedIn()) return;\n\n this.running = true;\n try {\n if (this.orgIds.length === 0) await this.refreshOrgs();\n for (const orgId of this.orgIds) {\n const claimed = await this.claimOne(orgId);\n if (!claimed) continue;\n\n const result = await this.execute(claimed);\n await this.finalize(orgId, claimed, result);\n }\n } catch {\n // swallow — we'll try again on the next tick\n } finally {\n this.running = false;\n }\n }\n\n private async refreshOrgs(): Promise<void> {\n const res = await fetch(`${API_URL}/api/orgs`, { headers: authHeaders() });\n if (!res.ok) return;\n const data = await res.json() as { organizations?: Array<{ id: string }> };\n this.orgIds = (data.organizations || []).map((o) => o.id);\n }\n\n private async claimOne(orgId: string): Promise<ClaimedRun | null> {\n try {\n const res = await fetch(`${API_URL}/api/orgs/${orgId}/runs/pending`, {\n method: 'POST',\n headers: authHeaders(),\n body: JSON.stringify({ worker_id: workerId() }),\n });\n if (!res.ok) return null;\n const data = await res.json() as { run?: ClaimedRun | null };\n return data.run ?? null;\n } catch {\n return null;\n }\n }\n\n private async execute(run: ClaimedRun): Promise<RunResult> {\n const target = run.property?.target;\n if (!target) {\n return {\n type: run.type,\n target: '',\n findings: [],\n severity_summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },\n summary: 'property target missing',\n error: 'property target missing',\n };\n }\n\n this.bus.announceModule('runs-worker', 'running', `${run.type} ${run.property?.name || target}`);\n\n try {\n if (run.type === 'scan') return await runScan(target);\n return await runPentest(target);\n } catch (err) {\n return {\n type: run.type,\n target,\n findings: [],\n severity_summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },\n summary: `failed: ${(err as Error).message}`,\n error: (err as Error).message,\n };\n }\n }\n\n private async finalize(orgId: string, claimed: ClaimedRun, result: RunResult): Promise<void> {\n try {\n await fetch(\n `${API_URL}/api/orgs/${orgId}/properties/${claimed.property_id}/runs/${claimed.id}`,\n {\n method: 'PATCH',\n headers: authHeaders(),\n body: JSON.stringify({\n status: result.error ? 'failed' : 'succeeded',\n findings_count: result.findings.length,\n severity_summary: result.severity_summary,\n summary: result.summary,\n findings: result.findings,\n error: result.error,\n source: 'daemon',\n worker_id: workerId(),\n }),\n },\n );\n } catch {\n // best-effort\n } finally {\n this.bus.announceModule('runs-worker', 'idle');\n }\n }\n}\n","import type { ThreatEvent, EventSeverity } from '../../types/events.js';\n\nexport interface DetectionRule {\n id: string;\n title: string;\n description: string;\n version: string;\n category: string;\n severity: EventSeverity;\n source_types: string[];\n match: RuleMatch;\n threshold: number;\n window_seconds: number;\n cooldown_seconds: number;\n tags: string[];\n remediation?: {\n action?: string;\n ttl_seconds?: number;\n description?: string;\n };\n enabled: boolean;\n}\n\nexport interface RuleMatch {\n field: string;\n operator: 'contains' | 'regex' | 'equals' | 'starts_with' | 'ends_with';\n value: string;\n and?: RuleMatch[];\n or?: RuleMatch[];\n}\n\ninterface EventWindow {\n events: Array<{ timestamp: number; event: ThreatEvent }>;\n lastAlert: number;\n}\n\nexport class RuleEngine {\n private rules: DetectionRule[] = [];\n private windows = new Map<string, EventWindow>();\n\n constructor(private onDetection: (detection: {\n rule_id: string;\n severity: EventSeverity;\n title: string;\n description: string;\n source_ip?: string;\n username?: string;\n raw_metadata?: Record<string, unknown>;\n }) => void) {}\n\n loadRules(rules: DetectionRule[]): void {\n this.rules = rules.filter(r => r.enabled !== false);\n }\n\n getRules(): DetectionRule[] {\n return [...this.rules];\n }\n\n evaluate(event: ThreatEvent): void {\n const now = Date.now();\n\n for (const rule of this.rules) {\n // Check source type match\n if (rule.source_types.length > 0 && !rule.source_types.includes(event.module) && !rule.source_types.includes(event.category)) {\n continue;\n }\n\n // Check match conditions\n if (!this.matchesCondition(event, rule.match)) continue;\n\n // Window key: rule_id + source_ip (or 'global')\n const windowKey = `${rule.id}:${event.source_ip || 'global'}`;\n let window = this.windows.get(windowKey);\n if (!window) {\n window = { events: [], lastAlert: 0 };\n this.windows.set(windowKey, window);\n }\n\n // Add event to window\n window.events.push({ timestamp: now, event });\n\n // Prune old events outside window\n const cutoff = now - (rule.window_seconds * 1000);\n window.events = window.events.filter(e => e.timestamp >= cutoff);\n\n // Check threshold\n if (window.events.length < rule.threshold) continue;\n\n // Check cooldown\n if (window.lastAlert > 0 && (now - window.lastAlert) < (rule.cooldown_seconds * 1000)) continue;\n\n // Fire detection\n window.lastAlert = now;\n window.events = []; // Reset window after detection\n\n this.onDetection({\n rule_id: rule.id,\n severity: rule.severity,\n title: rule.title,\n description: `${rule.description} (${rule.threshold} events in ${rule.window_seconds}s)`,\n source_ip: event.source_ip,\n username: event.details?.user as string || undefined,\n raw_metadata: {\n rule_version: rule.version,\n tags: rule.tags,\n category: rule.category,\n remediation: rule.remediation,\n },\n });\n }\n }\n\n private matchesCondition(event: ThreatEvent, match: RuleMatch): boolean {\n const fieldValue = this.getFieldValue(event, match.field);\n if (fieldValue === undefined) return false;\n\n const strValue = String(fieldValue);\n let result = false;\n\n switch (match.operator) {\n case 'contains':\n result = strValue.toLowerCase().includes(String(match.value).toLowerCase());\n break;\n case 'regex':\n try { result = new RegExp(String(match.value), 'i').test(strValue); } catch { result = false; }\n break;\n case 'equals':\n result = strValue === String(match.value);\n break;\n case 'starts_with':\n result = strValue.startsWith(String(match.value));\n break;\n case 'ends_with':\n result = strValue.endsWith(String(match.value));\n break;\n }\n\n // AND conditions\n if (result && match.and) {\n result = match.and.every(m => this.matchesCondition(event, m));\n }\n\n // OR conditions\n if (!result && match.or) {\n result = match.or.some(m => this.matchesCondition(event, m));\n }\n\n return result;\n }\n\n private getFieldValue(event: ThreatEvent, field: string): unknown {\n switch (field) {\n case 'message': return event.message;\n case 'severity': return event.severity;\n case 'module': return event.module;\n case 'category': return event.category;\n case 'source_ip': return event.source_ip;\n default:\n return event.details?.[field];\n }\n }\n\n // Periodic cleanup of stale windows\n cleanup(): void {\n const now = Date.now();\n for (const [key, window] of this.windows.entries()) {\n if (window.events.length === 0 && (now - window.lastAlert) > 3600_000) {\n this.windows.delete(key);\n }\n }\n }\n}\n","import { existsSync, readdirSync, readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport type { DetectionRule } from './engine.js';\nimport { DEFAULT_RULES } from './default-rules.js';\n\nconst RULES_DIR = '/etc/threatcrush/rules.d';\n\nexport function loadAllRules(customDir?: string): DetectionRule[] {\n const rules = [...DEFAULT_RULES];\n const dir = customDir || RULES_DIR;\n\n if (existsSync(dir)) {\n const files = readdirSync(dir).filter(f => f.endsWith('.json'));\n for (const file of files) {\n try {\n const raw = readFileSync(join(dir, file), 'utf-8');\n const parsed = JSON.parse(raw);\n const customRules: DetectionRule[] = Array.isArray(parsed) ? parsed : [parsed];\n for (const rule of customRules) {\n if (!rule.id || !rule.title || !rule.match) {\n console.warn(`[rules] skipping invalid rule in ${file}: missing required fields`);\n continue;\n }\n const existingIdx = rules.findIndex(r => r.id === rule.id);\n if (existingIdx >= 0) {\n rules[existingIdx] = { ...rules[existingIdx], ...rule };\n } else {\n rules.push(rule);\n }\n }\n } catch (err) {\n console.warn(`[rules] failed to load ${file}: ${(err as Error).message}`);\n }\n }\n }\n\n return rules;\n}\n","import type { DetectionRule } from './engine.js';\n\nexport const DEFAULT_RULES: DetectionRule[] = [\n {\n id: 'ssh-brute-force',\n title: 'SSH Brute Force Detected',\n description: 'Multiple failed SSH login attempts from the same source',\n version: '1.0.0',\n category: 'auth',\n severity: 'high',\n source_types: ['ssh-guard', 'auth'],\n match: {\n field: 'message',\n operator: 'regex',\n value: 'failed ssh login|invalid ssh user',\n },\n threshold: 5,\n window_seconds: 300,\n cooldown_seconds: 600,\n tags: ['ssh', 'brute-force', 'credential-stuffing'],\n remediation: {\n action: 'block',\n ttl_seconds: 3600,\n description: 'Block source IP for 1 hour',\n },\n enabled: true,\n },\n {\n id: 'ssh-success-after-failures',\n title: 'SSH Login After Failed Attempts',\n description: 'Successful SSH login from an IP that had recent failures',\n version: '1.0.0',\n category: 'auth',\n severity: 'critical',\n source_types: ['ssh-guard', 'auth'],\n match: {\n field: 'message',\n operator: 'contains',\n value: 'SSH login accepted',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['ssh', 'compromise-indicator'],\n enabled: true,\n },\n {\n id: 'ssh-root-login',\n title: 'Root SSH Login Attempt',\n description: 'Direct root login via SSH detected',\n version: '1.0.0',\n category: 'auth',\n severity: 'high',\n source_types: ['ssh-guard', 'auth'],\n match: {\n field: 'message',\n operator: 'regex',\n value: '(failed|accepted).*\\\\broot\\\\b',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['ssh', 'root-access'],\n remediation: {\n action: 'block',\n ttl_seconds: 7200,\n description: 'Block source IP attempting root login',\n },\n enabled: true,\n },\n {\n id: 'ssh-user-enumeration',\n title: 'SSH User Enumeration',\n description: 'Multiple SSH attempts with different usernames from same source',\n version: '1.0.0',\n category: 'auth',\n severity: 'high',\n source_types: ['ssh-guard', 'auth'],\n match: {\n field: 'message',\n operator: 'contains',\n value: 'Invalid SSH user',\n },\n threshold: 3,\n window_seconds: 120,\n cooldown_seconds: 600,\n tags: ['ssh', 'enumeration', 'reconnaissance'],\n remediation: {\n action: 'block',\n ttl_seconds: 3600,\n description: 'Block source IP performing user enumeration',\n },\n enabled: true,\n },\n {\n id: 'sudo-abuse',\n title: 'Sudo Authentication Failure',\n description: 'Repeated sudo authentication failures',\n version: '1.0.0',\n category: 'auth',\n severity: 'high',\n source_types: ['user-journal', 'system'],\n match: {\n field: 'message',\n operator: 'regex',\n value: 'sudo.*authentication failure|sudo.*incorrect password|sudo.*FAILED',\n },\n threshold: 3,\n window_seconds: 300,\n cooldown_seconds: 600,\n tags: ['sudo', 'privilege-escalation'],\n enabled: true,\n },\n {\n id: 'web-sqli-attack',\n title: 'SQL Injection Attack Detected',\n description: 'HTTP request with SQL injection patterns',\n version: '1.0.0',\n category: 'web',\n severity: 'critical',\n source_types: ['log-watcher', 'web'],\n match: {\n field: 'message',\n operator: 'contains',\n value: 'Attack detected [SQLI]',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['web', 'sqli', 'injection'],\n remediation: {\n action: 'block',\n ttl_seconds: 3600,\n description: 'Block source IP performing SQL injection',\n },\n enabled: true,\n },\n {\n id: 'web-path-traversal',\n title: 'Path Traversal Attack Detected',\n description: 'HTTP request with path traversal patterns',\n version: '1.0.0',\n category: 'web',\n severity: 'critical',\n source_types: ['log-watcher', 'web'],\n match: {\n field: 'message',\n operator: 'contains',\n value: 'Attack detected [PATH_TRAVERSAL]',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['web', 'path-traversal', 'lfi'],\n remediation: {\n action: 'block',\n ttl_seconds: 3600,\n description: 'Block source IP performing path traversal',\n },\n enabled: true,\n },\n {\n id: 'web-xss-attack',\n title: 'XSS Attack Detected',\n description: 'HTTP request with cross-site scripting patterns',\n version: '1.0.0',\n category: 'web',\n severity: 'high',\n source_types: ['log-watcher', 'web'],\n match: {\n field: 'message',\n operator: 'regex',\n value: 'Attack detected \\\\[XSS\\\\]',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['web', 'xss', 'injection'],\n remediation: {\n action: 'block',\n ttl_seconds: 3600,\n description: 'Block source IP performing XSS attack',\n },\n enabled: true,\n },\n {\n id: 'web-scanner-detection',\n title: 'Web Vulnerability Scanner Detected',\n description: 'High volume of 4xx errors suggesting automated scanning',\n version: '1.0.0',\n category: 'web',\n severity: 'medium',\n source_types: ['log-watcher', 'web'],\n match: {\n field: 'message',\n operator: 'regex',\n value: 'Client error 4\\\\d{2}:',\n },\n threshold: 20,\n window_seconds: 60,\n cooldown_seconds: 600,\n tags: ['web', 'scanner', 'reconnaissance'],\n remediation: {\n action: 'block',\n ttl_seconds: 1800,\n description: 'Block automated scanner',\n },\n enabled: true,\n },\n {\n id: 'port-scan-indicator',\n title: 'Port Scan Indicators',\n description: 'Connection attempts to many ports from a single source',\n version: '1.0.0',\n category: 'network',\n severity: 'medium',\n source_types: ['network-monitor', 'network'],\n match: {\n field: 'message',\n operator: 'contains',\n value: 'port scan',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['network', 'port-scan', 'reconnaissance'],\n remediation: {\n action: 'block',\n ttl_seconds: 3600,\n description: 'Block port scanner',\n },\n enabled: true,\n },\n {\n id: 'system-critical-error',\n title: 'Critical System Error',\n description: 'Critical or emergency level system log message',\n version: '1.0.0',\n category: 'system',\n severity: 'critical',\n source_types: ['user-journal', 'system'],\n match: {\n field: 'severity',\n operator: 'equals',\n value: 'critical',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['system', 'critical'],\n enabled: true,\n },\n {\n id: 'exploit-probe-pattern',\n title: 'Exploit Probe Pattern',\n description: 'HTTP requests matching common exploit probe patterns',\n version: '1.0.0',\n category: 'web',\n severity: 'high',\n source_types: ['log-watcher', 'web'],\n match: {\n field: 'message',\n operator: 'regex',\n value: 'Attack detected \\\\[(CMD_INJECTION|RCE|SSRF|XXE)\\\\]',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['web', 'exploit', 'probe'],\n remediation: {\n action: 'block',\n ttl_seconds: 7200,\n description: 'Block source IP performing exploit probes',\n },\n enabled: true,\n },\n];\n","import { execSync, spawnSync } from 'node:child_process';\nimport { isIP } from 'node:net';\n\nexport interface FirewallAdapter {\n name: string;\n isAvailable(): boolean;\n block(ip: string): Promise<void>;\n unblock(ip: string): Promise<void>;\n isBlocked(ip: string): Promise<boolean>;\n listBlocked(): Promise<string[]>;\n}\n\nfunction assertValidFirewallIp(ip: string): void {\n if (isIP(ip) !== 4) {\n throw new Error(`Invalid IPv4 address: ${ip}`);\n }\n}\n\nexport class NftablesAdapter implements FirewallAdapter {\n name = 'nftables';\n private table = 'threatcrush';\n private set = 'blocklist';\n\n isAvailable(): boolean {\n const result = spawnSync('nft', ['--version'], { stdio: 'pipe' });\n return result.status === 0;\n }\n\n private ensureSetup(): void {\n try {\n execSync(`nft list table inet ${this.table} 2>/dev/null`, { stdio: 'pipe' });\n } catch {\n execSync(`nft add table inet ${this.table}`);\n execSync(`nft add set inet ${this.table} ${this.set} '{ type ipv4_addr; flags timeout; }'`);\n execSync(`nft add chain inet ${this.table} input '{ type filter hook input priority -1; policy accept; }'`);\n execSync(`nft add rule inet ${this.table} input ip saddr @${this.set} drop`);\n }\n }\n\n async block(ip: string): Promise<void> {\n assertValidFirewallIp(ip);\n this.ensureSetup();\n execSync(`nft add element inet ${this.table} ${this.set} '{ ${ip} }'`);\n }\n\n async unblock(ip: string): Promise<void> {\n assertValidFirewallIp(ip);\n try {\n execSync(`nft delete element inet ${this.table} ${this.set} '{ ${ip} }'`);\n } catch { /* element may not exist */ }\n }\n\n async isBlocked(ip: string): Promise<boolean> {\n assertValidFirewallIp(ip);\n try {\n const output = execSync(`nft list set inet ${this.table} ${this.set}`, { encoding: 'utf-8' });\n return output.includes(ip);\n } catch { return false; }\n }\n\n async listBlocked(): Promise<string[]> {\n try {\n const output = execSync(`nft list set inet ${this.table} ${this.set}`, { encoding: 'utf-8' });\n const match = output.match(/elements\\s*=\\s*\\{([^}]*)\\}/);\n if (!match) return [];\n return match[1].split(',').map(s => s.trim().split(/\\s/)[0]).filter(Boolean);\n } catch { return []; }\n }\n}\n\nexport class IptablesAdapter implements FirewallAdapter {\n name = 'iptables';\n private chain = 'THREATCRUSH';\n\n isAvailable(): boolean {\n const result = spawnSync('iptables', ['--version'], { stdio: 'pipe' });\n return result.status === 0;\n }\n\n private ensureChain(): void {\n try {\n execSync(`iptables -n -L ${this.chain} 2>/dev/null`, { stdio: 'pipe' });\n } catch {\n execSync(`iptables -N ${this.chain}`);\n execSync(`iptables -I INPUT 1 -j ${this.chain}`);\n }\n }\n\n async block(ip: string): Promise<void> {\n assertValidFirewallIp(ip);\n this.ensureChain();\n if (await this.isBlocked(ip)) return;\n execSync(`iptables -A ${this.chain} -s ${ip} -j DROP`);\n }\n\n async unblock(ip: string): Promise<void> {\n assertValidFirewallIp(ip);\n try { execSync(`iptables -D ${this.chain} -s ${ip} -j DROP`); }\n catch { /* rule may not exist */ }\n }\n\n async isBlocked(ip: string): Promise<boolean> {\n assertValidFirewallIp(ip);\n try {\n const output = execSync(`iptables -n -L ${this.chain}`, { encoding: 'utf-8' });\n return output.includes(ip);\n } catch { return false; }\n }\n\n async listBlocked(): Promise<string[]> {\n try {\n const output = execSync(`iptables -n -L ${this.chain}`, { encoding: 'utf-8' });\n const ips: string[] = [];\n for (const line of output.split('\\n')) {\n const match = line.match(/DROP\\s+all\\s+--\\s+(\\d+\\.\\d+\\.\\d+\\.\\d+)/);\n if (match) ips.push(match[1]);\n }\n return ips;\n } catch { return []; }\n }\n}\n\nexport class DryRunAdapter implements FirewallAdapter {\n name = 'dry-run';\n private blocked = new Set<string>();\n\n isAvailable(): boolean { return true; }\n async block(ip: string): Promise<void> { assertValidFirewallIp(ip); this.blocked.add(ip); }\n async unblock(ip: string): Promise<void> { assertValidFirewallIp(ip); this.blocked.delete(ip); }\n async isBlocked(ip: string): Promise<boolean> { assertValidFirewallIp(ip); return this.blocked.has(ip); }\n async listBlocked(): Promise<string[]> { return [...this.blocked]; }\n}\n\nexport function detectFirewallAdapter(): FirewallAdapter {\n const nft = new NftablesAdapter();\n if (nft.isAvailable()) return nft;\n const ipt = new IptablesAdapter();\n if (ipt.isAvailable()) return ipt;\n return new DryRunAdapter();\n}\n","import { appendFileSync } from 'node:fs';\nimport type { FirewallAdapter } from './adapters.js';\nimport type { EventBus } from '../event-bus.js';\nimport { getModuleState, setModuleState } from '../../core/state.js';\nimport { PATHS } from '../paths.js';\nimport type { ThreatEvent } from '../../types/events.js';\n\ninterface BlockEntry {\n ip: string;\n reason: string;\n rule_id?: string;\n blocked_at: number;\n expires_at?: number;\n dry_run: boolean;\n}\n\ninterface RemediationConfig {\n enabled: boolean;\n dry_run: boolean;\n default_ttl_seconds: number;\n min_severity: string;\n allowlist: string[];\n}\n\nconst DEFAULT_CONFIG: RemediationConfig = {\n enabled: true,\n dry_run: true,\n default_ttl_seconds: 3600,\n min_severity: 'high',\n allowlist: ['127.0.0.1', '::1'],\n};\n\nconst SEVERITY_RANK: Record<string, number> = {\n info: 0, low: 1, medium: 2, high: 3, critical: 4,\n};\n\nexport class RemediationManager {\n private config: RemediationConfig;\n private blocklist: BlockEntry[] = [];\n private expiryTimer: NodeJS.Timeout | null = null;\n\n constructor(\n private adapter: FirewallAdapter,\n private bus: EventBus,\n config?: Partial<RemediationConfig>,\n ) {\n this.config = { ...DEFAULT_CONFIG, ...config };\n this.loadState();\n this.startExpiryWorker();\n }\n\n async handleDetection(event: ThreatEvent): Promise<void> {\n if (!this.config.enabled) return;\n\n const eventRank = SEVERITY_RANK[event.severity] ?? 0;\n const minRank = SEVERITY_RANK[this.config.min_severity] ?? 3;\n if (eventRank < minRank) return;\n\n const ip = event.source_ip;\n if (!ip) return;\n if (this.isAllowlisted(ip)) return;\n if (this.blocklist.some(b => b.ip === ip)) return;\n\n const ruleRemediation = event.details?.remediation as Record<string, unknown> | undefined;\n const ttl = (ruleRemediation?.ttl_seconds as number) || this.config.default_ttl_seconds;\n const ruleId = event.details?.rule_id as string | undefined;\n\n await this.blockIp(ip, event.message, ruleId, ttl);\n }\n\n async blockIp(ip: string, reason: string, ruleId?: string, ttlSeconds?: number): Promise<boolean> {\n if (this.isAllowlisted(ip)) return false;\n\n const entry: BlockEntry = {\n ip,\n reason,\n rule_id: ruleId,\n blocked_at: Date.now(),\n expires_at: ttlSeconds ? Date.now() + (ttlSeconds * 1000) : undefined,\n dry_run: this.config.dry_run,\n };\n\n if (!this.config.dry_run) {\n try {\n await this.adapter.block(ip);\n } catch (err) {\n this.logLine(`[firewall] EACCES or error blocking ${ip}: ${(err as Error).message}`);\n this.bus.publish({\n timestamp: new Date(),\n module: 'firewall-rules',\n category: 'system',\n severity: 'medium',\n message: `Failed to block ${ip}: ${(err as Error).message}. Ensure daemon has CAP_NET_ADMIN.`,\n });\n return false;\n }\n }\n\n this.blocklist.push(entry);\n this.saveState();\n\n const mode = this.config.dry_run ? '[DRY-RUN] ' : '';\n const expiryMsg = ttlSeconds ? ` (expires in ${ttlSeconds}s)` : ' (permanent)';\n this.logLine(`[firewall] ${mode}Blocked ${ip}: ${reason}${expiryMsg}`);\n\n this.bus.publish({\n timestamp: new Date(),\n module: 'firewall-rules',\n category: 'system',\n severity: 'info',\n message: `${mode}Blocked ${ip}: ${reason}${expiryMsg}`,\n source_ip: ip,\n details: { action: 'block', rule_id: ruleId, dry_run: this.config.dry_run, ttl_seconds: ttlSeconds },\n });\n\n return true;\n }\n\n async unblockIp(ip: string): Promise<boolean> {\n const idx = this.blocklist.findIndex(b => b.ip === ip);\n if (idx < 0) return false;\n\n const entry = this.blocklist[idx];\n if (!entry.dry_run) {\n try {\n await this.adapter.unblock(ip);\n } catch (err) {\n this.logLine(`[firewall] Error unblocking ${ip}: ${(err as Error).message}`);\n return false;\n }\n }\n\n this.blocklist.splice(idx, 1);\n this.saveState();\n\n this.logLine(`[firewall] Unblocked ${ip}`);\n this.bus.publish({\n timestamp: new Date(),\n module: 'firewall-rules',\n category: 'system',\n severity: 'info',\n message: `Unblocked ${ip}`,\n source_ip: ip,\n details: { action: 'unblock' },\n });\n\n return true;\n }\n\n isAllowlisted(ip: string): boolean {\n return this.config.allowlist.includes(ip);\n }\n\n addToAllowlist(ip: string): void {\n if (!this.config.allowlist.includes(ip)) {\n this.config.allowlist.push(ip);\n }\n }\n\n removeFromAllowlist(ip: string): void {\n this.config.allowlist = this.config.allowlist.filter(a => a !== ip);\n }\n\n getBlocklist(): BlockEntry[] { return [...this.blocklist]; }\n getAllowlist(): string[] { return [...this.config.allowlist]; }\n\n stop(): void {\n if (this.expiryTimer) clearInterval(this.expiryTimer);\n this.expiryTimer = null;\n }\n\n private startExpiryWorker(): void {\n this.expiryTimer = setInterval(() => void this.processExpiries(), 30_000);\n }\n\n private async processExpiries(): Promise<void> {\n const now = Date.now();\n const expired = this.blocklist.filter(b => b.expires_at && b.expires_at <= now);\n for (const entry of expired) {\n await this.unblockIp(entry.ip);\n }\n }\n\n private loadState(): void {\n try {\n const saved = getModuleState('firewall-rules', 'blocklist') as BlockEntry[] | undefined;\n if (Array.isArray(saved)) this.blocklist = saved;\n } catch { /* State DB may not be available */ }\n }\n\n private saveState(): void {\n try { setModuleState('firewall-rules', 'blocklist', this.blocklist); }\n catch { /* State DB may not be available */ }\n }\n\n private logLine(line: string): void {\n try { appendFileSync(PATHS.logFile, `${new Date().toISOString()} ${line}\\n`); }\n catch { /* best-effort */ }\n }\n}\n","/**\n * Opt-in error reporting for the CLI + daemon.\n *\n * Enabled only when `SENTRY_DSN` is set in the environment. Safe to call\n * from both short-lived CLI invocations and the long-running daemon.\n */\n\nlet ready = false;\n// Keep the import lazy so the CLI doesn't pay the Sentry bundle cost when\n// reporting is disabled.\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nlet sentry: any = null;\n\nasync function loadSentry(): Promise<void> {\n if (sentry) return;\n try {\n sentry = await import('@sentry/node');\n } catch {\n sentry = null;\n }\n}\n\nexport async function initTelemetry(context: 'cli' | 'daemon'): Promise<void> {\n if (ready) return;\n const dsn = process.env.SENTRY_DSN;\n if (!dsn) return;\n\n await loadSentry();\n if (!sentry) return;\n\n sentry.init({\n dsn,\n environment: process.env.NODE_ENV || 'production',\n release: process.env.SENTRY_RELEASE,\n serverName: context,\n tracesSampleRate: 0,\n beforeSend(event: Record<string, unknown>) {\n const req = (event as { request?: { headers?: Record<string, string> } }).request;\n if (req?.headers) {\n delete req.headers.authorization;\n delete req.headers.cookie;\n }\n return event;\n },\n });\n\n ready = true;\n}\n\nexport function captureException(err: unknown): void {\n if (!ready || !sentry) return;\n sentry.captureException(err);\n}\n\nexport async function flushTelemetry(timeoutMs = 2000): Promise<void> {\n if (!ready || !sentry) return;\n try { await sentry.flush(timeoutMs); } catch { /* ignore */ }\n}\n","#!/usr/bin/env node\nimport { runDaemon } from './daemon/index.js';\n\nrunDaemon().catch((err) => {\n console.error('threatcrushd failed to start:', err);\n process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA,sFAAAA,UAAAC,SAAA;AAAA;AACA,QAAM,YAAY;AAClB,QAAM,cAAN,MAAM,qBAAoB,MAAM;AAAA;AAAA,MAE9B,YAAa,KAAK,UAAU,YAAY;AACtC,cAAM,mBAAmB,KAAK,UAAU,UAAU;AAClD,aAAK,OAAO;AACZ,aAAK,OAAO;AACZ,YAAI,MAAM,kBAAmB,OAAM,kBAAkB,MAAM,YAAW;AAAA,MACxE;AAAA,IACF;AACA,QAAM,QAAN,MAAY;AAAA,MACV,YAAa,QAAQ;AACnB,aAAK,SAAS;AACd,aAAK,MAAM;AACX,aAAK,WAAW;AAChB,aAAK,SAAS;AACd,aAAK,cAAc;AACnB,aAAK,YAAY;AAAA,MACnB;AAAA,IACF;AACA,QAAM,SAAN,MAAa;AAAA,MACX,cAAe;AACb,aAAK,MAAM;AACX,aAAK,MAAM;AACX,aAAK,OAAO;AACZ,aAAK,MAAM,CAAC;AACZ,aAAK,MAAM,KAAK;AAChB,aAAK,QAAQ,CAAC;AACd,aAAK,OAAO;AACZ,aAAK,OAAO;AACZ,aAAK,KAAK;AACV,aAAK,QAAQ,IAAI,MAAM,KAAK,UAAU;AAAA,MACxC;AAAA,MAEA,MAAO,KAAK;AAEV,YAAI,IAAI,WAAW,KAAK,IAAI,UAAU,KAAM;AAE5C,aAAK,OAAO,OAAO,GAAG;AACtB,aAAK,KAAK;AACV,aAAK,OAAO;AACZ,YAAI;AACJ,eAAO,YAAY,SAAS,KAAK,SAAS,GAAG;AAC3C,oBAAU,KAAK,OAAO;AAAA,QACxB;AACA,aAAK,OAAO;AAAA,MACd;AAAA,MACA,WAAY;AACV,YAAI,KAAK,SAAS,IAAM;AACtB,YAAE,KAAK;AACP,eAAK,MAAM;AAAA,QACb;AACA,UAAE,KAAK;AACP,aAAK,OAAO,KAAK,KAAK,YAAY,KAAK,EAAE;AACzC,UAAE,KAAK;AACP,UAAE,KAAK;AACP,eAAO,KAAK,WAAW;AAAA,MACzB;AAAA,MACA,aAAc;AACZ,eAAO,KAAK,KAAK,KAAK,KAAK;AAAA,MAC7B;AAAA,MACA,SAAU;AACR,eAAO,KAAK,MAAM,OAAO,KAAK,MAAM,KAAK,MAAM,QAAQ;AAAA,MACzD;AAAA,MACA,SAAU;AACR,aAAK,OAAO;AACZ,YAAI;AACJ,WAAG;AACD,iBAAO,KAAK,MAAM;AAClB,eAAK,OAAO;AAAA,QACd,SAAS,KAAK,MAAM,WAAW;AAE/B,aAAK,MAAM;AACX,aAAK,QAAQ;AACb,aAAK,OAAO;AAEZ,eAAO,KAAK;AAAA,MACd;AAAA,MACA,KAAM,IAAI;AAER,YAAI,OAAO,OAAO,WAAY,OAAM,IAAI,YAAY,+CAA+C,KAAK,UAAU,EAAE,CAAC;AACrH,aAAK,MAAM,SAAS;AAAA,MACtB;AAAA,MACA,KAAM,IAAI;AACR,aAAK,KAAK,EAAE;AACZ,eAAO,KAAK,OAAO;AAAA,MACrB;AAAA,MACA,KAAM,IAAI,YAAY;AACpB,YAAI,WAAY,MAAK,KAAK,UAAU;AACpC,aAAK,MAAM,KAAK,KAAK,KAAK;AAC1B,aAAK,QAAQ,IAAI,MAAM,EAAE;AAAA,MAC3B;AAAA,MACA,QAAS,IAAI,YAAY;AACvB,aAAK,KAAK,IAAI,UAAU;AACxB,eAAO,KAAK,OAAO;AAAA,MACrB;AAAA,MACA,OAAQ,OAAO;AAEb,YAAI,KAAK,MAAM,WAAW,EAAG,OAAM,KAAK,MAAM,IAAI,YAAY,iBAAiB,CAAC;AAChF,YAAI,UAAU,OAAW,SAAQ,KAAK,MAAM;AAC5C,aAAK,QAAQ,KAAK,MAAM,IAAI;AAC5B,aAAK,MAAM,WAAW;AAAA,MACxB;AAAA,MACA,UAAW,OAAO;AAChB,aAAK,OAAO,KAAK;AACjB,eAAO,KAAK,OAAO;AAAA,MACrB;AAAA,MACA,UAAW;AAET,YAAI,KAAK,SAAS,UAAW,OAAM,KAAK,MAAM,IAAI,YAAY,0BAA0B,CAAC;AACzF,aAAK,MAAM,OAAO,KAAK,KAAK,KAAK,EAAE;AAAA,MACrC;AAAA,MACA,MAAO,KAAK;AACV,YAAI,OAAO,KAAK;AAChB,YAAI,MAAM,KAAK;AACf,YAAI,MAAM,KAAK;AACf,eAAO;AAAA,MACT;AAAA;AAAA,MAEA,aAAc;AACZ,cAAM,IAAI,YAAY,kCAAkC;AAAA,MAC1D;AAAA,IACF;AACA,WAAO,MAAM;AACb,WAAO,QAAQ;AACf,IAAAA,QAAO,UAAU;AAAA;AAAA;;;AC9HjB;AAAA,+FAAAC,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU,WAAS;AACxB,YAAM,OAAO,IAAI,KAAK,KAAK;AAE3B,UAAI,MAAM,IAAI,GAAG;AACf,cAAM,IAAI,UAAU,kBAAkB;AAAA,MACxC,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;;;ACTA;AAAA,0FAAAC,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU,CAAC,GAAG,QAAQ;AAC3B,YAAM,OAAO,GAAG;AAChB,aAAO,IAAI,SAAS,EAAG,OAAM,MAAM;AACnC,aAAO;AAAA,IACT;AAAA;AAAA;;;ACLA;AAAA,qGAAAC,UAAAC,SAAA;AAAA;AACA,QAAM,IAAI;AAEV,QAAM,mBAAN,cAA+B,KAAK;AAAA,MAClC,YAAa,OAAO;AAClB,cAAM,QAAQ,GAAG;AACjB,aAAK,aAAa;AAAA,MACpB;AAAA,MACA,cAAe;AACb,cAAM,OAAO,GAAG,KAAK,eAAe,CAAC,IAAI,EAAE,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC;AAChG,cAAM,OAAO,GAAG,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,cAAc,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,cAAc,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;AACvI,eAAO,GAAG,IAAI,IAAI,IAAI;AAAA,MACxB;AAAA,IACF;AAEA,IAAAA,QAAO,UAAU,WAAS;AACxB,YAAM,OAAO,IAAI,iBAAiB,KAAK;AAEvC,UAAI,MAAM,IAAI,GAAG;AACf,cAAM,IAAI,UAAU,kBAAkB;AAAA,MACxC,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;;;ACvBA;AAAA,2FAAAC,UAAAC,SAAA;AAAA;AACA,QAAM,IAAI;AACV,QAAM,WAAW,OAAO;AAExB,QAAMC,QAAN,cAAmB,SAAS;AAAA,MAC1B,YAAa,OAAO;AAClB,cAAM,KAAK;AACX,aAAK,SAAS;AAAA,MAChB;AAAA,MACA,cAAe;AACb,eAAO,GAAG,KAAK,eAAe,CAAC,IAAI,EAAE,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC;AAAA,MAC5F;AAAA,IACF;AAEA,IAAAD,QAAO,UAAU,WAAS;AACxB,YAAM,OAAO,IAAIC,MAAK,KAAK;AAE3B,UAAI,MAAM,IAAI,GAAG;AACf,cAAM,IAAI,UAAU,kBAAkB;AAAA,MACxC,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;;;ACtBA;AAAA,2FAAAC,UAAAC,SAAA;AAAA;AACA,QAAM,IAAI;AAEV,QAAM,OAAN,cAAmB,KAAK;AAAA,MACtB,YAAa,OAAO;AAClB,cAAM,cAAc,KAAK,GAAG;AAC5B,aAAK,SAAS;AAAA,MAChB;AAAA,MACA,cAAe;AACb,eAAO,GAAG,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,cAAc,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,cAAc,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;AAAA,MACnI;AAAA,IACF;AAEA,IAAAA,QAAO,UAAU,WAAS;AACxB,YAAM,OAAO,IAAI,KAAK,KAAK;AAE3B,UAAI,MAAM,IAAI,GAAG;AACf,cAAM,IAAI,UAAU,kBAAkB;AAAA,MACxC,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;;;ACrBA;AAAA;AAAA;AAEA,WAAO,UAAU,gBAAgB,gBAAsB;AACvD,WAAO,QAAQ,kBAAkB;AAEjC,QAAM,YAAN,MAAM,mBAAkB,MAAM;AAAA,MAC5B,YAAa,KAAK;AAChB,cAAM,GAAG;AACT,aAAK,OAAO;AAEZ,YAAI,MAAM,kBAAmB,OAAM,kBAAkB,MAAM,UAAS;AACpE,aAAK,WAAW;AAChB,aAAK,UAAU;AAAA,MACjB;AAAA,IACF;AACA,cAAU,OAAO,SAAO;AACtB,YAAM,OAAO,IAAI,UAAU,IAAI,OAAO;AACtC,WAAK,OAAO,IAAI;AAChB,WAAK,UAAU;AACf,aAAO;AAAA,IACT;AACA,WAAO,QAAQ,YAAY;AAE3B,QAAM,iBAAiB;AACvB,QAAM,sBAAsB;AAC5B,QAAM,aAAa;AACnB,QAAM,aAAa;AAEnB,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,qBAAqB;AAC3B,QAAM,UAAU;AAChB,QAAM,YAAY;AAClB,QAAM,WAAW;AACjB,QAAM,YAAY;AAClB,QAAM,YAAY;AAClB,QAAM,aAAa;AACnB,QAAM,cAAc;AACpB,QAAM,cAAc;AACpB,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,aAAa;AACnB,QAAM,cAAc;AACpB,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,cAAc;AACpB,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,YAAY;AAClB,QAAM,YAAY;AAClB,QAAM,YAAY;AAClB,QAAM,YAAY;AAClB,QAAM,YAAY;AAClB,QAAM,WAAW;AACjB,QAAM,kBAAkB;AACxB,QAAM,iBAAiB;AAEvB,QAAM,UAAU;AAAA,MACd,CAAC,MAAM,GAAG;AAAA,MACV,CAAC,MAAM,GAAG;AAAA,MACV,CAAC,MAAM,GAAG;AAAA,MACV,CAAC,MAAM,GAAG;AAAA,MACV,CAAC,MAAM,GAAG;AAAA,MACV,CAAC,SAAS,GAAG;AAAA,MACb,CAAC,SAAS,GAAG;AAAA,IACf;AAEA,aAAS,QAAS,IAAI;AACpB,aAAO,MAAM,UAAU,MAAM;AAAA,IAC/B;AACA,aAAS,QAAS,IAAI;AACpB,aAAQ,MAAM,UAAU,MAAM,UAAY,MAAM,UAAU,MAAM,UAAY,MAAM,UAAU,MAAM;AAAA,IACpG;AACA,aAAS,MAAO,IAAI;AAClB,aAAO,OAAO,UAAU,OAAO;AAAA,IACjC;AACA,aAAS,QAAS,IAAI;AACpB,aAAQ,MAAM,UAAU,MAAM;AAAA,IAChC;AACA,aAAS,sBAAuB,IAAI;AAClC,aAAQ,MAAM,UAAU,MAAM,UACtB,MAAM,UAAU,MAAM,UACtB,MAAM,UAAU,MAAM,UACvB,OAAO,aACP,OAAO,aACP,OAAO,eACP,OAAO;AAAA,IAChB;AACA,aAAS,iBAAkB,IAAI;AAC7B,aAAQ,MAAM,UAAU,MAAM,UACtB,MAAM,UAAU,MAAM,UACtB,MAAM,UAAU,MAAM,UACvB,OAAO,eACP,OAAO;AAAA,IAChB;AACA,QAAM,QAAQ,uBAAO,MAAM;AAC3B,QAAM,YAAY,uBAAO,UAAU;AAEnC,QAAM,iBAAiB,OAAO,UAAU;AACxC,QAAM,iBAAiB,OAAO;AAC9B,QAAM,aAAa,EAAC,cAAc,MAAM,YAAY,MAAM,UAAU,MAAM,OAAO,OAAS;AAE1F,aAAS,OAAQ,KAAK,KAAK;AACzB,UAAI,eAAe,KAAK,KAAK,GAAG,EAAG,QAAO;AAC1C,UAAI,QAAQ,YAAa,gBAAe,KAAK,aAAa,UAAU;AACpE,aAAO;AAAA,IACT;AAEA,QAAM,eAAe,uBAAO,cAAc;AAC1C,aAAS,cAAe;AACtB,aAAO,OAAO,iBAAiB,CAAC,GAAG;AAAA,QACjC,CAAC,KAAK,GAAG,EAAC,OAAO,aAAY;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,aAAS,cAAe,KAAK;AAC3B,UAAI,QAAQ,QAAQ,OAAQ,QAAS,SAAU,QAAO;AACtD,aAAO,IAAI,KAAK,MAAM;AAAA,IACxB;AAEA,QAAM,QAAQ,uBAAO,OAAO;AAC5B,aAAS,QAAS;AAChB,aAAO,OAAO,iBAAiB,CAAC,GAAG;AAAA,QACjC,CAAC,KAAK,GAAG,EAAC,OAAO,MAAK;AAAA,QACtB,CAAC,SAAS,GAAG,EAAC,OAAO,OAAO,UAAU,KAAI;AAAA,MAC5C,CAAC;AAAA,IACH;AACA,aAAS,QAAS,KAAK;AACrB,UAAI,QAAQ,QAAQ,OAAQ,QAAS,SAAU,QAAO;AACtD,aAAO,IAAI,KAAK,MAAM;AAAA,IACxB;AAEA,QAAM,eAAe,uBAAO,cAAc;AAC1C,QAAM,cAAc,uBAAO,aAAa;AACxC,aAAS,WAAY,MAAM;AACzB,aAAO,OAAO,iBAAiB,CAAC,GAAG;AAAA,QACjC,CAAC,KAAK,GAAG,EAAC,OAAO,YAAW;AAAA,QAC5B,CAAC,YAAY,GAAG,EAAC,OAAO,KAAI;AAAA,MAC9B,CAAC;AAAA,IACH;AACA,aAAS,aAAc,KAAK;AAC1B,UAAI,QAAQ,QAAQ,OAAQ,QAAS,SAAU,QAAO;AACtD,aAAO,IAAI,KAAK,MAAM;AAAA,IACxB;AAEA,QAAM,OAAO,uBAAO,MAAM;AAC1B,aAAS,OAAQ;AACf,aAAO,OAAO,iBAAiB,CAAC,GAAG;AAAA,QACjC,CAAC,KAAK,GAAG,EAAC,OAAO,KAAI;AAAA,MACvB,CAAC;AAAA,IACH;AACA,aAAS,OAAQ,KAAK;AACpB,UAAI,QAAQ,QAAQ,OAAQ,QAAS,SAAU,QAAO;AACtD,aAAO,IAAI,KAAK,MAAM;AAAA,IACxB;AAGA,QAAI;AACJ,QAAI;AACF,YAAM,cAAc,KAAK,yBAAyB;AAClD,gBAAU,YAAY;AAAA,IACxB,SAAS,GAAG;AAAA,IAEZ;AAEA,QAAM,WAAW,WAAW;AAE5B,QAAM,cAAN,MAAkB;AAAA,MAChB,YAAa,OAAO;AAClB,YAAI;AACF,eAAK,QAAQ,OAAO,OAAO,OAAO,IAAI,KAAK;AAAA,QAC7C,SAAS,GAAG;AAEV,eAAK,QAAQ;AAAA,QACf;AACA,eAAO,eAAe,MAAM,OAAO,EAAC,OAAO,QAAO,CAAC;AAAA,MACrD;AAAA,MACA,QAAS;AACP,eAAO,KAAK,UAAU;AAAA,MACxB;AAAA;AAAA,MAEA,WAAY;AACV,eAAO,OAAO,KAAK,KAAK;AAAA,MAC1B;AAAA;AAAA,MAEA,CAAC,QAAQ,IAAK;AACZ,eAAO,YAAY,KAAK,SAAS,CAAC;AAAA,MACpC;AAAA,MACA,UAAW;AACT,eAAO,KAAK;AAAA,MACd;AAAA,IACF;AAEA,QAAM,UAAU,uBAAO,SAAS;AAChC,aAAS,QAAS,OAAO;AACvB,UAAI,MAAM,OAAO,KAAK;AAEtB,UAAI,OAAO,GAAG,KAAK,EAAE,EAAG,OAAM;AAE9B,UAAI,OAAO,UAAU,CAAC,OAAO,cAAc,GAAG,GAAG;AAC/C,eAAO,IAAI,YAAY,KAAK;AAAA,MAC9B,OAAO;AAEL,eAAO,OAAO,iBAAiB,IAAI,OAAO,GAAG,GAAG;AAAA,UAC9C,OAAO,EAAC,OAAO,WAAY;AAAE,mBAAO,MAAM,IAAI;AAAA,UAAE,EAAC;AAAA,UACjD,CAAC,KAAK,GAAG,EAAC,OAAO,QAAO;AAAA,UACxB,CAAC,QAAQ,GAAG,EAAC,OAAO,MAAM,aAAa,KAAK,IAAG;AAAA,QACjD,CAAC;AAAA,MACH;AAAA,IACF;AACA,aAAS,UAAW,KAAK;AACvB,UAAI,QAAQ,QAAQ,OAAQ,QAAS,SAAU,QAAO;AACtD,aAAO,IAAI,KAAK,MAAM;AAAA,IACxB;AAEA,QAAM,QAAQ,uBAAO,OAAO;AAC5B,aAAS,MAAO,OAAO;AAErB,aAAO,OAAO,iBAAiB,IAAI,OAAO,KAAK,GAAG;AAAA,QAChD,CAAC,KAAK,GAAG,EAAC,OAAO,MAAK;AAAA,QACtB,CAAC,QAAQ,GAAG,EAAC,OAAO,MAAM,WAAW,KAAK,IAAG;AAAA,MAC/C,CAAC;AAAA,IACH;AACA,aAAS,QAAS,KAAK;AACrB,UAAI,QAAQ,QAAQ,OAAQ,QAAS,SAAU,QAAO;AACtD,aAAO,IAAI,KAAK,MAAM;AAAA,IACxB;AAEA,aAAS,SAAU,OAAO;AACxB,YAAM,OAAO,OAAO;AACpB,UAAI,SAAS,UAAU;AAErB,YAAI,UAAU,KAAM,QAAO;AAC3B,YAAI,iBAAiB,KAAM,QAAO;AAElC,YAAI,SAAS,OAAO;AAClB,kBAAQ,MAAM,KAAK,GAAG;AAAA,YACpB,KAAK;AAAc,qBAAO;AAAA,YAC1B,KAAK;AAAa,qBAAO;AAAA;AAAA,YAEzB,KAAK;AAAO,qBAAO;AAAA;AAAA,YAEnB,KAAK;AAAM,qBAAO;AAAA,YAClB,KAAK;AAAO,qBAAO;AAAA,YACnB,KAAK;AAAS,qBAAO;AAAA,UACvB;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAEA,aAAS,gBAAiB,QAAQ;AAAA,MAChC,MAAM,mBAAmB,OAAO;AAAA,QAC9B,cAAe;AACb,gBAAM;AACN,eAAK,MAAM,KAAK,MAAM,MAAM;AAAA,QAC9B;AAAA;AAAA,QAGA,cAAe;AACb,iBAAO,KAAK,SAAS,YAAY,KAAK,SAAS,UAAU,KAAK,SAAS,WAAW,KAAK,YAAY;AAAA,QACrG;AAAA,QACA,cAAe;AACb,iBAAO,KAAK,SAAS,OAAO,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS;AAAA,QAC3E;AAAA,QAEA,aAAc;AACZ,cAAI,KAAK,SAAS,OAAO,KAAK;AAC5B,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC,WAAW,KAAK,SAAS,UAAU;AACjC,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACxG,mBAAO;AAAA,UACT,WAAW,sBAAsB,KAAK,IAAI,GAAG;AAC3C,mBAAO,KAAK,QAAQ,KAAK,oBAAoB;AAAA,UAC/C,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,sBAAsB,KAAK,IAAI,GAAG,CAAC;AAAA,UACpE;AAAA,QACF;AAAA;AAAA;AAAA,QAIA,uBAAwB;AACtB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACzE,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,UAAU;AACjC,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,KAAK,SAAS,OAAO,OAAO,KAAK,SAAS,QAAQ;AAC3D,mBAAO,KAAK,OAAO;AAAA,UACrB,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,6EAA6E,CAAC;AAAA,UAC/G;AAAA,QACF;AAAA;AAAA,QAGA,uBAAwB;AACtB,iBAAO,KAAK,QAAQ,KAAK,aAAa,KAAK,qBAAqB;AAAA,QAClE;AAAA,QACA,sBAAuB,IAAI;AACzB,cAAI,SAAS,KAAK;AAClB,cAAI,WAAW,GAAG,IAAI,IAAI;AAC1B,mBAAS,MAAM,GAAG,KAAK;AACrB,gBAAI,OAAO,QAAQ,EAAE,MAAM,CAAC,QAAQ,OAAO,EAAE,CAAC,KAAK,OAAO,EAAE,EAAE,SAAS,IAAI;AACzE,oBAAM,KAAK,MAAM,IAAI,UAAU,6BAA6B,CAAC;AAAA,YAC/D;AACA,qBAAS,OAAO,EAAE,IAAI,OAAO,EAAE,KAAK,MAAM;AAAA,UAC5C;AACA,cAAI,OAAO,QAAQ,QAAQ,GAAG;AAC5B,kBAAM,KAAK,MAAM,IAAI,UAAU,6BAA6B,CAAC;AAAA,UAC/D;AAEA,cAAI,UAAU,GAAG,KAAK,KAAK,QAAQ,GAAG,KAAK,GAAG;AAC5C,mBAAO,QAAQ,IAAI,GAAG,MAAM,QAAQ;AAAA,UACtC,OAAO;AACL,mBAAO,QAAQ,IAAI,GAAG;AAAA,UACxB;AACA,iBAAO,KAAK,KAAK,KAAK,oBAAoB;AAAA,QAC5C;AAAA;AAAA,QAGA,cAAe;AACb,iBAAO,KAAK,QAAQ,KAAK,cAAc,KAAK,mBAAmB;AAAA,QACjE;AAAA,QACA,oBAAqB,KAAK;AACxB,cAAI,KAAK,MAAM,aAAa;AAC1B,iBAAK,MAAM,YAAY,KAAK,GAAG;AAAA,UACjC,OAAO;AACL,iBAAK,MAAM,cAAc,CAAC,GAAG;AAAA,UAC/B;AACA,iBAAO,KAAK,KAAK,KAAK,wBAAwB;AAAA,QAChD;AAAA,QACA,2BAA4B;AAC1B,cAAI,KAAK,SAAS,aAAa;AAC7B,mBAAO,KAAK,KAAK,KAAK,yBAAyB;AAAA,UACjD,WAAW,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACxD,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC;AAAA,QACF;AAAA,QACA,4BAA6B;AAC3B,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO,KAAK,QAAQ,KAAK,cAAc,KAAK,mBAAmB;AAAA,UACjE;AAAA,QACF;AAAA,QAEA,mBAAoB;AAClB,cAAI,KAAK,SAAS,aAAa;AAC7B,mBAAO,KAAK,KAAK,KAAK,mBAAmB;AAAA,UAC3C,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iCAAiC,CAAC;AAAA,UACnE;AAAA,QACF;AAAA,QACA,sBAAuB;AACrB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,OAAO;AACL,mBAAO,KAAK,QAAQ,KAAK,YAAY,KAAK,iBAAiB;AAAA,UAC7D;AAAA,QACF;AAAA,QACA,kBAAmB,OAAO;AACxB,iBAAO,KAAK,UAAU,EAAC,KAAK,KAAK,MAAM,aAAa,MAAY,CAAC;AAAA,QACnE;AAAA;AAAA,QAGA,eAAgB;AACd,aAAG;AACD,gBAAI,KAAK,SAAS,OAAO,OAAO,KAAK,SAAS,QAAQ;AACpD,qBAAO,KAAK,OAAO;AAAA,YACrB;AAAA,UACF,SAAS,KAAK,SAAS;AAAA,QACzB;AAAA;AAAA,QAGA,mBAAoB;AAClB,cAAI,KAAK,SAAS,WAAW;AAC3B,iBAAK,KAAK,KAAK,SAAS;AAAA,UAC1B,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,UAAU;AAAA,UAClC;AAAA,QACF;AAAA;AAAA,QAGA,aAAc;AACZ,eAAK,MAAM,KAAK;AAChB,iBAAO,KAAK,KAAK,KAAK,cAAc;AAAA,QACtC;AAAA,QACA,iBAAkB;AAChB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,OAAO;AACL,mBAAO,KAAK,QAAQ,KAAK,cAAc,KAAK,cAAc;AAAA,UAC5D;AAAA,QACF;AAAA,QACA,eAAgB,SAAS;AACvB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,WAAW;AAClC,gBAAI,OAAO,KAAK,KAAK,OAAO,MAAM,CAAC,QAAQ,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,OAAO,EAAE,SAAS,IAAI;AAC9F,oBAAM,KAAK,MAAM,IAAI,UAAU,6BAA6B,CAAC;AAAA,YAC/D,OAAO;AACL,mBAAK,MAAM,KAAK,IAAI,OAAO,IAAI,KAAK,IAAI,OAAO,KAAK,MAAM;AAC1D,mBAAK,IAAI,SAAS,IAAI;AAAA,YACxB;AACA,mBAAO,KAAK,KAAK,KAAK,oBAAoB;AAAA,UAC5C,WAAW,KAAK,SAAS,aAAa;AACpC,gBAAI,CAAC,OAAO,KAAK,KAAK,OAAO,GAAG;AAC9B,mBAAK,MAAM,KAAK,IAAI,OAAO,IAAI,MAAM;AAAA,YACvC,WAAW,QAAQ,KAAK,IAAI,OAAO,CAAC,GAAG;AACrC,mBAAK,MAAM,KAAK,IAAI,OAAO;AAAA,YAC7B,WAAW,OAAO,KAAK,IAAI,OAAO,CAAC,GAAG;AACpC,mBAAK,MAAM,KAAK,IAAI,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,SAAS,CAAC;AAAA,YAC3D,OAAO;AACL,oBAAM,KAAK,MAAM,IAAI,UAAU,6BAA6B,CAAC;AAAA,YAC/D;AACA,mBAAO,KAAK,KAAK,KAAK,cAAc;AAAA,UACtC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,mDAAmD,CAAC;AAAA,UACrF;AAAA,QACF;AAAA;AAAA,QAGA,YAAa;AACX,eAAK,MAAM,KAAK;AAChB,iBAAO,KAAK,KAAK,KAAK,aAAa;AAAA,QACrC;AAAA,QACA,gBAAiB;AACf,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,OAAO;AACL,mBAAO,KAAK,QAAQ,KAAK,cAAc,KAAK,aAAa;AAAA,UAC3D;AAAA,QACF;AAAA,QACA,cAAe,SAAS;AACtB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,WAAW;AAClC,gBAAI,CAAC,OAAO,KAAK,KAAK,OAAO,GAAG;AAC9B,mBAAK,IAAI,OAAO,IAAI,KAAK;AAAA,YAC3B;AACA,gBAAI,aAAa,KAAK,IAAI,OAAO,CAAC,GAAG;AACnC,oBAAM,KAAK,MAAM,IAAI,UAAU,8BAA8B,CAAC;AAAA,YAChE,WAAW,OAAO,KAAK,IAAI,OAAO,CAAC,GAAG;AACpC,oBAAM,OAAO,MAAM;AACnB,mBAAK,IAAI,OAAO,EAAE,KAAK,IAAI;AAC3B,mBAAK,MAAM;AAAA,YACb,OAAO;AACL,oBAAM,KAAK,MAAM,IAAI,UAAU,gCAAgC,CAAC;AAAA,YAClE;AACA,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,KAAK,SAAS,aAAa;AACpC,gBAAI,CAAC,OAAO,KAAK,KAAK,OAAO,GAAG;AAC9B,mBAAK,MAAM,KAAK,IAAI,OAAO,IAAI,MAAM;AAAA,YACvC,WAAW,aAAa,KAAK,IAAI,OAAO,CAAC,GAAG;AAC1C,oBAAM,KAAK,MAAM,IAAI,UAAU,8BAA8B,CAAC;AAAA,YAChE,WAAW,cAAc,KAAK,IAAI,OAAO,CAAC,GAAG;AAC3C,oBAAM,KAAK,MAAM,IAAI,UAAU,8BAA8B,CAAC;AAAA,YAChE,WAAW,OAAO,KAAK,IAAI,OAAO,CAAC,GAAG;AACpC,mBAAK,MAAM,KAAK,IAAI,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,SAAS,CAAC;AAAA,YAC3D,WAAW,QAAQ,KAAK,IAAI,OAAO,CAAC,GAAG;AACrC,mBAAK,MAAM,KAAK,IAAI,OAAO;AAAA,YAC7B,OAAO;AACL,oBAAM,KAAK,MAAM,IAAI,UAAU,gCAAgC,CAAC;AAAA,YAClE;AACA,mBAAO,KAAK,KAAK,KAAK,aAAa;AAAA,UACrC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,mDAAmD,CAAC;AAAA,UACrF;AAAA,QACF;AAAA,QACA,aAAc,SAAS;AACrB,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,oBAAoB;AAAA,UAC5C,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,mDAAmD,CAAC;AAAA,UACrF;AAAA,QACF;AAAA;AAAA,QAGA,aAAc;AACZ,cAAI,KAAK,SAAS,OAAO,KAAK;AAC5B,kBAAM,KAAK,MAAM,IAAI,UAAU,mBAAmB,CAAC;AAAA,UACrD,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,KAAK,KAAK,iBAAiB;AAAA,UACzC;AAAE,cAAI,KAAK,SAAS,WAAW;AAC7B,mBAAO,KAAK,KAAK,KAAK,iBAAiB;AAAA,UACzC,WAAW,KAAK,SAAS,eAAe,KAAK,SAAS,WAAW;AAC/D,mBAAO,KAAK,KAAK,KAAK,eAAe;AAAA,UACvC,WAAW,KAAK,SAAS,QAAQ;AAC/B,mBAAO,KAAK,KAAK,KAAK,QAAQ;AAAA,UAChC,WAAW,KAAK,SAAS,QAAQ;AAC/B,mBAAO,KAAK,KAAK,KAAK,QAAQ;AAAA,UAChC,WAAW,QAAQ,KAAK,IAAI,GAAG;AAC7B,mBAAO,KAAK,KAAK,KAAK,qBAAqB;AAAA,UAC7C,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACvD,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,KAAK,KAAK,iBAAiB,KAAK,WAAW;AAAA,UACzD,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,KAAK,KAAK,kBAAkB,KAAK,WAAW;AAAA,UAC1D,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iGAAiG,CAAC;AAAA,UACnI;AAAA,QACF;AAAA,QACA,YAAa,OAAO;AAClB,iBAAO,KAAK,UAAU,KAAK;AAAA,QAC7B;AAAA,QAEA,WAAY;AACV,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO,KAAK,KAAK,KAAK,SAAS;AAAA,UACjC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,wDAAwD,CAAC;AAAA,UAC1F;AAAA,QACF;AAAA,QACA,YAAa;AACX,cAAI,KAAK,SAAS,QAAQ;AACxB,gBAAI,KAAK,MAAM,QAAQ,KAAK;AAC1B,qBAAO,KAAK,OAAO,SAAS;AAAA,YAC9B,OAAO;AACL,qBAAO,KAAK,OAAO,QAAQ;AAAA,YAC7B;AAAA,UACF,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,wDAAwD,CAAC;AAAA,UAC1F;AAAA,QACF;AAAA,QAEA,WAAY;AACV,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO,KAAK,KAAK,KAAK,SAAS;AAAA,UACjC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,sCAAsC,CAAC;AAAA,UACxE;AAAA,QACF;AAAA,QACA,YAAa;AACX,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO,KAAK,OAAO,GAAG;AAAA,UACxB,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,sCAAsC,CAAC;AAAA,UACxE;AAAA,QACF;AAAA;AAAA,QAGA,eAAgB;AACd,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,KAAK,KAAK,kBAAkB;AAAA,UAC1C,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC;AAAA,QACF;AAAA;AAAA,QAGA,eAAgB;AACd,aAAG;AACD,gBAAI,KAAK,SAAS,OAAO,KAAK;AAC5B,oBAAM,KAAK,MAAM,IAAI,UAAU,yBAAyB,CAAC;AAAA,YAC3D,WAAW,iBAAiB,KAAK,IAAI,GAAG;AACtC,mBAAK,QAAQ;AAAA,YACf,WAAW,KAAK,MAAM,IAAI,WAAW,GAAG;AACtC,oBAAM,KAAK,MAAM,IAAI,UAAU,iCAAiC,CAAC;AAAA,YACnE,OAAO;AACL,qBAAO,KAAK,UAAU;AAAA,YACxB;AAAA,UACF,SAAS,KAAK,SAAS;AAAA,QACzB;AAAA;AAAA,QAGA,oBAAqB;AACnB,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,4BAA4B;AAAA,UACpD,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,kBAAkB;AAAA,UAC1C;AAAA,QACF;AAAA,QACA,qBAAsB;AACpB,aAAG;AACD,gBAAI,KAAK,SAAS,WAAW;AAC3B,qBAAO,KAAK,OAAO;AAAA,YACrB,WAAW,KAAK,YAAY,GAAG;AAC7B,oBAAM,KAAK,MAAM,IAAI,UAAU,qBAAqB,CAAC;AAAA,YACvD,WAAW,KAAK,SAAS,YAAa,KAAK,QAAQ,sBAAsB,KAAK,SAAS,QAAS;AAC9F,oBAAM,KAAK,yBAAyB;AAAA,YACtC,OAAO;AACL,mBAAK,QAAQ;AAAA,YACf;AAAA,UACF,SAAS,KAAK,SAAS;AAAA,QACzB;AAAA,QACA,+BAAgC;AAC9B,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C,OAAO;AACL,mBAAO,KAAK,UAAU;AAAA,UACxB;AAAA,QACF;AAAA,QACA,0BAA2B;AACzB,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,QAAQ;AAC/B,mBAAO,KAAK,KAAK,KAAK,8BAA8B;AAAA,UACtD,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,8BAA8B;AAAA,UACtD;AAAA,QACF;AAAA,QACA,iCAAkC;AAChC,aAAG;AACD,gBAAI,KAAK,SAAS,WAAW;AAC3B,qBAAO,KAAK,KAAK,KAAK,oBAAoB;AAAA,YAC5C,WAAW,KAAK,SAAS,OAAO,KAAK;AACnC,oBAAM,KAAK,MAAM,IAAI,UAAU,gCAAgC,CAAC;AAAA,YAClE,WAAW,KAAK,SAAS,YAAa,KAAK,QAAQ,sBAAsB,KAAK,SAAS,UAAU,KAAK,SAAS,UAAU,KAAK,SAAS,QAAS;AAC9I,oBAAM,KAAK,yBAAyB;AAAA,YACtC,OAAO;AACL,mBAAK,QAAQ;AAAA,YACf;AAAA,UACF,SAAS,KAAK,SAAS;AAAA,QACzB;AAAA,QACA,uBAAwB;AACtB,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,qBAAqB;AAAA,UAC7C,OAAO;AACL,iBAAK,MAAM,OAAO;AAClB,mBAAO,KAAK,KAAK,KAAK,8BAA8B;AAAA,UACtD;AAAA,QACF;AAAA,QACA,wBAAyB;AACvB,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,OAAO;AAAA,UACrB,OAAO;AACL,iBAAK,MAAM,OAAO;AAClB,mBAAO,KAAK,KAAK,KAAK,8BAA8B;AAAA,UACtD;AAAA,QACF;AAAA;AAAA,QAGA,oBAAqB;AACnB,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,qBAAqB;AAAA,UAC7C,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC;AAAA,QACF;AAAA,QACA,mBAAoB;AAClB,aAAG;AACD,gBAAI,KAAK,SAAS,WAAW;AAC3B,qBAAO,KAAK,KAAK,KAAK,aAAa,KAAK,uBAAuB;AAAA,YACjE,WAAW,KAAK,SAAS,WAAW;AAClC,qBAAO,KAAK,OAAO;AAAA,YACrB,WAAW,KAAK,YAAY,GAAG;AAC7B,oBAAM,KAAK,MAAM,IAAI,UAAU,qBAAqB,CAAC;AAAA,YACvD,WAAW,KAAK,SAAS,YAAa,KAAK,QAAQ,sBAAsB,KAAK,SAAS,QAAS;AAC9F,oBAAM,KAAK,yBAAyB;AAAA,YACtC,OAAO;AACL,mBAAK,QAAQ;AAAA,YACf;AAAA,UACF,SAAS,KAAK,SAAS;AAAA,QACzB;AAAA,QACA,wBAAyB,aAAa;AACpC,eAAK,MAAM,OAAO;AAClB,iBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,QACxC;AAAA,QACA,wBAAyB;AACvB,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC,OAAO;AACL,mBAAO,KAAK,UAAU;AAAA,UACxB;AAAA,QACF;AAAA,QACA,mBAAoB;AAClB,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,QAAQ;AAC/B,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C;AAAA,QACF;AAAA,QACA,0BAA2B;AACzB,aAAG;AACD,gBAAI,KAAK,SAAS,WAAW;AAC3B,qBAAO,KAAK,KAAK,KAAK,kBAAkB,KAAK,4BAA4B;AAAA,YAC3E,WAAW,KAAK,SAAS,WAAW;AAClC,qBAAO,KAAK,KAAK,KAAK,aAAa;AAAA,YACrC,WAAW,KAAK,SAAS,OAAO,KAAK;AACnC,oBAAM,KAAK,MAAM,IAAI,UAAU,gCAAgC,CAAC;AAAA,YAClE,WAAW,KAAK,SAAS,YAAa,KAAK,QAAQ,sBAAsB,KAAK,SAAS,UAAU,KAAK,SAAS,UAAU,KAAK,SAAS,QAAS;AAC9I,oBAAM,KAAK,yBAAyB;AAAA,YACtC,OAAO;AACL,mBAAK,QAAQ;AAAA,YACf;AAAA,UACF,SAAS,KAAK,SAAS;AAAA,QACzB;AAAA,QACA,2BAA4B;AAC1B,cAAI,cAAc;AAClB,cAAI,KAAK,OAAO,IAAI;AAClB,2BAAe;AAAA,UACjB;AACA,yBAAe,KAAK,KAAK,SAAS,EAAE;AAEpC,iBAAO,KAAK,MAAM,IAAI,UAAU,8EAA8E,WAAW,UAAU,CAAC;AAAA,QACtI;AAAA,QACA,6BAA8B,aAAa;AACzC,eAAK,MAAM,OAAO;AAClB,iBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,QAC/C;AAAA,QACA,gBAAiB;AACf,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,cAAc;AAAA,UACtC,OAAO;AACL,iBAAK,MAAM,OAAO;AAClB,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C;AAAA,QACF;AAAA,QACA,iBAAkB;AAChB,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,OAAO;AAAA,UACrB,OAAO;AACL,iBAAK,MAAM,OAAO;AAClB,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C;AAAA,QACF;AAAA,QACA,mBAAoB;AAClB,cAAI,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AAChD,mBAAO,KAAK,KAAK,KAAK,cAAc;AAAA,UACtC,WAAW,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACxD,mBAAO,KAAK,KAAK,KAAK,iBAAiB;AAAA,UACzC,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,WAAW;AAAA,UACnC;AAAA,QACF;AAAA,QACA,oBAAqB;AACnB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACvD,mBAAO,KAAK,KAAK,KAAK,cAAc;AAAA,UACtC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yBAAyB,CAAC;AAAA,UAC3D;AAAA,QACF;AAAA,QACA,iBAAkB;AAEhB,cAAI,KAAK,SAAS,UAAU,KAAK,SAAS,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACjG,mBAAO;AAAA,UACT,OAAO;AACL,mBAAO,KAAK,UAAU;AAAA,UACxB;AAAA,QACF;AAAA,QACA,cAAe;AACb,cAAI,KAAK,QAAQ,SAAS;AACxB,mBAAO,KAAK,OAAO,QAAQ,KAAK,IAAI,CAAC;AAAA,UACvC,WAAW,KAAK,SAAS,QAAQ;AAC/B,mBAAO,KAAK,KAAK,KAAK,mBAAmB,KAAK,kBAAkB;AAAA,UAClE,WAAW,KAAK,SAAS,QAAQ;AAC/B,mBAAO,KAAK,KAAK,KAAK,mBAAmB,KAAK,kBAAkB;AAAA,UAClE,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,+BAA+B,KAAK,IAAI,CAAC;AAAA,UAC1E;AAAA,QACF;AAAA,QACA,mBAAoB,MAAM;AACxB,cAAI;AACF,kBAAM,YAAY,SAAS,MAAM,EAAE;AACnC,gBAAI,aAAa,mBAAmB,aAAa,gBAAgB;AAC/D,oBAAM,KAAK,MAAM,IAAI,UAAU,iEAAiE,CAAC;AAAA,YACnG;AACA,mBAAO,KAAK,UAAU,OAAO,cAAc,SAAS,CAAC;AAAA,UACvD,SAAS,KAAK;AACZ,kBAAM,KAAK,MAAM,UAAU,KAAK,GAAG,CAAC;AAAA,UACtC;AAAA,QACF;AAAA,QACA,oBAAqB;AACnB,cAAI,CAAC,QAAQ,KAAK,IAAI,GAAG;AACvB,kBAAM,KAAK,MAAM,IAAI,UAAU,qDAAqD,CAAC;AAAA,UACvF,OAAO;AACL,iBAAK,QAAQ;AACb,gBAAI,KAAK,MAAM,IAAI,UAAU,EAAG,QAAO,KAAK,OAAO;AAAA,UACrD;AAAA,QACF;AAAA,QACA,oBAAqB;AACnB,cAAI,CAAC,QAAQ,KAAK,IAAI,GAAG;AACvB,kBAAM,KAAK,MAAM,IAAI,UAAU,qDAAqD,CAAC;AAAA,UACvF,OAAO;AACL,iBAAK,QAAQ;AACb,gBAAI,KAAK,MAAM,IAAI,UAAU,EAAG,QAAO,KAAK,OAAO;AAAA,UACrD;AAAA,QACF;AAAA;AAAA,QAGA,kBAAmB;AACjB,eAAK,QAAQ;AACb,iBAAO,KAAK,KAAK,KAAK,wBAAwB;AAAA,QAChD;AAAA,QACA,2BAA4B;AAC1B,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO,KAAK,KAAK,KAAK,QAAQ;AAAA,UAChC,WAAW,KAAK,SAAS,QAAQ;AAC/B,mBAAO,KAAK,KAAK,KAAK,QAAQ;AAAA,UAChC,OAAO;AACL,mBAAO,KAAK,QAAQ,KAAK,cAAc,KAAK,uBAAuB;AAAA,UACrE;AAAA,QACF;AAAA,QACA,0BAA2B;AACzB,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,mCAAmC;AAAA,UAC3D,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,kBAAkB;AAAA,UAC1C;AAAA,QACF;AAAA,QACA,sCAAuC;AACrC,cAAI,KAAK,SAAS,aAAa;AAC7B,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,cAAc,KAAK,gBAAgB;AAAA,UAC3D,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACvD,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C,OAAO;AACL,mBAAO,KAAK,UAAU,QAAQ,KAAK,MAAM,GAAG,CAAC;AAAA,UAC/C;AAAA,QACF;AAAA,QACA,qBAAsB;AACpB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,SAAS,aAAa;AACpC,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACvD,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C,WAAW,KAAK,SAAS,aAAa;AACpC,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,cAAc,KAAK,gBAAgB;AAAA,UAC3D,OAAO;AACL,kBAAM,SAAS,QAAQ,KAAK,MAAM,GAAG;AAErC,gBAAI,OAAO,MAAM,GAAG;AAClB,oBAAM,KAAK,MAAM,IAAI,UAAU,gBAAgB,CAAC;AAAA,YAClD,OAAO;AACL,qBAAO,KAAK,UAAU,MAAM;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAAA,QACA,eAAgB;AACd,cAAI,KAAK,SAAS,eAAe,KAAK,SAAS,eAAe,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AAC1G,kBAAM,KAAK,MAAM,IAAI,UAAU,sCAAsC,CAAC;AAAA,UACxE,WAAW,KAAK,YAAY,GAAG;AAC7B,kBAAM,KAAK,MAAM,IAAI,UAAU,mBAAmB,CAAC;AAAA,UACrD;AACA,iBAAO,KAAK,UAAU;AAAA,QACxB;AAAA,QACA,+BAAgC;AAC9B,cAAI,KAAK,SAAS,eAAe,KAAK,SAAS,aAAa;AAC1D,kBAAM,KAAK,MAAM,IAAI,UAAU,sCAAsC,CAAC;AAAA,UACxE,WAAW,KAAK,YAAY,GAAG;AAC7B,kBAAM,KAAK,MAAM,IAAI,UAAU,mBAAmB,CAAC;AAAA,UACrD;AACA,iBAAO,KAAK,UAAU;AAAA,QACxB;AAAA,QACA,mBAAoB;AAClB,cAAI,KAAK,SAAS,aAAa;AAC7B,mBAAO,KAAK,KAAK,KAAK,cAAc,KAAK,gBAAgB;AAAA,UAC3D,WAAW,QAAQ,KAAK,IAAI,GAAG;AAC7B,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACvD,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C,OAAO;AACL,mBAAO,KAAK,UAAU,MAAM,KAAK,MAAM,GAAG,CAAC;AAAA,UAC7C;AAAA,QACF;AAAA,QACA,0BAA2B;AACzB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,mBAAO,KAAK,KAAK,KAAK,mBAAmB;AAAA,UAC3C,WAAW,KAAK,SAAS,eAAe,KAAK,SAAS,WAAW;AAC/D,iBAAK,QAAQ;AACb,iBAAK,KAAK,KAAK,cAAc,KAAK,mBAAmB;AAAA,UACvD,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,8CAA8C,CAAC;AAAA,UAChF;AAAA,QACF;AAAA,QACA,sBAAuB;AACrB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,SAAS,aAAa;AACpC,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,OAAO;AACL,mBAAO,KAAK,UAAU,MAAM,KAAK,MAAM,GAAG,CAAC;AAAA,UAC7C;AAAA,QACF;AAAA;AAAA,QAGA,wBAAyB;AACvB,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,yBAAyB;AAAA,UACjD,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,yBAAyB;AAAA,UACjD;AAAA,QACF;AAAA,QACA,4BAA6B;AAE3B,cAAI,KAAK,SAAS,aAAa;AAC7B,mBAAO,KAAK,KAAK,KAAK,cAAc,KAAK,kBAAkB;AAAA,UAC7D,WAAW,QAAQ,KAAK,IAAI,GAAG;AAC7B,iBAAK,QAAQ;AACb,gBAAI,KAAK,MAAM,IAAI,SAAS,EAAG,MAAK,KAAK,KAAK,kBAAkB;AAAA,UAClE,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACvD,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C,WAAW,KAAK,SAAS,aAAa;AACpC,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,cAAc,KAAK,gBAAgB;AAAA,UAC3D,WAAW,KAAK,SAAS,aAAa;AACpC,mBAAO,KAAK,KAAK,KAAK,aAAa;AAAA,UACrC,WAAW,KAAK,SAAS,YAAY;AACnC,mBAAO,KAAK,KAAK,KAAK,iBAAiB;AAAA,UACzC,OAAO;AACL,mBAAO,KAAK,UAAU,QAAQ,KAAK,MAAM,GAAG,CAAC;AAAA,UAC/C;AAAA,QACF;AAAA,QACA,oBAAqB;AACnB,cAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC7B,gBAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,qBAAO,KAAK,QAAQ;AAAA,YACtB,WAAW,KAAK,SAAS,YAAY;AACnC,qBAAO,KAAK,KAAK,KAAK,iBAAiB;AAAA,YACzC,OAAO;AACL,oBAAM,KAAK,MAAM,IAAI,UAAU,kDAAkD,CAAC;AAAA,YACpF;AAAA,UACF,OAAO;AACL,gBAAI,KAAK,SAAS,aAAa;AAC7B,qBAAO,KAAK,KAAK,KAAK,aAAa;AAAA,YACrC,OAAO;AACL,oBAAM,KAAK,MAAM,IAAI,UAAU,qDAAqD,CAAC;AAAA,YACvF;AAAA,UACF;AAAA,QACF;AAAA,QACA,4BAA6B;AAC3B,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,8BAA8B,KAAK,eAAe;AAAA,UAC1E,WAAW,KAAK,SAAS,QAAQ;AAC/B,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,8BAA8B,KAAK,eAAe;AAAA,UAC1E,WAAW,KAAK,SAAS,QAAQ;AAC/B,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,8BAA8B,KAAK,eAAe;AAAA,UAC1E,WAAW,KAAK,SAAS,aAAa;AACpC,mBAAO,KAAK,KAAK,KAAK,kBAAkB;AAAA,UAC1C,WAAW,QAAQ,KAAK,IAAI,GAAG;AAC7B,mBAAO,KAAK,KAAK,KAAK,iBAAiB;AAAA,UACzC,OAAO;AACL,mBAAO,KAAK,UAAU,QAAQ,KAAK,MAAM,GAAG,CAAC;AAAA,UAC/C;AAAA,QACF;AAAA,QACA,kBAAmB;AACjB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,SAAS,aAAa;AACpC,mBAAO,KAAK,KAAK,KAAK,4BAA4B;AAAA,UACpD,OAAO;AACL,kBAAM,SAAS,QAAQ,KAAK,MAAM,GAAG;AAErC,gBAAI,OAAO,MAAM,GAAG;AAClB,oBAAM,KAAK,MAAM,IAAI,UAAU,gBAAgB,CAAC;AAAA,YAClD,OAAO;AACL,qBAAO,KAAK,UAAU,MAAM;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAAA,QACA,kBAAmB;AACjB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,SAAS,aAAa;AACpC,mBAAO,KAAK,KAAK,KAAK,4BAA4B;AAAA,UACpD,OAAO;AACL,kBAAM,SAAS,QAAQ,KAAK,MAAM,GAAG;AAErC,gBAAI,OAAO,MAAM,GAAG;AAClB,oBAAM,KAAK,MAAM,IAAI,UAAU,gBAAgB,CAAC;AAAA,YAClD,OAAO;AACL,qBAAO,KAAK,UAAU,MAAM;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAAA,QACA,kBAAmB;AACjB,cAAI,MAAM,KAAK,IAAI,GAAG;AACpB,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,SAAS,aAAa;AACpC,mBAAO,KAAK,KAAK,KAAK,4BAA4B;AAAA,UACpD,OAAO;AACL,kBAAM,SAAS,QAAQ,KAAK,MAAM,GAAG;AAErC,gBAAI,OAAO,MAAM,GAAG;AAClB,oBAAM,KAAK,MAAM,IAAI,UAAU,gBAAgB,CAAC;AAAA,YAClD,OAAO;AACL,qBAAO,KAAK,UAAU,MAAM;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAAA;AAAA,QAGA,gBAAiB;AAEf,cAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC7B,kBAAM,KAAK,MAAM,IAAI,UAAU,6DAA6D,CAAC;AAAA,UAC/F;AACA,eAAK,MAAM,SAAS,KAAK,MAAM;AAC/B,eAAK,MAAM,MAAM;AACjB,iBAAO,KAAK,KAAK,KAAK,cAAc;AAAA,QACtC;AAAA,QACA,iBAAkB;AAChB,cAAI,KAAK,SAAS,aAAa;AAC7B,gBAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC7B,oBAAM,KAAK,MAAM,IAAI,UAAU,2DAA2D,CAAC;AAAA,YAC7F;AACA,iBAAK,MAAM,UAAU,MAAM,KAAK,MAAM;AACtC,iBAAK,MAAM,MAAM;AACjB,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,QAAQ,KAAK,IAAI,GAAG;AAC7B,iBAAK,QAAQ;AAAA,UACf,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,qBAAqB,CAAC;AAAA,UACvD;AAAA,QACF;AAAA,QACA,eAAgB;AACd,cAAI,KAAK,SAAS,UAAU,KAAK,SAAS,SAAS;AACjD,gBAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC7B,oBAAM,KAAK,MAAM,IAAI,UAAU,yDAAyD,CAAC;AAAA,YAC3F;AACA,iBAAK,MAAM,UAAU,MAAM,KAAK,MAAM;AACtC,iBAAK,MAAM,MAAM;AACjB,mBAAO,KAAK,KAAK,KAAK,kBAAkB;AAAA,UAC1C,WAAW,KAAK,YAAY,GAAG;AAC7B,mBAAO,KAAK,UAAU,WAAW,KAAK,MAAM,SAAS,MAAM,KAAK,MAAM,GAAG,CAAC;AAAA,UAC5E,WAAW,QAAQ,KAAK,IAAI,GAAG;AAC7B,iBAAK,QAAQ;AAAA,UACf,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,qBAAqB,CAAC;AAAA,UACvD;AAAA,QACF;AAAA,QACA,qBAAsB;AACpB,cAAI,KAAK,YAAY,GAAG;AACtB,mBAAO,KAAK,UAAU,WAAW,KAAK,MAAM,MAAM,CAAC;AAAA,UACrD,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,aAAa;AAAA,UACrC;AAAA,QACF;AAAA,QACA,gBAAiB;AACf,cAAI,KAAK,SAAS,YAAY;AAC5B,gBAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC7B,oBAAM,KAAK,MAAM,IAAI,UAAU,0DAA0D,CAAC;AAAA,YAC5F;AACA,iBAAK,MAAM,UAAU,MAAM,KAAK,MAAM;AACtC,iBAAK,MAAM,MAAM;AACjB,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,QAAQ,KAAK,IAAI,GAAG;AAC7B,iBAAK,QAAQ;AAAA,UACf,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,qBAAqB,CAAC;AAAA,UACvD;AAAA,QACF;AAAA,QACA,eAAgB;AACd,cAAI,KAAK,MAAM,IAAI,SAAS,KAAK,QAAQ,KAAK,IAAI,GAAG;AACnD,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,KAAK,SAAS,YAAY;AAClE,iBAAK,MAAM,UAAU,MAAM,KAAK,MAAM;AACtC,iBAAK,MAAM,MAAM;AACjB,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,qBAAqB,CAAC;AAAA,UACvD;AAAA,QACF;AAAA,QACA,eAAgB;AACd,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AACb,gBAAI,KAAK,MAAM,IAAI,WAAW,GAAG;AAC/B,mBAAK,MAAM,UAAU,MAAM,KAAK,MAAM;AACtC,mBAAK,MAAM,MAAM;AACjB,qBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,YAC/C;AAAA,UACF,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,qBAAqB,CAAC;AAAA,UACvD;AAAA,QACF;AAAA,QAEA,oBAAqB;AAEnB,cAAI,KAAK,SAAS,YAAY;AAC5B,gBAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC7B,oBAAM,KAAK,MAAM,IAAI,UAAU,0DAA0D,CAAC;AAAA,YAC5F;AACA,iBAAK,MAAM,SAAS,KAAK,MAAM;AAC/B,iBAAK,MAAM,MAAM;AACjB,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iBAAiB,CAAC;AAAA,UACnD;AAAA,QACF;AAAA,QACA,mBAAoB;AAClB,cAAI,KAAK,MAAM,IAAI,SAAS,KAAK,QAAQ,KAAK,IAAI,GAAG;AACnD,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,KAAK,SAAS,YAAY;AAClE,iBAAK,MAAM,UAAU,MAAM,KAAK,MAAM;AACtC,iBAAK,MAAM,MAAM;AACjB,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iBAAiB,CAAC;AAAA,UACnD;AAAA,QACF;AAAA,QACA,mBAAoB;AAClB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AACb,gBAAI,KAAK,MAAM,IAAI,WAAW,GAAG;AAC/B,qBAAO,KAAK,KAAK,KAAK,0BAA0B;AAAA,YAClD;AAAA,UACF,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iBAAiB,CAAC;AAAA,UACnD;AAAA,QACF;AAAA,QACA,6BAA8B;AAC5B,eAAK,MAAM,UAAU,MAAM,KAAK,MAAM;AACtC,cAAI,KAAK,SAAS,aAAa;AAC7B,iBAAK,MAAM,MAAM;AACjB,iBAAK,KAAK,KAAK,qBAAqB;AAAA,UACtC,OAAO;AACL,mBAAO,KAAK,OAAO,WAAW,KAAK,MAAM,MAAM,CAAC;AAAA,UAClD;AAAA,QACF;AAAA,QACA,wBAAyB;AACvB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,YAAY,GAAG;AAC7B,gBAAI,KAAK,MAAM,IAAI,WAAW,EAAG,OAAM,KAAK,MAAM,IAAI,UAAU,gCAAgC,CAAC;AACjG,mBAAO,KAAK,UAAU,WAAW,KAAK,MAAM,SAAS,MAAM,KAAK,MAAM,GAAG,CAAC;AAAA,UAC5E,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iFAAiF,CAAC;AAAA,UACnH;AAAA,QACF;AAAA,QAEA,0BAA2B;AACzB,cAAI,KAAK,SAAS,aAAa;AAC7B,iBAAK,QAAQ;AACb,iBAAK,KAAK,KAAK,qBAAqB;AAAA,UACtC,WAAW,KAAK,SAAS,eAAe,KAAK,SAAS,WAAW;AAC/D,iBAAK,QAAQ;AACb,iBAAK,KAAK,KAAK,iBAAiB;AAAA,UAClC,WAAW,KAAK,SAAS,QAAQ;AAC/B,iBAAK,QAAQ;AACb,mBAAO,KAAK,OAAO,eAAe,KAAK,MAAM,SAAS,KAAK,MAAM,GAAG,CAAC;AAAA,UACvE,WAAW,KAAK,YAAY,GAAG;AAC7B,mBAAO,KAAK,UAAU,oBAAoB,KAAK,MAAM,SAAS,KAAK,MAAM,GAAG,CAAC;AAAA,UAC/E,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iFAAiF,CAAC;AAAA,UACnH;AAAA,QACF;AAAA,QACA,wBAAyB;AACvB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,MAAM,IAAI,WAAW,GAAG;AACtC,kBAAM,KAAK,MAAM,IAAI,UAAU,gCAAgC,CAAC;AAAA,UAClE,WAAW,KAAK,SAAS,eAAe,KAAK,SAAS,WAAW;AAC/D,iBAAK,QAAQ;AACb,iBAAK,KAAK,KAAK,iBAAiB;AAAA,UAClC,WAAW,KAAK,SAAS,QAAQ;AAC/B,iBAAK,QAAQ;AACb,mBAAO,KAAK,OAAO,eAAe,KAAK,MAAM,SAAS,KAAK,MAAM,GAAG,CAAC;AAAA,UACvE,WAAW,KAAK,YAAY,GAAG;AAC7B,mBAAO,KAAK,UAAU,oBAAoB,KAAK,MAAM,SAAS,KAAK,MAAM,GAAG,CAAC;AAAA,UAC/E,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iFAAiF,CAAC;AAAA,UACnH;AAAA,QACF;AAAA,QACA,oBAAqB;AACnB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AAEb,gBAAI,QAAQ,KAAK,KAAK,MAAM,GAAG,EAAG,QAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UAC1E,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,kDAAkD,CAAC;AAAA,UACpF;AAAA,QACF;AAAA,QACA,mBAAoB;AAClB,cAAI,KAAK,SAAS,YAAY;AAC5B,iBAAK,QAAQ;AACb,iBAAK,KAAK,KAAK,gBAAgB;AAAA,UACjC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,kDAAkD,CAAC;AAAA,UACpF;AAAA,QACF;AAAA,QACA,mBAAoB;AAClB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AACb,gBAAI,QAAQ,KAAK,KAAK,MAAM,GAAG,EAAG,QAAO,KAAK,OAAO,eAAe,KAAK,MAAM,SAAS,KAAK,MAAM,GAAG,CAAC;AAAA,UACzG,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,kDAAkD,CAAC;AAAA,UACpF;AAAA,QACF;AAAA;AAAA,QAGA,eAAgB;AAEd,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,WAAW;AAAA,UACnC,WAAW,KAAK,SAAS,QAAQ;AAC/B,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC;AAAA,QACF;AAAA,QACA,cAAe;AACb,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,WAAW;AAAA,UACnC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yCAAyC,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA,QACA,cAAe;AACb,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,WAAW;AAAA,UACnC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yCAAyC,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA,QACA,cAAe;AACb,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO,KAAK,OAAO,IAAI;AAAA,UACzB,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yCAAyC,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA,QAEA,eAAgB;AACd,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yCAAyC,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA,QAEA,eAAgB;AACd,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yCAAyC,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA,QAEA,eAAgB;AACd,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yCAAyC,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA,QAEA,eAAgB;AACd,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO,KAAK,OAAO,KAAK;AAAA,UAC1B,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yCAAyC,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA;AAAA,QAGA,kBAAmB;AACjB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACjG,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,OAAO,KAAK;AACnC,kBAAM,KAAK,MAAM,IAAI,UAAU,2BAA2B,CAAC;AAAA,UAC7D,WAAW,KAAK,SAAS,UAAU;AACjC,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,OAAO,KAAK,MAAM,aAAa,WAAW,CAAC;AAAA,UACzD,OAAO;AACL,mBAAO,KAAK,QAAQ,KAAK,YAAY,KAAK,qBAAqB;AAAA,UACjE;AAAA,QACF;AAAA,QACA,sBAAuB,OAAO;AAC5B,cAAI,KAAK,MAAM,WAAW;AACxB,kBAAM,WAAW,KAAK,MAAM,UAAU,YAAY;AAClD,kBAAM,YAAY,SAAS,KAAK;AAChC,gBAAI,aAAa,WAAW;AAC1B,oBAAM,KAAK,MAAM,IAAI,UAAU,oDAAoD,QAAQ,QAAQ,SAAS,EAAE,CAAC;AAAA,YACjH;AAAA,UACF,OAAO;AACL,iBAAK,MAAM,YAAY,WAAW,SAAS,KAAK,CAAC;AAAA,UACnD;AACA,cAAI,QAAQ,KAAK,KAAK,UAAU,KAAK,GAAG;AAEtC,iBAAK,MAAM,UAAU,KAAK,MAAM,QAAQ,CAAC;AAAA,UAC3C,OAAO;AACL,iBAAK,MAAM,UAAU,KAAK,KAAK;AAAA,UACjC;AACA,iBAAO,KAAK,KAAK,KAAK,mBAAmB;AAAA,QAC3C;AAAA,QACA,sBAAuB;AACrB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACjG,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,UAAU;AACjC,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,KAAK,SAAS,YAAY;AACnC,mBAAO,KAAK,KAAK,KAAK,eAAe;AAAA,UACvC,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,KAAK,KAAK,eAAe;AAAA,UACvC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,wEAAwE,CAAC;AAAA,UAC1G;AAAA,QACF;AAAA;AAAA,QAGA,mBAAoB;AAClB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,OAAO,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AAC7G,kBAAM,KAAK,MAAM,IAAI,UAAU,2BAA2B,CAAC;AAAA,UAC7D,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,OAAO,KAAK,MAAM,eAAe,YAAY,CAAC;AAAA,UAC5D,OAAO;AACL,gBAAI,CAAC,KAAK,MAAM,YAAa,MAAK,MAAM,cAAc,YAAY;AAClE,mBAAO,KAAK,QAAQ,KAAK,aAAa,KAAK,sBAAsB;AAAA,UACnE;AAAA,QACF;AAAA,QACA,uBAAwB,IAAI;AAC1B,cAAI,SAAS,KAAK,MAAM;AACxB,cAAI,WAAW,GAAG,IAAI,IAAI;AAC1B,mBAAS,MAAM,GAAG,KAAK;AACrB,gBAAI,OAAO,QAAQ,EAAE,MAAM,CAAC,QAAQ,OAAO,EAAE,CAAC,KAAK,OAAO,EAAE,EAAE,SAAS,IAAI;AACzE,oBAAM,KAAK,MAAM,IAAI,UAAU,6BAA6B,CAAC;AAAA,YAC/D;AACA,qBAAS,OAAO,EAAE,IAAI,OAAO,EAAE,KAAK,MAAM;AAAA,UAC5C;AACA,cAAI,OAAO,QAAQ,QAAQ,GAAG;AAC5B,kBAAM,KAAK,MAAM,IAAI,UAAU,6BAA6B,CAAC;AAAA,UAC/D;AACA,cAAI,UAAU,GAAG,KAAK,KAAK,QAAQ,GAAG,KAAK,GAAG;AAC5C,mBAAO,QAAQ,IAAI,GAAG,MAAM,QAAQ;AAAA,UACtC,OAAO;AACL,mBAAO,QAAQ,IAAI,GAAG;AAAA,UACxB;AACA,iBAAO,KAAK,KAAK,KAAK,oBAAoB;AAAA,QAC5C;AAAA,QACA,uBAAwB;AACtB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,OAAO,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AAC7G,kBAAM,KAAK,MAAM,IAAI,UAAU,2BAA2B,CAAC;AAAA,UAC7D,WAAW,KAAK,SAAS,YAAY;AACnC,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,wEAAwE,CAAC;AAAA,UAC1G;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA;AAAA;;;ACl2CA;AAAA,8FAAAC,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU;AAEjB,aAAS,YAAa,KAAK,KAAK;AAE9B,UAAI,IAAI,OAAO,QAAQ,IAAI,QAAQ,KAAM,QAAO;AAChD,UAAI,MAAM,IAAI;AACd,aAAO,WAAW,IAAI,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;AAAA;AAGlE,UAAI,OAAO,IAAI,OAAO;AACpB,cAAM,QAAQ,IAAI,MAAM,IAAI;AAC5B,cAAM,eAAe,OAAO,KAAK,IAAI,MAAM,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE;AAClE,YAAI,cAAc;AAClB,eAAO,YAAY,SAAS,aAAc,gBAAe;AACzD,iBAAS,KAAK,KAAK,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI;AACxF,cAAI,UAAU,OAAO,KAAK,CAAC;AAC3B,cAAI,QAAQ,SAAS,aAAc,WAAU,MAAM;AACnD,cAAI,IAAI,SAAS,IAAI;AACnB,mBAAO,UAAU,OAAO,MAAM,EAAE,IAAI;AACpC,mBAAO,cAAc;AACrB,qBAAS,KAAK,GAAG,KAAK,IAAI,KAAK,EAAE,IAAI;AACnC,qBAAO;AAAA,YACT;AACA,mBAAO;AAAA,UACT,OAAO;AACL,mBAAO,UAAU,OAAO,MAAM,EAAE,IAAI;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AACA,UAAI,UAAU,MAAM;AACpB,aAAO;AAAA,IACT;AAAA;AAAA;;;AChCA;AAAA,wFAAAC,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU;AAEjB,QAAM,aAAa;AACnB,QAAM,cAAc;AAEpB,aAAS,YAAa,KAAK;AACzB,UAAI,OAAO,UAAU,OAAO,OAAO,SAAS,GAAG,GAAG;AAChD,cAAM,IAAI,SAAS,MAAM;AAAA,MAC3B;AACA,YAAM,SAAS,IAAI,WAAW;AAC9B,UAAI;AACF,eAAO,MAAM,GAAG;AAChB,eAAO,OAAO,OAAO;AAAA,MACvB,SAAS,KAAK;AACZ,cAAM,YAAY,KAAK,GAAG;AAAA,MAC5B;AAAA,IACF;AAAA;AAAA;;;ACjBA;AAAA,uFAAAC,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU;AAEjB,QAAM,aAAa;AACnB,QAAM,cAAc;AAEpB,aAAS,WAAY,KAAK,MAAM;AAC9B,UAAI,CAAC,KAAM,QAAO,CAAC;AACnB,YAAM,QAAQ;AACd,YAAM,YAAY,KAAK,aAAa;AACpC,YAAM,SAAS,IAAI,WAAW;AAC9B,aAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,qBAAa,gBAAgB,OAAO,WAAWA,UAAS,MAAM;AAAA,MAChE,CAAC;AACD,eAAS,eAAgBC,QAAOC,YAAWF,UAAS,QAAQ;AAC1D,YAAIC,UAAS,IAAI,QAAQ;AACvB,cAAI;AACF,mBAAOD,SAAQ,OAAO,OAAO,CAAC;AAAA,UAChC,SAAS,KAAK;AACZ,mBAAO,OAAO,YAAY,KAAK,GAAG,CAAC;AAAA,UACrC;AAAA,QACF;AACA,YAAI;AACF,iBAAO,MAAM,IAAI,MAAMC,QAAOA,SAAQC,UAAS,CAAC;AAChD,uBAAa,gBAAgBD,SAAQC,YAAWA,YAAWF,UAAS,MAAM;AAAA,QAC5E,SAAS,KAAK;AACZ,iBAAO,YAAY,KAAK,GAAG,CAAC;AAAA,QAC9B;AAAA,MACF;AAAA,IACF;AAAA;AAAA;;;AC7BA;AAAA,wFAAAG,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU;AAEjB,QAAM,SAAS,QAAQ,QAAQ;AAC/B,QAAM,aAAa;AAEnB,aAAS,YAAa,KAAK;AACzB,UAAI,KAAK;AACP,eAAO,cAAc,GAAG;AAAA,MAC1B,OAAO;AACL,eAAO,eAAe,GAAG;AAAA,MAC3B;AAAA,IACF;AAEA,aAAS,cAAe,KAAK;AAC3B,YAAM,SAAS,IAAI,WAAW;AAC9B,UAAI,YAAY,MAAM;AACtB,aAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,YAAI;AACJ,YAAI,QAAQ;AACZ,YAAI,UAAU;AACd,iBAAS,SAAU;AACjB,kBAAQ;AACR,cAAI,SAAU;AACd,cAAI;AACF,YAAAA,SAAQ,OAAO,OAAO,CAAC;AAAA,UACzB,SAAS,KAAK;AACZ,mBAAO,GAAG;AAAA,UACZ;AAAA,QACF;AACA,iBAAS,MAAO,KAAK;AACnB,oBAAU;AACV,iBAAO,GAAG;AAAA,QACZ;AACA,YAAI,KAAK,OAAO,MAAM;AACtB,YAAI,KAAK,SAAS,KAAK;AACvB,iBAAS;AAET,iBAAS,WAAY;AACnB,qBAAW;AACX,cAAI;AACJ,kBAAQ,OAAO,IAAI,KAAK,OAAO,MAAM;AACnC,gBAAI;AACF,qBAAO,MAAM,IAAI;AAAA,YACnB,SAAS,KAAK;AACZ,qBAAO,MAAM,GAAG;AAAA,YAClB;AAAA,UACF;AACA,qBAAW;AAEX,cAAI,MAAO,QAAO,OAAO;AAEzB,cAAI,QAAS;AACb,cAAI,KAAK,YAAY,QAAQ;AAAA,QAC/B;AAAA,MACF,CAAC;AAAA,IACH;AAEA,aAAS,iBAAkB;AACzB,YAAM,SAAS,IAAI,WAAW;AAC9B,aAAO,IAAI,OAAO,UAAU;AAAA,QAC1B,YAAY;AAAA,QACZ,UAAW,OAAO,UAAU,IAAI;AAC9B,cAAI;AACF,mBAAO,MAAM,MAAM,SAAS,QAAQ,CAAC;AAAA,UACvC,SAAS,KAAK;AACZ,iBAAK,KAAK,SAAS,GAAG;AAAA,UACxB;AACA,aAAG;AAAA,QACL;AAAA,QACA,MAAO,IAAI;AACT,cAAI;AACF,iBAAK,KAAK,OAAO,OAAO,CAAC;AAAA,UAC3B,SAAS,KAAK;AACZ,iBAAK,KAAK,SAAS,GAAG;AAAA,UACxB;AACA,aAAG;AAAA,QACL;AAAA,MACF,CAAC;AAAA,IACH;AAAA;AAAA;;;AC/EA;AAAA,iFAAAC,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU;AACjB,IAAAA,QAAO,QAAQ,QAAQ;AACvB,IAAAA,QAAO,QAAQ,SAAS;AACxB,IAAAA,QAAO,QAAQ,cAAc;AAAA;AAAA;;;ACJ7B;AAAA,qFAAAC,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU;AACjB,IAAAA,QAAO,QAAQ,QAAQ;AAEvB,aAAS,UAAW,KAAK;AACvB,UAAI,QAAQ,KAAM,OAAM,UAAU,MAAM;AACxC,UAAI,QAAQ,OAAU,OAAM,UAAU,WAAW;AACjD,UAAI,OAAO,QAAQ,SAAU,OAAM,UAAU,OAAO,GAAG;AAEvD,UAAI,OAAO,IAAI,WAAW,WAAY,OAAM,IAAI,OAAO;AACvD,UAAI,OAAO,KAAM,QAAO;AACxB,YAAM,OAAOC,UAAS,GAAG;AACzB,UAAI,SAAS,QAAS,OAAM,UAAU,IAAI;AAC1C,aAAO,gBAAgB,IAAI,IAAI,GAAG;AAAA,IACpC;AAEA,aAAS,UAAW,MAAM;AACxB,aAAO,IAAI,MAAM,qCAAqC,IAAI;AAAA,IAC5D;AAEA,aAAS,oBAAqB;AAC5B,aAAO,IAAI,MAAM,qCAAqC;AAAA,IACxD;AAEA,aAAS,cAAe,KAAK;AAC3B,aAAO,OAAO,KAAK,GAAG,EAAE,OAAO,SAAO,SAAS,IAAI,GAAG,CAAC,CAAC;AAAA,IAC1D;AACA,aAAS,eAAgB,KAAK;AAC5B,aAAO,OAAO,KAAK,GAAG,EAAE,OAAO,SAAO,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;AAAA,IAC3D;AAEA,aAAS,OAAQ,KAAK;AACpB,UAAI,OAAO,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,OAAO,UAAU,eAAe,KAAK,KAAK,WAAW,IAAI,EAAC,CAAC,WAAW,GAAG,OAAS,IAAI,CAAC;AAC5H,eAAS,QAAQ,OAAO,KAAK,GAAG,GAAG;AACjC,YAAI,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,EAAE,WAAW,cAAc,EAAE,iBAAiB,IAAI,IAAI,IAAI;AACxF,eAAK,IAAI,IAAI,IAAI,IAAI,EAAE,OAAO;AAAA,QAChC,OAAO;AACL,eAAK,IAAI,IAAI,IAAI,IAAI;AAAA,QACvB;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAEA,aAAS,gBAAiB,QAAQ,QAAQ,KAAK;AAC7C,YAAM,OAAO,GAAG;AAChB,UAAI;AACJ,UAAI;AACJ,mBAAa,cAAc,GAAG;AAC9B,oBAAc,eAAe,GAAG;AAChC,UAAI,SAAS,CAAC;AACd,UAAI,eAAe,UAAU;AAC7B,iBAAW,QAAQ,SAAO;AACxB,YAAI,OAAOA,UAAS,IAAI,GAAG,CAAC;AAC5B,YAAI,SAAS,eAAe,SAAS,QAAQ;AAC3C,iBAAO,KAAK,eAAe,aAAa,GAAG,IAAI,QAAQ,mBAAmB,IAAI,GAAG,GAAG,IAAI,CAAC;AAAA,QAC3F;AAAA,MACF,CAAC;AACD,UAAI,OAAO,SAAS,EAAG,QAAO,KAAK,EAAE;AACrC,UAAI,gBAAgB,UAAU,WAAW,SAAS,IAAI,SAAS,OAAO;AACtE,kBAAY,QAAQ,SAAO;AACzB,eAAO,KAAK,iBAAiB,QAAQ,eAAe,KAAK,IAAI,GAAG,CAAC,CAAC;AAAA,MACpE,CAAC;AACD,aAAO,OAAO,KAAK,IAAI;AAAA,IACzB;AAEA,aAAS,SAAU,OAAO;AACxB,cAAQA,UAAS,KAAK,GAAG;AAAA,QACvB,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO;AAAA,QACT,KAAK;AACH,iBAAO,MAAM,WAAW,KAAKA,UAAS,MAAM,CAAC,CAAC,MAAM;AAAA,QACtD,KAAK;AACH,iBAAO,OAAO,KAAK,KAAK,EAAE,WAAW;AAAA;AAAA,QAEvC;AACE,iBAAO;AAAA,MACX;AAAA,IACF;AAEA,aAASA,UAAU,OAAO;AACxB,UAAI,UAAU,QAAW;AACvB,eAAO;AAAA,MACT,WAAW,UAAU,MAAM;AACzB,eAAO;AAAA,MAET,WAAW,OAAO,UAAU,YAAa,OAAO,UAAU,KAAK,KAAK,CAAC,OAAO,GAAG,OAAO,EAAE,GAAI;AAC1F,eAAO;AAAA,MACT,WAAW,OAAO,UAAU,UAAU;AACpC,eAAO;AAAA,MACT,WAAW,OAAO,UAAU,WAAW;AACrC,eAAO;AAAA,MACT,WAAW,OAAO,UAAU,UAAU;AACpC,eAAO;AAAA,MACT,WAAW,iBAAiB,OAAO;AACjC,eAAO,MAAM,KAAK,IAAI,cAAc;AAAA,MACtC,WAAW,MAAM,QAAQ,KAAK,GAAG;AAC/B,eAAO;AAAA,MACT,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AAEA,aAAS,aAAc,KAAK;AAC1B,UAAI,SAAS,OAAO,GAAG;AACvB,UAAI,mBAAmB,KAAK,MAAM,GAAG;AACnC,eAAO;AAAA,MACT,OAAO;AACL,eAAO,qBAAqB,MAAM;AAAA,MACpC;AAAA,IACF;AAEA,aAAS,qBAAsB,KAAK;AAClC,aAAO,MAAM,aAAa,GAAG,EAAE,QAAQ,MAAM,KAAK,IAAI;AAAA,IACxD;AAEA,aAAS,uBAAwB,KAAK;AACpC,aAAO,MAAM,MAAM;AAAA,IACrB;AAEA,aAAS,OAAQ,KAAK,KAAK;AACzB,aAAO,IAAI,SAAS,IAAK,OAAM,MAAM;AACrC,aAAO;AAAA,IACT;AAEA,aAAS,aAAc,KAAK;AAC1B,aAAO,IAAI,QAAQ,OAAO,MAAM,EAC7B,QAAQ,SAAS,KAAK,EACtB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EAEpB,QAAQ,2BAA2B,OAAK,QAAQ,OAAO,GAAG,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AAAA,IAE7F;AAEA,aAAS,yBAA0B,KAAK;AACtC,UAAI,UAAU,IAAI,MAAM,IAAI,EAAE,IAAI,CAAAC,SAAO;AACvC,eAAO,aAAaA,IAAG,EAAE,QAAQ,YAAY,KAAK;AAAA,MACpD,CAAC,EAAE,KAAK,IAAI;AACZ,UAAI,QAAQ,MAAM,EAAE,MAAM,IAAK,YAAW;AAC1C,aAAO,UAAU,UAAU;AAAA,IAC7B;AAEA,aAAS,mBAAoB,OAAO,aAAa;AAC/C,UAAI,OAAOD,UAAS,KAAK;AACzB,UAAI,SAAS,UAAU;AACrB,YAAI,eAAe,KAAK,KAAK,KAAK,GAAG;AACnC,iBAAO;AAAA,QACT,WAAW,CAAC,gBAAgB,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,GAAG;AAC1D,iBAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO,gBAAgB,OAAO,IAAI;AAAA,IACpC;AAEA,aAAS,gBAAiB,OAAO,MAAM;AAErC,UAAI,CAAC,KAAM,QAAOA,UAAS,KAAK;AAChC,cAAQ,MAAM;AAAA,QACZ,KAAK;AACH,iBAAO,yBAAyB,KAAK;AAAA,QACvC,KAAK;AACH,iBAAO,qBAAqB,KAAK;AAAA,QACnC,KAAK;AACH,iBAAO,uBAAuB,KAAK;AAAA,QACrC,KAAK;AACH,iBAAO,iBAAiB,KAAK;AAAA,QAC/B,KAAK;AACH,iBAAO,eAAe,KAAK;AAAA,QAC7B,KAAK;AACH,iBAAO,iBAAiB,KAAK;AAAA,QAC/B,KAAK;AACH,iBAAO,kBAAkB,KAAK;AAAA,QAChC,KAAK;AACH,iBAAO,qBAAqB,MAAM,OAAO,OAAKA,UAAS,CAAC,MAAM,UAAUA,UAAS,CAAC,MAAM,eAAeA,UAAS,CAAC,MAAM,KAAK,CAAC;AAAA,QAC/H,KAAK;AACH,iBAAO,qBAAqB,KAAK;AAAA;AAAA,QAEnC;AACE,gBAAM,UAAU,IAAI;AAAA,MACxB;AAAA,IACF;AAEA,aAAS,iBAAkB,OAAO;AAEhC,aAAO,OAAO,KAAK,EAAE,QAAQ,yBAAyB,GAAG;AAAA,IAC3D;AAEA,aAAS,eAAgB,OAAO;AAC9B,UAAI,UAAU,UAAU;AACtB,eAAO;AAAA,MACT,WAAW,UAAU,WAAW;AAC9B,eAAO;AAAA,MACT,WAAW,OAAO,GAAG,OAAO,GAAG,GAAG;AAChC,eAAO;AAAA,MACT,WAAW,OAAO,GAAG,OAAO,EAAE,GAAG;AAC/B,eAAO;AAAA,MACT;AACA,UAAI,SAAS,OAAO,KAAK,EAAE,MAAM,GAAG;AACpC,UAAI,MAAM,OAAO,CAAC;AAClB,UAAI,MAAM,OAAO,CAAC,KAAK;AACvB,aAAO,iBAAiB,GAAG,IAAI,MAAM;AAAA,IACvC;AAEA,aAAS,iBAAkB,OAAO;AAChC,aAAO,OAAO,KAAK;AAAA,IACrB;AAEA,aAAS,kBAAmB,OAAO;AACjC,aAAO,MAAM,YAAY;AAAA,IAC3B;AAEA,aAAS,SAAU,MAAM;AACvB,aAAO,SAAS,WAAW,SAAS;AAAA,IACtC;AACA,aAAS,UAAW,QAAQ;AAC1B,UAAI,cAAcA,UAAS,OAAO,CAAC,CAAC;AACpC,UAAI,OAAO,MAAM,OAAKA,UAAS,CAAC,MAAM,WAAW,EAAG,QAAO;AAE3D,UAAI,OAAO,MAAM,OAAK,SAASA,UAAS,CAAC,CAAC,CAAC,EAAG,QAAO;AACrD,aAAO;AAAA,IACT;AACA,aAAS,cAAe,QAAQ;AAC9B,YAAM,OAAO,UAAU,MAAM;AAC7B,UAAI,SAAS,SAAS;AACpB,cAAM,kBAAkB;AAAA,MAC1B;AACA,aAAO;AAAA,IACT;AAEA,aAAS,qBAAsB,QAAQ;AACrC,eAAS,OAAO,MAAM;AACtB,YAAM,OAAO,cAAc,MAAM;AACjC,UAAI,SAAS;AACb,UAAI,cAAc,OAAO,IAAI,OAAK,gBAAgB,GAAG,IAAI,CAAC;AAC1D,UAAI,YAAY,KAAK,IAAI,EAAE,SAAS,MAAM,KAAK,KAAK,WAAW,GAAG;AAChE,kBAAU,SAAS,YAAY,KAAK,OAAO,IAAI;AAAA,MACjD,OAAO;AACL,kBAAU,MAAM,YAAY,KAAK,IAAI,KAAK,YAAY,SAAS,IAAI,MAAM;AAAA,MAC3E;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,aAAS,qBAAsB,OAAO;AACpC,cAAQ,OAAO,KAAK;AACpB,UAAI,SAAS,CAAC;AACd,aAAO,KAAK,KAAK,EAAE,QAAQ,SAAO;AAChC,eAAO,KAAK,aAAa,GAAG,IAAI,QAAQ,mBAAmB,MAAM,GAAG,GAAG,KAAK,CAAC;AAAA,MAC/E,CAAC;AACD,aAAO,OAAO,OAAO,KAAK,IAAI,KAAK,OAAO,SAAS,IAAI,MAAM,MAAM;AAAA,IACrE;AAEA,aAAS,iBAAkB,QAAQ,QAAQ,KAAK,OAAO;AACrD,UAAI,YAAYA,UAAS,KAAK;AAE9B,UAAI,cAAc,SAAS;AACzB,eAAO,uBAAuB,QAAQ,QAAQ,KAAK,KAAK;AAAA,MAC1D,WAAW,cAAc,SAAS;AAChC,eAAO,sBAAsB,QAAQ,QAAQ,KAAK,KAAK;AAAA,MACzD,OAAO;AACL,cAAM,UAAU,SAAS;AAAA,MAC3B;AAAA,IACF;AAEA,aAAS,uBAAwB,QAAQ,QAAQ,KAAK,QAAQ;AAC5D,eAAS,OAAO,MAAM;AACtB,oBAAc,MAAM;AACpB,UAAI,iBAAiBA,UAAS,OAAO,CAAC,CAAC;AAEvC,UAAI,mBAAmB,QAAS,OAAM,UAAU,cAAc;AAC9D,UAAI,UAAU,SAAS,aAAa,GAAG;AACvC,UAAI,SAAS;AACb,aAAO,QAAQ,WAAS;AACtB,YAAI,OAAO,SAAS,EAAG,WAAU;AACjC,kBAAU,SAAS,OAAO,UAAU;AACpC,kBAAU,gBAAgB,UAAU,KAAK,QAAQ,KAAK;AAAA,MACxD,CAAC;AACD,aAAO;AAAA,IACT;AAEA,aAAS,sBAAuB,QAAQ,QAAQ,KAAK,OAAO;AAC1D,UAAI,UAAU,SAAS,aAAa,GAAG;AACvC,UAAI,SAAS;AACb,UAAI,cAAc,KAAK,EAAE,SAAS,GAAG;AACnC,kBAAU,SAAS,MAAM,UAAU;AAAA,MACrC;AACA,aAAO,SAAS,gBAAgB,UAAU,KAAK,QAAQ,KAAK;AAAA,IAC9D;AAAA;AAAA;;;ACvSA;AAAA,gFAAAE,UAAA;AAAA;AACA,IAAAA,SAAQ,QAAQ;AAChB,IAAAA,SAAQ,YAAY;AAAA;AAAA;;;ACFpB,IAAAC,mBAAyD;AACzD,IAAAC,qBAAqB;;;ACDrB,qBAAsC;AACtC,qBAAwB;AACxB,uBAAqB;AAErB,SAAS,SAAkB;AACzB,SACE,QAAQ,aAAa,WACrB,OAAO,QAAQ,WAAW,cAC1B,QAAQ,OAAO,MAAM;AAEzB;AAEA,IAAM,eAAW,2BAAK,wBAAQ,GAAG,cAAc;AAE/C,IAAM,eAAe;AAAA,EACnB,MAAM;AAAA,EACN,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AACV;AAEA,IAAM,aAAa;AAAA,EACjB,MAAM;AAAA,EACN,WAAW;AAAA,EACX,gBAAY,uBAAK,UAAU,mBAAmB;AAAA,EAC9C,WAAO,uBAAK,UAAU,qBAAqB;AAAA,EAC3C,eAAW,uBAAK,UAAU,SAAS;AAAA,EACnC,YAAQ,uBAAK,UAAU,MAAM;AAAA,EAC7B,aAAS,uBAAK,UAAU,QAAQ,kBAAkB;AAAA,EAClD,cAAU,uBAAK,UAAU,OAAO;AAAA,EAChC,aAAS,uBAAK,UAAU,SAAS,UAAU;AAAA,EAC3C,YAAQ,uBAAK,UAAU,KAAK;AAAA,EAC5B,aAAS,uBAAK,UAAU,OAAO,kBAAkB;AAAA,EACjD,YAAQ,uBAAK,UAAU,OAAO,mBAAmB;AACnD;AAQO,IAAM,QAAQ,OAAO,IAAI,eAAe;AAYxC,SAAS,oBAA0B;AACxC,aAAW,OAAO,CAAC,MAAM,WAAW,MAAM,OAAO,MAAM,WAAW,MAAM,QAAQ,MAAM,UAAU,MAAM,MAAM,GAAG;AAC7G,QAAI;AACF,oCAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,IACpC,QAAQ;AAAA,IAER;AAAA,EACF;AACF;;;ACtEA,IAAAC,kBAAoE;AAG7D,SAAS,eAAqB;AACnC,oBAAkB;AAClB,qCAAc,MAAM,SAAS,OAAO,QAAQ,GAAG,GAAG,OAAO;AAC3D;AAEO,SAAS,cAA6B;AAC3C,MAAI,KAAC,4BAAW,MAAM,OAAO,EAAG,QAAO;AACvC,QAAM,UAAM,8BAAa,MAAM,SAAS,OAAO,EAAE,KAAK;AACtD,QAAM,MAAM,SAAS,KAAK,EAAE;AAC5B,SAAO,OAAO,SAAS,GAAG,IAAI,MAAM;AACtC;AAEO,SAAS,gBAAsB;AACpC,MAAI;AACF,YAAI,4BAAW,MAAM,OAAO,EAAG,iCAAW,MAAM,OAAO;AAAA,EACzD,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,eAAe,KAAsB;AACnD,MAAI;AACF,YAAQ,KAAK,KAAK,CAAC;AACnB,WAAO;AAAA,EACT,SAAS,KAAK;AAIZ,UAAM,OAAQ,IAA8B;AAC5C,WAAO,SAAS;AAAA,EAClB;AACF;AAEO,SAAS,oBAAmC;AACjD,QAAM,MAAM,YAAY;AACxB,MAAI,OAAO,eAAe,GAAG,EAAG,QAAO;AACvC,MAAI,IAAK,eAAc;AACvB,SAAO;AACT;;;ACzCA,sBAA6C;AAC7C,IAAAC,kBAAuC;;;ACDvC,yBAA6C;AAC7C,IAAAC,kBAAmE;AACnE,IAAAC,oBAAqB;AAgBd,IAAM,yBAAqB,wBAAK,MAAM,QAAQ,eAAe;AAG7D,SAAS,oBAA4B;AAC1C,QAAM,YAAQ,gCAAY,EAAE,EAAE,SAAS,KAAK;AAC5C,qCAAc,oBAAoB,OAAO,EAAE,MAAM,IAAM,CAAC;AACxD,MAAI;AACF,mCAAU,oBAAoB,GAAK;AAAA,EACrC,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAcO,SAAS,YAAY,UAAkB,UAA4B;AACxE,MAAI,OAAO,aAAa,YAAY,CAAC,SAAU,QAAO;AACtD,QAAM,IAAI,OAAO,KAAK,QAAQ;AAC9B,QAAM,IAAI,OAAO,KAAK,QAAQ;AAC9B,SAAO,EAAE,WAAW,EAAE,cAAU,oCAAgB,GAAG,CAAC;AACtD;;;ACjDA,yBAA6B;AAStB,IAAM,WAAN,cAAuB,gCAAa;AAAA,EACzC,QAAQ,OAA0B;AAChC,SAAK,KAAK,SAAS,KAAK;AACxB,QAAI,MAAM,aAAa,UAAU,MAAM,aAAa,YAAY;AAC9D,WAAK,KAAK,SAAS,KAAK;AAAA,IAC1B;AAAA,EACF;AAAA,EAEA,eAAe,MAAc,QAAgB,QAAuB;AAClE,SAAK,KAAK,UAAU,EAAE,MAAM,QAAQ,OAAO,CAAC;AAAA,EAC9C;AACF;AAEO,IAAM,MAAM,IAAI,SAAS;AAChC,IAAI,gBAAgB,EAAE;;;ACvBtB,4BAAqB;AAGrB,IAAI,KAA+B;AACnC,IAAI,gBAAgB;AAMb,SAAS,YAAY,SAAiB,iCAAoD;AAC/F,MAAI,GAAI,QAAO;AACf,MAAI,eAAe;AACjB,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,MAAI;AACF,QAAI;AACF,WAAK,IAAI,sBAAAC,QAAS,MAAM;AAAA,IAC1B,QAAQ;AAEN,WAAK,IAAI,sBAAAA,QAAS,UAAU;AAAA,IAC9B;AAAA,EACF,SAAS,KAAK;AAGZ,oBAAgB;AAChB,UAAM;AAAA,EACR;AAEA,KAAG,OAAO,oBAAoB;AAE9B,KAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GA6BP;AAED,SAAO;AACT;AAEO,SAAS,YAAY,OAA4B;AACtD,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,OAAO,SAAS,QAAQ;AAAA;AAAA;AAAA,GAG7B;AACD,QAAM,SAAS,KAAK;AAAA,IAClB,MAAM,UAAU,YAAY;AAAA,IAC5B,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM,aAAa;AAAA,IACnB,MAAM,UAAU,KAAK,UAAU,MAAM,OAAO,IAAI;AAAA,EAClD;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,QAAkC;AACzC,MAAI,GAAI,QAAO;AACf,MAAI,cAAe,QAAO;AAC1B,MAAI;AACF,WAAO,YAAY;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,QAAgB,IAAmB;AACjE,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,SAAU,QAAO,CAAC;AACvB,QAAM,OAAO,SAAS,QAAQ;AAAA;AAAA,GAE7B,EAAE,IAAI,KAAK;AACZ,SAAO,KAAK,IAAI,UAAU;AAC5B;AAEO,SAAS,cAAc,OAAsB;AAClD,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,OAAO;AACT,WAAQ,SAAS,QAAQ,2DAA2D,EACjF,IAAI,MAAM,YAAY,CAAC,EAAU;AAAA,EACtC;AACA,SAAQ,SAAS,QAAQ,sCAAsC,EAAE,IAAI,EAAU;AACjF;AAEO,SAAS,eAAe,OAAsB;AACnD,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,aAAa;AACnB,MAAI,OAAO;AACT,WAAQ,SAAS;AAAA,MACf,0DAA0D,UAAU;AAAA,IACtE,EAAE,IAAI,MAAM,YAAY,CAAC,EAAU;AAAA,EACrC;AACA,SAAQ,SAAS;AAAA,IACf,0DAA0D,UAAU;AAAA,EACtE,EAAE,IAAI,EAAU;AAClB;AAEO,SAAS,cAAc,QAAgB,IAA0C;AACtF,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,SAAU,QAAO,CAAC;AACvB,SAAO,SAAS,QAAQ;AAAA;AAAA;AAAA;AAAA,GAIvB,EAAE,IAAI,KAAK;AACd;AAEO,SAAS,eAAeC,SAAgB,KAAsB;AACnE,QAAM,WAAW,MAAM,YAAY;AACnC,QAAM,MAAM,SAAS,QAAQ,6DAA6D,EACvF,IAAIA,SAAQ,GAAG;AAClB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,WAAO,KAAK,MAAM,IAAI,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO,IAAI;AAAA,EACb;AACF;AAEO,SAAS,eAAeA,SAAgB,KAAa,OAAsB;AAChF,QAAM,WAAW,MAAM,YAAY;AACnC,WAAS,QAAQ;AAAA;AAAA,GAEhB,EAAE,IAAIA,SAAQ,KAAK,KAAK,UAAU,KAAK,CAAC;AAC3C;AAEA,SAAS,WAAW,KAAuB;AACzC,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,WAAW,IAAI,KAAK,IAAI,SAAS;AAAA,IACjC,QAAQ,IAAI;AAAA,IACZ,UAAU,IAAI;AAAA,IACd,UAAU,IAAI;AAAA,IACd,SAAS,IAAI;AAAA,IACb,WAAW,IAAI;AAAA,IACf,SAAS,IAAI,UAAU,KAAK,MAAM,IAAI,OAAO,IAAI;AAAA,EACnD;AACF;AAEO,SAAS,UAAgB;AAC9B,MAAI,IAAI;AACN,OAAG,MAAM;AACT,SAAK;AAAA,EACP;AACF;;;AHzJO,IAAM,YAAN,MAAgB;AAAA,EAQrB,YACU,SACA,YACR;AAFQ;AACA;AAER,QAAI,GAAG,SAAS,CAAC,UAAuB;AACtC,WAAK,SAAS;AACd,UAAI,MAAM,aAAa,YAAY,MAAM,aAAa,UAAU,MAAM,aAAa,YAAY;AAC7F,aAAK,SAAS;AAAA,MAChB;AACA,WAAK,UAAU,EAAE,MAAM,SAAS,SAAS,MAAM,GAAG,OAAO;AAAA,IAC3D,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AACpB,WAAK,SAAS;AAAA,IAChB,CAAC;AACD,QAAI,GAAG,UAAU,CAAC,SAAS;AACzB,WAAK,UAAU,EAAE,MAAM,UAAU,SAAS,KAAK,GAAG,QAAQ;AAAA,IAC5D,CAAC;AAAA,EACH;AAAA,EAhBU;AAAA,EACA;AAAA,EATF,SAAwB;AAAA,EACxB,UAAU,oBAAI,IAAyB;AAAA,EACvC,eAAe;AAAA,EACf,YAAY,oBAAI,KAAK;AAAA,EACrB,WAAW,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EAAE;AAAA,EAC9C,eAAe;AAAA,EAqBvB,MAAM,QAAuB;AAE3B,SAAK,eAAe,kBAAkB;AAEtC,YAAI,4BAAW,MAAM,MAAM,GAAG;AAC5B,UAAI;AAAE,wCAAW,MAAM,MAAM;AAAA,MAAG,QAAQ;AAAA,MAAC;AAAA,IAC3C;AACA,WAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,WAAK,aAAS,8BAAa,CAAC,SAAS,KAAK,aAAa,IAAI,CAAC;AAC5D,WAAK,OAAO,GAAG,SAAS,MAAM;AAC9B,WAAK,OAAO,OAAO,MAAM,QAAQ,MAAM;AACrC,cAAM,SAAS,QAAQ,IAAS;AAChC,YAAI;AAAE,iBAAO,UAAU,MAAM,QAAQ,GAAK;AAAA,QAAG,QAAQ;AAAA,QAAC;AAOtD,cAAMC,UAAS,QAAQ,aAAa,WAC/B,OAAO,QAAQ,WAAW,cAC1B,QAAQ,OAAO,MAAM;AAC1B,YAAIA,SAAQ;AACV,cAAI;AACF,kBAAM,EAAE,IAAI,IAAI,OAAO,SAAS,mBAAmB;AACnD,mBAAO,UAAU,MAAM,QAAQ,GAAG,GAAG;AAAA,UACvC,QAAQ;AAAA,UAER;AAAA,QACF;AACA,QAAAD,SAAQ;AAAA,MACV,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,OAAsB;AAC1B,eAAW,KAAK,KAAK,QAAQ,OAAO,GAAG;AACrC,UAAI;AAAE,UAAE,OAAO,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAAC;AAAA,IACrC;AACA,SAAK,QAAQ,MAAM;AACnB,WAAO,IAAI,QAAQ,CAACA,aAAY;AAC9B,UAAI,CAAC,KAAK,QAAQ;AAChB,YAAI;AAAE,kBAAI,4BAAW,MAAM,MAAM,EAAG,iCAAW,MAAM,MAAM;AAAA,QAAG,QAAQ;AAAA,QAAC;AACvE,eAAOA,SAAQ;AAAA,MACjB;AACA,WAAK,OAAO,MAAM,MAAM;AACtB,YAAI;AAAE,kBAAI,4BAAW,MAAM,MAAM,EAAG,iCAAW,MAAM,MAAM;AAAA,QAAG,QAAQ;AAAA,QAAC;AACvE,QAAAA,SAAQ;AAAA,MACV,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEQ,aAAa,QAAsB;AACzC,UAAM,KAAK,KAAK;AAChB,UAAM,QAAqB,EAAE,IAAI,QAAQ,QAAQ,IAAI,eAAe,oBAAI,IAAI,EAAE;AAC9E,SAAK,QAAQ,IAAI,IAAI,KAAK;AAE1B,WAAO,YAAY,OAAO;AAC1B,WAAO,GAAG,QAAQ,CAAC,UAAU;AAC3B,YAAM,UAAU,MAAM,SAAS;AAC/B,UAAI;AACJ,cAAQ,MAAM,MAAM,OAAO,QAAQ,IAAI,MAAM,GAAG;AAC9C,cAAM,OAAO,MAAM,OAAO,MAAM,GAAG,GAAG;AACtC,cAAM,SAAS,MAAM,OAAO,MAAM,MAAM,CAAC;AACzC,YAAI,CAAC,KAAK,KAAK,EAAG;AAClB,aAAK,WAAW,OAAO,IAAI,EAAE,MAAM,CAAC,QAAQ;AAC1C,eAAK,KAAK,OAAO,EAAE,IAAI,GAAG,IAAI,OAAO,OAAO,OAAO,KAAK,WAAW,GAAG,EAAE,CAAC;AAAA,QAC3E,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAED,WAAO,GAAG,SAAS,MAAM;AAAE,WAAK,QAAQ,OAAO,EAAE;AAAA,IAAG,CAAC;AACrD,WAAO,GAAG,SAAS,MAAM;AAAE,WAAK,QAAQ,OAAO,EAAE;AAAA,IAAG,CAAC;AAAA,EACvD;AAAA,EAEA,MAAc,WAAW,QAAqB,MAA6B;AACzE,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,MAAM,IAAI;AAAA,IACvB,QAAQ;AACN,aAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,GAAG,IAAI,OAAO,OAAO,eAAe,CAAC;AAAA,IACtE;AAEA,YAAQ,IAAI,QAAQ;AAAA,MAClB,KAAK;AACH,eAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ,OAAO,CAAC;AAAA,MAEnE,KAAK,UAAU;AACb,cAAM,SAA4B;AAAA,UAChC,KAAK,QAAQ;AAAA,UACb,WAAW,KAAK,UAAU,YAAY;AAAA,UACtC,eAAe,KAAK,OAAO,KAAK,IAAI,IAAI,KAAK,UAAU,QAAQ,KAAK,GAAI;AAAA,UACxE,SAAS,KAAK;AAAA,UACd,MAAM,MAAM;AAAA,UACZ,OAAO;AAAA,YACL,QAAQ,MAAM;AAAA,YACd,KAAK,MAAM;AAAA,YACX,OAAO,MAAM;AAAA,YACb,QAAQ,MAAM;AAAA,UAChB;AAAA,UACA,SAAS,KAAK,WAAW,QAAQ;AAAA,UACjC,UAAU,EAAE,GAAG,KAAK,SAAS;AAAA,QAC/B;AACA,eAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ,OAAO,CAAC;AAAA,MACnE;AAAA,MAEA,KAAK,iBAAiB;AACpB,cAAM,QAAQ,IAAI,QAAQ,SAAS;AACnC,cAAM,SAAS,gBAAgB,KAAK;AACpC,eAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ,OAAO,CAAC;AAAA,MACnE;AAAA,MAEA,KAAK,eAAe;AAClB,cAAM,QAAQ,IAAI,QAAQ,SAAS;AACnC,eAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ,cAAc,KAAK,EAAE,CAAC;AAAA,MACjF;AAAA,MAEA,KAAK,YAAY;AACf,eAAO,KAAK,KAAK,QAAQ;AAAA,UACvB,IAAI,IAAI;AAAA,UACR,IAAI;AAAA,UACJ,QAAQ;AAAA,YACN,OAAO,cAAc;AAAA,YACrB,SAAS,eAAe;AAAA,YACxB,SAAS,cAAc,IAAI,KAAK,KAAK,IAAI,IAAI,KAAQ,CAAC;AAAA,YACtD,YAAY,eAAe,IAAI,KAAK,KAAK,IAAI,IAAI,KAAQ,CAAC;AAAA,UAC5D;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MAEA,KAAK;AACH,eAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ,KAAK,WAAW,QAAQ,EAAE,CAAC;AAAA,MAEtF,KAAK;AACH,mBAAW,MAAM,IAAI,OAAO,SAAU,QAAO,cAAc,IAAI,EAAE;AACjE,eAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ,EAAE,YAAY,CAAC,GAAG,OAAO,aAAa,EAAE,EAAE,CAAC;AAAA,MAEtG,KAAK;AAGH,YAAI,CAAC,YAAY,KAAK,cAAe,IAAyC,QAAQ,KAAK,GAAG;AAC5F,iBAAO,KAAK,KAAK,QAAQ;AAAA,YACvB,IAAI,IAAI;AAAA,YACR,IAAI;AAAA,YACJ,OAAO;AAAA,UACT,CAAC;AAAA,QACH;AACA,aAAK,KAAK,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ,gBAAgB,CAAC;AACnE,mBAAW,MAAM,QAAQ,KAAK,SAA2B,GAAG,EAAE;AAC9D;AAAA,IACJ;AAAA,EACF;AAAA,EAEQ,KAAK,QAAqB,KAAkC;AAClE,QAAI;AACF,aAAO,OAAO,MAAM,KAAK,UAAU,GAAG,IAAI,IAAI;AAAA,IAChD,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEQ,UAAU,KAAc,SAAmC;AACjE,eAAW,UAAU,KAAK,QAAQ,OAAO,GAAG;AAC1C,UAAI,CAAC,OAAO,cAAc,IAAI,OAAO,EAAG;AACxC,WAAK,KAAK,QAAQ,GAAG;AAAA,IACvB;AAAA,EACF;AACF;;;AIxNA,IAAAE,mBAAsD;AACtD,IAAAC,oBAAqB;AACrB,sBAA8B;AAC9B,IAAAC,eAAiB;;;ACHjB,IAAAC,sBAAsD;AACtD,IAAAC,kBAOO;AACP,IAAAC,oBAAoC;AAmBpC,IAAM,iBAAa,wBAAK,MAAM,WAAW,sBAAsB;AAC/D,IAAM,0BAAsB,wBAAK,MAAM,WAAW,qBAAqB;AAGvE,IAAM,uBAAuB,oBAAI,IAAI,CAAC,MAAM,CAAC;AAuB7C,SAAS,aAAa,MAAc,MAAM,MAAM,MAAqB,CAAC,GAAkB;AACtF,aAAW,aAAS,6BAAY,KAAK,EAAE,eAAe,KAAK,CAAC,EAAE;AAAA,IAAK,CAAC,GAAG,MACrE,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI;AAAA,EAC/C,GAAG;AACD,UAAM,WAAO,wBAAK,KAAK,MAAM,IAAI;AACjC,QAAI,MAAM,eAAe,GAAG;AAE1B,UAAI,KAAK,EAAE,MAAM,MAAM,WAAW,KAAK,CAAC;AAAA,IAC1C,WAAW,MAAM,YAAY,GAAG;AAC9B,UAAI,qBAAqB,IAAI,MAAM,IAAI,EAAG;AAC1C,mBAAa,MAAM,MAAM,GAAG;AAAA,IAC9B,WAAW,MAAM,OAAO,GAAG;AACzB,UAAI,KAAK,EAAE,MAAM,MAAM,WAAW,MAAM,CAAC;AAAA,IAC3C;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,oBAAoB,YAA4B;AAC9D,QAAM,WAAO,gCAAW,QAAQ;AAEhC,aAAW,SAAS,aAAa,UAAU,GAAG;AAE5C,UAAM,cAAU,4BAAS,YAAY,MAAM,IAAI,EAAE,MAAM,qBAAG,EAAE,KAAK,GAAG;AACpE,SAAK,OAAO,OAAO;AACnB,SAAK,OAAO,IAAI;AAEhB,QAAI,MAAM,WAAW;AACnB,WAAK,OAAO,UAAU;AACtB,WAAK,WAAO,8BAAa,MAAM,IAAI,CAAC;AAAA,IACtC,OAAO;AACL,WAAK,OAAO,OAAO;AACnB,WAAK,WAAO,8BAAa,MAAM,IAAI,CAAC;AAAA,IACtC;AACA,SAAK,OAAO,IAAI;AAAA,EAClB;AAEA,SAAO,KAAK,OAAO,KAAK;AAC1B;AAEA,SAAS,gBAA2B;AAClC,MAAI,KAAC,4BAAW,UAAU,EAAG,QAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAC9D,MAAI;AACF,UAAM,SAAS,KAAK,UAAM,8BAAa,YAAY,OAAO,CAAC;AAC3D,QAAI,OAAO,YAAY,KAAK,OAAO,OAAO,YAAY,YAAY,CAAC,OAAO,SAAS;AACjF,aAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAAA,IACnC;AACA,WAAO,EAAE,SAAS,GAAG,SAAS,OAAO,QAAQ;AAAA,EAC/C,QAAQ;AAEN,WAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAAA,EACnC;AACF;AAoCA,SAAS,oBAA4C;AACnD,MAAI,KAAC,4BAAW,mBAAmB,EAAG,QAAO,CAAC;AAC9C,MAAI;AACF,UAAM,SAAS,KAAK,UAAM,8BAAa,qBAAqB,OAAO,CAAC;AACpE,WAAO,UAAU,OAAO,WAAW,WAAW,SAAS,CAAC;AAAA,EAC1D,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAOO,SAAS,sBAAsB,YAAoB,QAA8B;AACtF,QAAM,OAAO,kBAAkB;AAC/B,QAAM,eAAe,OAAO,KAAK,IAAI;AACrC,QAAM,cAAU,wBAAK,YAAY,SAAS;AAE1C,MAAI,aAAa,WAAW,GAAG;AAC7B,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB;AAEA,MAAI,KAAC,4BAAW,OAAO,GAAG;AACxB,WAAO,EAAE,IAAI,OAAO,QAAQ,4DAA4D;AAAA,EAC1F;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,UAAM,8BAAa,SAAS,OAAO,CAAC;AAAA,EACpD,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,4BAA4B;AAAA,EAC1D;AAEA,MAAI,CAAC,OAAO,SAAS,CAAC,OAAO,WAAW;AACtC,WAAO,EAAE,IAAI,OAAO,QAAQ,wCAAwC;AAAA,EACtE;AAEA,QAAM,YAAY,KAAK,OAAO,KAAK;AACnC,MAAI,CAAC,WAAW;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,oCAAoC,OAAO,KAAK,IAAI;AAAA,EAClF;AAEA,MAAI;AAEF,UAAM,YAAQ,oBAAAC;AAAA,MACZ;AAAA,MACA,OAAO,KAAK,QAAQ,KAAK;AAAA,MACzB;AAAA,MACA,OAAO,KAAK,OAAO,WAAW,QAAQ;AAAA,IACxC;AACA,WAAO,QAAQ,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,QAAQ,mCAAmC;AAAA,EACxF,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,2BAA2B,OAAQ,IAAc,WAAW,GAAG,CAAC,GAAG;AAAA,EACjG;AACF;AAKO,SAAS,kBAAkB,MAAc,YAAkC;AAChF,MAAI;AACJ,MAAI;AACF,aAAS,oBAAoB,UAAU;AAAA,EACzC,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,0BAA0B,OAAQ,IAAc,WAAW,GAAG,CAAC,GAAG;AAAA,EAChG;AAEA,QAAM,YAAY,sBAAsB,YAAY,MAAM;AAC1D,MAAI,CAAC,UAAU,GAAI,QAAO;AAE1B,QAAM,SAAS,cAAc,EAAE,QAAQ,IAAI;AAC3C,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,qEAAgE,IAAI;AAAA,IAC9E;AAAA,EACF;AAEA,MAAI,OAAO,WAAW,QAAQ;AAC5B,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QACE,4CAA4C,OAAO,SAAS,6DACP,IAAI;AAAA,IAC7D;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,KAAK;AACpB;;;AChPA,IAAAC,kBAA8E;AAC9E,2BAAgC;;;ACGhC,IAAM,cAAc;AAIpB,IAAM,aAAa;AAInB,IAAM,eAAe;AAGrB,IAAM,WAAW;AACjB,IAAM,qBAAqB;AAC3B,IAAM,aAAa;AAGZ,IAAM,kBAAkB;AAAA,EAC7B,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,KAAK;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,KAAK;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,cAAc,MAAoC;AAChE,QAAM,QAAQ,KAAK,MAAM,WAAW;AACpC,MAAI,CAAC,MAAO,QAAO;AAEnB,SAAO;AAAA,IACL,WAAW,oBAAoB,MAAM,CAAC,CAAC;AAAA,IACvC,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,MACN,IAAI,MAAM,CAAC;AAAA,MACX,QAAQ,MAAM,CAAC;AAAA,MACf,MAAM,MAAM,CAAC;AAAA,MACb,QAAQ,MAAM,CAAC;AAAA,MACf,MAAM,MAAM,CAAC;AAAA,MACb,YAAY,MAAM,CAAC;AAAA,IACrB;AAAA,EACF;AACF;AAEO,SAAS,aAAa,MAAmC;AAC9D,QAAM,QAAQ,KAAK,MAAM,UAAU;AACnC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,MAAM,CAAC,EAAE,MAAM,QAAQ;AACvC,QAAM,YAAY,MAAM,CAAC,EAAE,MAAM,kBAAkB,KAAK,MAAM,CAAC,EAAE,MAAM,UAAU;AAEjF,SAAO;AAAA,IACL,WAAW,qBAAqB,MAAM,CAAC,CAAC;AAAA,IACxC,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,MACN,SAAS,MAAM,CAAC;AAAA,MAChB,SAAS,MAAM,CAAC;AAAA,MAChB,IAAI,UAAU,CAAC;AAAA,MACf,MAAM,YAAY,CAAC;AAAA,IACrB;AAAA,EACF;AACF;AAEO,SAAS,YAAY,MAAkC;AAC5D,QAAM,QAAQ,KAAK,MAAM,YAAY;AACrC,MAAI,CAAC,MAAO,QAAO;AAEnB,SAAO;AAAA,IACL,WAAW,qBAAqB,MAAM,CAAC,CAAC;AAAA,IACxC,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,MACN,UAAU;AAAA,MACV,SAAS,MAAM,CAAC;AAAA,MAChB,SAAS,MAAM,CAAC;AAAA,IAClB;AAAA,EACF;AACF;AAEO,SAAS,oBAAoB,MAA6B;AAM/D,QAAM,aAAa,oBAAI,IAAY,CAAC,IAAI,CAAC;AACzC,MAAI,UAAU;AACd,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,QAAI,UAAyB;AAC7B,QAAI;AACF,gBAAU,mBAAmB,OAAO;AAAA,IACtC,QAAQ;AACN,gBAAU;AAAA,IACZ;AACA,QAAI,YAAY,QAAQ,YAAY,QAAS;AAC7C,eAAW,IAAI,OAAO;AACtB,cAAU;AAAA,EACZ;AAEA,aAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,eAAe,GAAG;AAC9D,eAAW,WAAW,UAAU;AAC9B,iBAAW,aAAa,YAAY;AAClC,YAAI,QAAQ,KAAK,SAAS,GAAG;AAC3B,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,MAAoC;AAEnE,QAAM,QAAQ,cAAc,IAAI;AAChC,MAAI,MAAO,QAAO;AAGlB,QAAM,OAAO,aAAa,IAAI;AAC9B,MAAI,KAAM,QAAO;AAGjB,SAAO,YAAY,IAAI;AACzB;AAEA,SAAS,oBAAoB,GAAiB;AAK5C,QAAM,UAAU,EAAE,QAAQ,8BAA8B,YAAY;AACpE,QAAM,IAAI,IAAI,KAAK,OAAO;AAC1B,SAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,IAAI,oBAAI,KAAK,IAAI;AAClD;AAEA,SAAS,qBAAqB,GAAiB;AAI7C,QAAM,MAAM,oBAAI,KAAK;AACrB,MAAI,IAAI,oBAAI,KAAK,GAAG,CAAC,IAAI,IAAI,YAAY,CAAC,EAAE;AAC5C,MAAI,OAAO,MAAM,EAAE,QAAQ,CAAC,EAAG,QAAO;AACtC,MAAI,EAAE,QAAQ,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,OAAO,oBAAI,KAAK,GAAG,CAAC,IAAI,IAAI,YAAY,IAAI,CAAC,EAAE;AACrD,QAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,KAAI;AAAA,EACzC;AACA,SAAO;AACT;;;ADjKO,IAAM,kBAA+B;AAAA,EAC1C,EAAE,MAAM,qBAAqB,QAAQ,aAAa,UAAU,OAAO;AAAA,EACnE,EAAE,MAAM,mBAAmB,QAAQ,aAAa,UAAU,OAAO;AAAA,EACjE,EAAE,MAAM,6BAA6B,QAAQ,eAAe,UAAU,MAAM;AAAA,EAC5E,EAAE,MAAM,mBAAmB,QAAQ,eAAe,UAAU,SAAS;AACvE;AAEO,IAAM,aAAN,MAAiB;AAAA,EAKtB,YAAoBC,MAAuB,UAAuB,iBAAiB;AAA/D,eAAAA;AAAuB;AAAA,EAAyC;AAAA,EAAhE;AAAA,EAAuB;AAAA,EAJnC,SAAS,oBAAI,IAA4B;AAAA,EACzC,YAAY,oBAAI,IAAoB;AAAA,EACpC,SAAS,oBAAI,IAAY;AAAA,EAIjC,QAAkB;AAChB,UAAM,UAAoB,CAAC;AAC3B,eAAW,OAAO,KAAK,SAAS;AAC9B,UAAI,KAAC,4BAAW,IAAI,IAAI,EAAG;AAC3B,UAAI;AAAE,wCAAW,IAAI,MAAM,0BAAU,IAAI;AAAA,MAAG,QACtC;AAAE;AAAA,MAAU;AAClB,WAAK,KAAK,GAAG;AACb,cAAQ,KAAK,IAAI,IAAI;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AAAA,EAEA,OAAa;AACX,eAAW,KAAK,KAAK,OAAO,OAAO,EAAG,eAAc,CAAC;AACrD,SAAK,OAAO,MAAM;AAClB,SAAK,UAAU,MAAM;AACrB,SAAK,OAAO,MAAM;AAAA,EACpB;AAAA,EAEA,gBAA0B;AACxB,WAAO,CAAC,GAAG,KAAK,MAAM;AAAA,EACxB;AAAA,EAEQ,KAAK,KAAsB;AACjC,QAAI;AACF,WAAK,UAAU,IAAI,IAAI,UAAM,0BAAS,IAAI,IAAI,EAAE,IAAI;AAAA,IACtD,QAAQ;AACN,WAAK,UAAU,IAAI,IAAI,MAAM,CAAC;AAAA,IAChC;AAEA,UAAM,QAAQ,YAAY,MAAM,KAAK,KAAK,GAAG,GAAG,GAAI;AACpD,SAAK,OAAO,IAAI,IAAI,MAAM,KAAK;AAC/B,SAAK,OAAO,IAAI,IAAI,MAAM;AAAA,EAC5B;AAAA,EAEQ,KAAK,KAAsB;AACjC,QAAI;AACJ,QAAI;AAAE,iBAAO,0BAAS,IAAI,IAAI;AAAA,IAAG,QAAQ;AAAE;AAAA,IAAQ;AACnD,UAAM,OAAO,KAAK,UAAU,IAAI,IAAI,IAAI,KAAK;AAE7C,QAAI,KAAK,OAAO,MAAM;AACpB,WAAK,UAAU,IAAI,IAAI,MAAM,CAAC;AAC9B;AAAA,IACF;AACA,QAAI,KAAK,SAAS,KAAM;AAExB,UAAM,aAAS,kCAAiB,IAAI,MAAM,EAAE,OAAO,MAAM,UAAU,QAAQ,CAAC;AAC5E,WAAO,GAAG,SAAS,MAAM,KAAK,UAAU,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC;AAChE,UAAM,SAAK,sCAAgB,EAAE,OAAO,OAAO,CAAC;AAC5C,OAAG,GAAG,SAAS,MAAM;AAAA,IAAC,CAAC;AACvB,OAAG,GAAG,QAAQ,CAAC,SAAS;AACtB,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,WAAK,QAAQ,MAAM,GAAG;AAAA,IACxB,CAAC;AACD,OAAG,GAAG,SAAS,MAAM,KAAK,UAAU,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC;AAAA,EAC9D;AAAA,EAEQ,QAAQ,MAAc,KAAsB;AAClD,UAAM,SAAS,iBAAiB,IAAI;AACpC,QAAI,CAAC,OAAQ;AAEb,QAAI,WAA0B;AAC9B,QAAI,UAAU;AACd,QAAI;AAEJ,QAAI,OAAO,WAAW,QAAQ;AAC5B,YAAM,QAAQ,aAAa,IAAI;AAC/B,UAAI,CAAC,MAAO;AACZ,iBAAW,MAAM,OAAO;AACxB,YAAM,MAAM,MAAM,OAAO;AACzB,UAAI,mBAAmB,KAAK,GAAG,GAAG;AAChC,mBAAW;AACX,kBAAU,wBAAwB,MAAM,OAAO,QAAQ,SAAS,SAAS,MAAM,OAAO,MAAM,SAAS;AAAA,MACvG,WAAW,gBAAgB,KAAK,GAAG,GAAG;AACpC,mBAAW;AACX,kBAAU,qBAAqB,MAAM,OAAO,QAAQ,SAAS,SAAS,MAAM,OAAO,MAAM,SAAS;AAAA,MACpG,WAAW,YAAY,KAAK,GAAG,GAAG;AAChC,mBAAW;AACX,kBAAU,0BAA0B,MAAM,OAAO,QAAQ,SAAS;AAAA,MACpE,OAAO;AACL;AAAA,MACF;AAAA,IACF,WAAW,OAAO,WAAW,SAAS;AACpC,YAAM,QAAQ,cAAc,IAAI;AAChC,UAAI,CAAC,MAAO;AACZ,iBAAW,MAAM,OAAO;AACxB,YAAM,SAAS,SAAS,MAAM,OAAO,QAAQ,EAAE;AAC/C,YAAM,SAAS,oBAAoB,MAAM,OAAO,IAAI;AACpD,UAAI,QAAQ;AACV,mBAAW;AACX,kBAAU,WAAW,OAAO,YAAY,CAAC,MAAM,MAAM,OAAO,MAAM,IAAI,MAAM,OAAO,IAAI;AAAA,MACzF,WAAW,UAAU,KAAK;AACxB,mBAAW;AACX,kBAAU,gBAAgB,MAAM,KAAK,MAAM,OAAO,MAAM,IAAI,MAAM,OAAO,IAAI;AAAA,MAC/E,WAAW,UAAU,KAAK;AACxB,mBAAW;AACX,kBAAU,gBAAgB,MAAM,KAAK,MAAM,OAAO,MAAM,IAAI,MAAM,OAAO,IAAI;AAAA,MAC/E,OAAO;AACL;AAAA,MACF;AAAA,IACF,OAAO;AACL;AAAA,IACF;AAEA,UAAM,QAAqB;AAAA,MACzB,WAAW,oBAAI,KAAK;AAAA,MACpB,QAAQ,IAAI;AAAA,MACZ,UAAU,IAAI;AAAA,MACd;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb;AAEA,QAAI;AAAE,kBAAY,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAoB;AACtD,SAAK,IAAI,QAAQ,KAAK;AAAA,EACxB;AACF;;;AE/IA,gCAAoD;AAQ7C,IAAM,iBAAN,MAAM,gBAAe;AAAA,EAM1B,YAAoBC,MAAe;AAAf,eAAAA;AAAA,EAAgB;AAAA,EAAhB;AAAA,EALZ,OAA4B;AAAA,EAC5B,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,OAAO,YAAsB;AAC3B,UAAMC,UAAS,QAAQ,aAAa,WAC/B,OAAO,QAAQ,WAAW,cAC1B,QAAQ,OAAO,MAAM;AAC1B,WAAOA,UAAS,CAAC,IAAI,CAAC,QAAQ;AAAA,EAChC;AAAA,EAEA,OAAO,cAAuB;AAC5B,UAAM,YAAQ,qCAAU,cAAc,CAAC,GAAG,KAAK,UAAU,GAAG,MAAM,KAAK,YAAY,GAAG;AAAA,MACpF,OAAO,CAAC,UAAU,UAAU,QAAQ;AAAA,IACtC,CAAC;AACD,WAAO,MAAM,WAAW;AAAA,EAC1B;AAAA,EAEA,QAAiB;AACf,QAAI,CAAC,gBAAe,YAAY,EAAG,QAAO;AAE1C,UAAM,YAAQ;AAAA,MACZ;AAAA,MACA,CAAC,GAAG,gBAAe,UAAU,GAAG,MAAM,QAAQ,MAAM,WAAW,KAAK;AAAA,MACpE,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE;AAAA,IACtC;AACA,QAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,UAAM,OAAO,YAAY,OAAO;AAChC,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB,KAAK,OAAO,KAAK,CAAC;AAC7D,UAAM,GAAG,QAAQ,MAAM;AACrB,WAAK,OAAO;AACZ,WAAK,SAAS;AAAA,IAChB,CAAC;AACD,SAAK,OAAO;AAEZ,SAAK,SAAS;AACd,WAAO;AAAA,EACT;AAAA,EAEA,OAAa;AACX,QAAI,KAAK,MAAM;AACb,UAAI;AAAE,aAAK,KAAK,KAAK,SAAS;AAAA,MAAG,QAAQ;AAAA,MAAC;AAC1C,WAAK,OAAO;AAAA,IACd;AACA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,WAAoB;AAClB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,kBAA0B;AACxB,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,OAAO,OAAqB;AAClC,SAAK,UAAU;AACf,QAAI;AACJ,YAAQ,MAAM,KAAK,OAAO,QAAQ,IAAI,MAAM,GAAG;AAC7C,YAAM,OAAO,KAAK,OAAO,MAAM,GAAG,GAAG;AACrC,WAAK,SAAS,KAAK,OAAO,MAAM,MAAM,CAAC;AACvC,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,WAAK,WAAW,IAAI;AAAA,IACtB;AAAA,EACF;AAAA,EAEQ,WAAW,MAAoB;AACrC,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,IAAI;AAAA,IACzB,QAAQ;AACN;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AACtB,QAAI,CAAC,QAAS;AAEd,UAAM,WAAW,SAAS,MAAM,YAAY,KAAK,EAAE;AACnD,UAAM,WAAW,mBAAmB,QAAQ;AAI5C,UAAM,QAAQ,MAAM,qBAAqB,MAAM,SAAS;AACxD,UAAM,iBAAiB,aAAa,OAAO,SAAS,QAAQ;AAE5D,UAAM,QAAqB;AAAA,MACzB,WAAW,eAAe,MAAM,oBAAoB,KAAK,oBAAI,KAAK;AAAA,MAClE,QAAQ,KAAK;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,MACV,SAAS,IAAI,KAAK,KAAK,OAAO,GAAG,MAAM,GAAG,GAAG;AAAA,IAC/C;AAEA,QAAI;AAAE,kBAAY,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAoB;AACtD,SAAK,IAAI,QAAQ,KAAK;AAAA,EACxB;AACF;AAEA,SAAS,mBAAmB,UAAiC;AAE3D,MAAI,YAAY,EAAG,QAAO;AAC1B,MAAI,aAAa,EAAG,QAAO;AAC3B,MAAI,aAAa,EAAG,QAAO;AAC3B,MAAI,aAAa,EAAG,QAAO;AAC3B,SAAO;AACT;AAEA,SAAS,aAAa,OAAe,SAAiB,MAAoC;AACxF,MAAI,QAAQ,KAAK,KAAK,KAAK,oDAAoD,KAAK,OAAO,GAAG;AAC5F,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,KAAK,KAAK,KAAK,gCAAgC,KAAK,OAAO,GAAG;AACxE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,eAAe,IAAqC;AAC3D,MAAI,CAAC,GAAI,QAAO;AAChB,QAAM,KAAK,SAAS,IAAI,EAAE;AAC1B,MAAI,CAAC,OAAO,SAAS,EAAE,EAAG,QAAO;AACjC,SAAO,IAAI,KAAK,KAAK,MAAM,KAAK,GAAI,CAAC;AACvC;;;AClIA,IAAAC,6BAA0B;AAC1B,IAAAC,kBAA2B;AAkBpB,IAAM,iBAAN,MAAqB;AAAA,EAc1B,YAAoBC,MAAe;AAAf,eAAAA;AAAA,EAAgB;AAAA,EAAhB;AAAA,EAbZ,SAAS;AAAA,EACT,YAAmC;AAAA,EACnC,eAAe,oBAAI,IAAyB;AAAA,EAC5C,mBAAmB,oBAAI,IAAkD;AAAA,EACzE,kBAAkB,oBAAI,IAAY;AAAA;AAAA,EAGlC,iBAAiB;AAAA,EACjB,oBAAoB;AAAA;AAAA,EACpB,mBAAmB;AAAA,EACnB,oBAAoB;AAAA;AAAA,EACpB,mBAAmB;AAAA,EAI3B,QAAiB;AACf,QAAI,CAAC,KAAK,iBAAiB,GAAG;AAC5B,aAAO;AAAA,IACT;AACA,SAAK,SAAS;AACd,SAAK,YAAY,YAAY,MAAM,KAAK,KAAK,GAAG,KAAK,cAAc;AACnE,WAAO;AAAA,EACT;AAAA,EAEA,OAAa;AACX,QAAI,KAAK,UAAW,eAAc,KAAK,SAAS;AAChD,SAAK,YAAY;AACjB,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,WAAoB;AAAE,WAAO,KAAK;AAAA,EAAQ;AAAA,EAElC,mBAA4B;AAClC,UAAM,SAAK,sCAAU,MAAM,CAAC,WAAW,GAAG,EAAE,OAAO,OAAO,CAAC;AAC3D,QAAI,GAAG,WAAW,EAAG,QAAO;AAE5B,eAAO,4BAAW,eAAe;AAAA,EACnC;AAAA,EAEQ,OAAa;AACnB,QAAI;AACF,YAAM,cAAc,KAAK,eAAe;AACxC,WAAK,iBAAiB,WAAW;AACjC,WAAK,gBAAgB,WAAW;AAChC,WAAK,gBAAgB;AAAA,IACvB,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEQ,iBAAqC;AAC3C,UAAM,UAA8B,CAAC;AACrC,UAAM,MAAM,KAAK,IAAI;AAErB,QAAI;AAEF,YAAM,SAAK,sCAAU,aAAa,CAAC,MAAM,MAAM,OAAO,MAAM,UAAU,GAAG;AAAA,QACvE,UAAU;AAAA,QAAS,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAAG,SAAS;AAAA,MAC/D,CAAC;AACD,UAAI,GAAG,WAAW,KAAK,GAAG,QAAQ;AAChC,mBAAW,QAAQ,GAAG,OAAO,MAAM,IAAI,GAAG;AACxC,gBAAM,WAAW,KAAK,MAAM,0BAA0B;AACtD,gBAAM,aAAa,KAAK,MAAM,aAAa;AAC3C,cAAI,YAAY,YAAY;AAC1B,oBAAQ,KAAK,EAAE,WAAW,SAAS,CAAC,GAAG,WAAW,SAAS,WAAW,CAAC,CAAC,GAAG,WAAW,IAAI,CAAC;AAAA,UAC7F;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,EAAG,QAAO;AAAA,MACjC;AAAA,IACF,QAAQ;AAAA,IAAoB;AAE5B,QAAI;AAEF,YAAM,SAAK,sCAAU,MAAM,CAAC,QAAQ,IAAI,GAAG;AAAA,QACzC,UAAU;AAAA,QAAS,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAAG,SAAS;AAAA,MAC/D,CAAC;AACD,UAAI,GAAG,WAAW,KAAK,GAAG,QAAQ;AAChC,mBAAW,QAAQ,GAAG,OAAO,MAAM,IAAI,GAAG;AAExC,gBAAM,QAAQ,KAAK,KAAK,EAAE,MAAM,KAAK;AACrC,cAAI,MAAM,SAAS,EAAG;AACtB,gBAAM,YAAY,MAAM,CAAC,EAAE,MAAM,GAAG;AACpC,gBAAM,aAAa,MAAM,CAAC,EAAE,MAAM,GAAG;AACrC,cAAI,UAAU,UAAU,KAAK,WAAW,UAAU,GAAG;AACnD,kBAAM,WAAW,UAAU,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;AAChD,kBAAM,WAAW,SAAS,WAAW,WAAW,SAAS,CAAC,CAAC;AAC3D,gBAAI,YAAY,CAAC,MAAM,QAAQ,KAAK,CAAC,KAAK,UAAU,QAAQ,GAAG;AAC7D,sBAAQ,KAAK,EAAE,WAAW,UAAU,WAAW,UAAU,WAAW,IAAI,CAAC;AAAA,YAC3E;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAoB;AAE5B,WAAO;AAAA,EACT;AAAA,EAEQ,iBAAiB,aAAuC;AAC9D,UAAM,MAAM,KAAK,IAAI;AAErB,eAAW,QAAQ,aAAa;AAC9B,YAAM,MAAM,KAAK;AACjB,UAAI,UAAU,KAAK,aAAa,IAAI,GAAG;AAEvC,UAAI,CAAC,SAAS;AACZ,kBAAU,EAAE,OAAO,oBAAI,IAAI,GAAG,WAAW,KAAK,UAAU,KAAK,OAAO,EAAE;AACtE,aAAK,aAAa,IAAI,KAAK,OAAO;AAAA,MACpC;AAEA,cAAQ,MAAM,IAAI,KAAK,SAAS;AAChC,cAAQ,WAAW;AACnB,cAAQ;AAGR,UAAI,QAAQ,MAAM,QAAQ,KAAK,qBAC1B,MAAM,QAAQ,aAAc,KAAK,kBAAkB;AACtD,aAAK;AAAA,UACH;AAAA,UACA,uBAAuB,KAAK,SAAS,WAAW,QAAQ,MAAM,IAAI,aAAa,KAAK,OAAO,MAAM,QAAQ,aAAa,GAAI,CAAC;AAAA,UAC3H,KAAK;AAAA,UACL,EAAE,eAAe,QAAQ,MAAM,MAAM,gBAAgB,KAAK,OAAO,MAAM,QAAQ,aAAa,GAAI,EAAE;AAAA,QACpG;AAEA,aAAK,aAAa,OAAO,GAAG;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,gBAAgB,aAAuC;AAE7D,QAAI;AACF,YAAM,SAAK,sCAAU,MAAM,CAAC,OAAO,SAAS,YAAY,IAAI,GAAG;AAAA,QAC7D,UAAU;AAAA,QAAS,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAAG,SAAS;AAAA,MAC/D,CAAC;AACD,UAAI,GAAG,WAAW,KAAK,CAAC,GAAG,OAAQ;AAEnC,YAAM,YAAY,oBAAI,IAAoB;AAE1C,iBAAW,QAAQ,GAAG,OAAO,MAAM,IAAI,GAAG;AACxC,cAAM,QAAQ,KAAK,KAAK,EAAE,MAAM,KAAK;AACrC,YAAI,MAAM,SAAS,EAAG;AACtB,cAAM,OAAO,MAAM,CAAC,EAAE,MAAM,GAAG;AAC/B,cAAM,KAAK,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;AACrC,YAAI,GAAI,WAAU,IAAI,KAAK,UAAU,IAAI,EAAE,KAAK,KAAK,CAAC;AAAA,MACxD;AAEA,iBAAW,CAAC,IAAI,KAAK,KAAK,WAAW;AACnC,YAAI,SAAS,KAAK,mBAAmB;AACnC,eAAK;AAAA,YACH;AAAA,YACA,yBAAyB,KAAK,+BAA+B,EAAE;AAAA,YAC/D;AAAA,YACA,EAAE,iBAAiB,MAAM;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAiB;AAAA,EAC3B;AAAA,EAEQ,UAAU,UAAyB,SAAiB,UAAmB,SAAyC;AACtH,UAAM,QAAqB;AAAA,MACzB,WAAW,oBAAI,KAAK;AAAA,MACpB,QAAQ;AAAA,MACR,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX;AAAA,IACF;AACA,QAAI;AAAE,kBAAY,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAoB;AACtD,SAAK,IAAI,QAAQ,KAAK;AAAA,EACxB;AAAA,EAEQ,kBAAwB;AAC9B,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,KAAK,OAAO,KAAK,KAAK,cAAc;AAC9C,UAAI,MAAM,QAAQ,WAAW,KAAK,mBAAmB,GAAG;AACtD,aAAK,aAAa,OAAO,GAAG;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,IAAqB;AACrC,WAAO,OAAO,eAAe,OAAO,SAAS,OAAO,aAAa,GAAG,WAAW,aAAa;AAAA,EAC9F;AACF;;;AC9MA,IAAAC,kBAA8E;AAC9E,IAAAC,wBAAgC;AAYhC,IAAM,kBAAkB;AAAA,EACtB;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF;AAEO,IAAM,aAAN,MAAiB;AAAA;AAAA,EAgBtB,YAAoBC,MAAe;AAAf,eAAAA;AAAA,EAAgB;AAAA,EAAhB;AAAA,EAfZ,SAAS;AAAA,EACT,SAAS,oBAAI,IAA4B;AAAA,EACzC,YAAY,oBAAI,IAAoB;AAAA;AAAA,EAGpC,iBAAiB,oBAAI,IAAkD;AAAA,EACvE,eAA2B,CAAC;AAAA;AAAA,EAG5B,mBAAmB;AAAA;AAAA,EACnB,cAAc;AAAA,EACd,oBAAoB;AAAA;AAAA,EACpB,cAAc;AAAA,EACd,mBAAmB;AAAA,EAI3B,QAAiB;AACf,UAAM,UAAU,gBAAgB,OAAO,OAAK;AAC1C,UAAI,KAAC,4BAAW,CAAC,EAAG,QAAO;AAC3B,UAAI;AAAE,wCAAW,GAAG,0BAAU,IAAI;AAAG,eAAO;AAAA,MAAM,QAC5C;AAAE,eAAO;AAAA,MAAO;AAAA,IACxB,CAAC;AAED,QAAI,QAAQ,WAAW,EAAG,QAAO;AAEjC,SAAK,SAAS;AACd,eAAW,OAAO,SAAS;AACzB,WAAK,QAAQ,GAAG;AAAA,IAClB;AAGA,gBAAY,MAAM,KAAK,cAAc,GAAG,GAAM;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,OAAa;AACX,eAAW,KAAK,KAAK,OAAO,OAAO,EAAG,eAAc,CAAC;AACrD,SAAK,OAAO,MAAM;AAClB,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,WAAoB;AAAE,WAAO,KAAK;AAAA,EAAQ;AAAA,EAElC,QAAQ,MAAoB;AAClC,QAAI;AACF,WAAK,UAAU,IAAI,UAAM,0BAAS,IAAI,EAAE,IAAI;AAAA,IAC9C,QAAQ;AACN,WAAK,UAAU,IAAI,MAAM,CAAC;AAAA,IAC5B;AAEA,UAAM,QAAQ,YAAY,MAAM,KAAK,QAAQ,IAAI,GAAG,GAAI;AACxD,SAAK,OAAO,IAAI,MAAM,KAAK;AAAA,EAC7B;AAAA,EAEQ,QAAQ,MAAoB;AAClC,QAAI;AACJ,QAAI;AAAE,iBAAO,0BAAS,IAAI;AAAA,IAAG,QAAQ;AAAE;AAAA,IAAQ;AAC/C,UAAM,OAAO,KAAK,UAAU,IAAI,IAAI,KAAK;AAEzC,QAAI,KAAK,OAAO,MAAM;AAAE,WAAK,UAAU,IAAI,MAAM,CAAC;AAAG;AAAA,IAAQ;AAC7D,QAAI,KAAK,SAAS,KAAM;AAExB,UAAM,aAAS,kCAAiB,MAAM,EAAE,OAAO,MAAM,UAAU,QAAQ,CAAC;AACxE,WAAO,GAAG,SAAS,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,IAAI,CAAC;AAC5D,UAAM,SAAK,uCAAgB,EAAE,OAAO,OAAO,CAAC;AAC5C,OAAG,GAAG,QAAQ,CAAC,SAAS,KAAK,aAAa,IAAI,CAAC;AAC/C,OAAG,GAAG,SAAS,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1D;AAAA,EAEQ,aAAa,MAAoB;AAEvC,UAAM,gBAAgB,KAAK,MAAM,wCAAwC;AACzE,QAAI,eAAe;AACjB,WAAK,aAAa,KAAK;AAAA,QACrB,MAAM,cAAc,CAAC;AAAA,QACrB,QAAQ,cAAc,CAAC;AAAA,QACvB,WAAW,cAAc,CAAC;AAAA,QAC1B,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AACD;AAAA,IACF;AAGA,UAAM,eAAe,KAAK,MAAM,wCAAwC;AACxE,QAAI,cAAc;AAChB,WAAK,aAAa,KAAK;AAAA,QACrB,MAAM,aAAa,CAAC;AAAA,QACpB,QAAQ,aAAa,CAAC;AAAA,QACtB,WAAW,aAAa,CAAC;AAAA,QACzB,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AACD;AAAA,IACF;AAGA,UAAM,eAAe,KAAK,MAAM,sCAAsC;AACtE,QAAI,cAAc;AAChB,YAAM,YAAY,KAAK,MAAM,kBAAkB;AAC/C,WAAK,aAAa,KAAK;AAAA,QACrB,MAAM,YAAY,CAAC,KAAK;AAAA,QACxB,QAAQ,aAAa,CAAC;AAAA,QACtB,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEQ,gBAAsB;AAC5B,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,SAAS,MAAM,KAAK;AAG1B,SAAK,eAAe,KAAK,aAAa,OAAO,OAAK,EAAE,YAAY,MAAM;AAEtE,SAAK,gBAAgB;AACrB,SAAK,UAAU;AAAA,EACjB;AAAA,EAEQ,kBAAwB;AAE9B,UAAM,cAAc,oBAAI,IAAoB;AAC5C,UAAM,mBAA6B,CAAC;AAEpC,eAAW,KAAK,KAAK,cAAc;AACjC,UAAI,EAAE,SAAS,OAAO;AACpB,cAAM,MAAM,EAAE,aAAa;AAC3B,oBAAY,IAAI,MAAM,YAAY,IAAI,GAAG,KAAK,KAAK,CAAC;AAAA,MACtD;AAGA,YAAM,SAAS,EAAE,OAAO,MAAM,GAAG;AACjC,YAAM,WAAW,KAAK,IAAI,GAAG,OAAO,IAAI,OAAK,EAAE,MAAM,CAAC;AACtD,UAAI,WAAW,IAAI;AACjB,yBAAiB,KAAK,EAAE,MAAM;AAAA,MAChC;AAAA,IACF;AAEA,eAAW,CAAC,QAAQ,KAAK,KAAK,aAAa;AACzC,UAAI,SAAS,KAAK,kBAAkB;AAClC,aAAK;AAAA,UACH;AAAA,UACA,6BAA6B,KAAK,qBAAqB,MAAM,OAAO,KAAK,cAAc,GAAI;AAAA,UAC3F,WAAW,YAAY,SAAS;AAAA,UAChC,EAAE,iBAAiB,OAAO,MAAM,YAAY;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAEA,QAAI,iBAAiB,UAAU,GAAG;AAChC,WAAK;AAAA,QACH;AAAA,QACA,kBAAkB,iBAAiB,MAAM;AAAA,QACzC;AAAA,QACA,EAAE,SAAS,iBAAiB,MAAM,GAAG,CAAC,GAAG,MAAM,mBAAmB;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,YAAkB;AAExB,UAAM,qBAA+B,CAAC;AAEtC,eAAW,KAAK,KAAK,cAAc;AACjC,YAAM,SAAS,EAAE,OAAO,YAAY;AAEpC,YAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,UAAI,MAAM,SAAS,EAAG;AACtB,YAAM,MAAM,MAAM,MAAM,SAAS,CAAC;AAElC,UAAI,IAAI,UAAU,KAAK,KAAK,eAAe,GAAG,KAAK,KAAK,kBAAkB;AACxE,2BAAmB,KAAK,MAAM;AAAA,MAChC;AAAA,IACF;AAGA,UAAM,SAAS,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC;AAC9C,QAAI,OAAO,UAAU,KAAK,mBAAmB;AAC3C,WAAK;AAAA,QACH;AAAA,QACA,0BAA0B,OAAO,MAAM;AAAA,QACvC;AAAA,QACA,EAAE,gBAAgB,OAAO,MAAM,GAAG,EAAE,GAAG,MAAM,OAAO,cAAc,OAAO,OAAO;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,eAAe,KAAqB;AAC1C,UAAM,OAAO,oBAAI,IAAoB;AACrC,eAAW,MAAM,KAAK;AACpB,WAAK,IAAI,KAAK,KAAK,IAAI,EAAE,KAAK,KAAK,CAAC;AAAA,IACtC;AACA,QAAI,UAAU;AACd,eAAW,SAAS,KAAK,OAAO,GAAG;AACjC,YAAM,IAAI,QAAQ,IAAI;AACtB,UAAI,IAAI,EAAG,YAAW,IAAI,KAAK,KAAK,CAAC;AAAA,IACvC;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,UAAyB,SAAiB,UAAmB,SAAyC;AACtH,UAAM,QAAqB;AAAA,MACzB,WAAW,oBAAI,KAAK;AAAA,MACpB,QAAQ;AAAA,MACR,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX;AAAA,IACF;AACA,QAAI;AAAE,kBAAY,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAoB;AACtD,SAAK,IAAI,QAAQ,KAAK;AAAA,EACxB;AACF;;;AChPA,IAAAC,kBAAsD;AACtD,IAAAC,oBAAqB;AACrB,kBAAiB;AAGjB,IAAM,sBAAsB;AAC5B,IAAM,kBAAkB;AAExB,IAAM,iBAAoC;AAAA,EACxC,QAAQ;AAAA,IACN,UAAU;AAAA,IACV,WAAW;AAAA,IACX,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AAAA,EACA,KAAK;AAAA,IACH,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA,EACP;AAAA,EACA,QAAQ,CAAC;AAAA,EACT,SAAS;AAAA,IACP,aAAa;AAAA,IACb,iBAAiB;AAAA,IACjB,YAAY;AAAA,IACZ,YAAY;AAAA,EACd;AACF;AAEO,SAAS,WAAW,YAAwC;AACjE,QAAM,OAAO,cAAc;AAC3B,MAAI,KAAC,4BAAW,IAAI,GAAG;AACrB,WAAO,EAAE,GAAG,eAAe;AAAA,EAC7B;AAEA,MAAI;AACF,UAAM,UAAM,8BAAa,MAAM,OAAO;AACtC,UAAM,SAAS,YAAAC,QAAK,MAAM,GAAG;AAC7B,WAAO;AAAA,MACL,QAAQ,EAAE,GAAG,eAAe,QAAQ,GAAG,OAAO,OAAO;AAAA,MACrD,KAAK,EAAE,GAAG,eAAe,KAAK,GAAG,OAAO,IAAI;AAAA,MAC5C,QAAQ,OAAO,UAAU,CAAC;AAAA,MAC1B,SAAS,EAAE,GAAG,eAAe,SAAS,GAAG,OAAO,QAAQ;AAAA,MACxD,SAAS,OAAO;AAAA,IAClB;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,GAAG,eAAe;AAAA,EAC7B;AACF;AAEO,SAAS,kBAAkB,SAA6C;AAC7E,QAAM,MAAM,WAAW;AACvB,QAAM,UAAU,oBAAI,IAA0B;AAE9C,MAAI,KAAC,4BAAW,GAAG,GAAG;AACpB,WAAO;AAAA,EACT;AAEA,QAAM,YAAQ,6BAAY,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO,CAAC;AAChE,aAAW,QAAQ,OAAO;AACxB,QAAI;AACF,YAAM,UAAM,kCAAa,wBAAK,KAAK,IAAI,GAAG,OAAO;AACjD,YAAM,SAAS,YAAAA,QAAK,MAAM,GAAG;AAC7B,iBAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,gBAAQ,IAAI,MAAM,MAAsB;AAAA,MAC1C;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;;;AP3CO,IAAM,aAAN,MAAiB;AAAA,EAOtB,YAAoBC,MAAe;AAAf,eAAAA;AAClB,IAAAA,KAAI,GAAG,SAAS,CAAC,UAAU;AACzB,YAAM,MAAM,KAAK,QAAQ,IAAI,MAAM,MAAM;AACzC,UAAI,IAAK,KAAI;AACb,iBAAW,UAAU,KAAK,QAAQ,OAAO,GAAG;AAC1C,YAAI,OAAO,WAAW,aAAa,CAAC,OAAO,UAAU,QAAS;AAC9D,aAAK,OAAO,SAAS,QAAQ,KAAK,EAAE,MAAM,CAAC,QAAQ;AACjD,iBAAO,SAAS;AAChB,iBAAO,SAAS,mBAAmB,OAAQ,IAAc,WAAW,GAAG,CAAC;AACxE,eAAK,IAAI,eAAe,OAAO,MAAM,SAAS,OAAO,MAAM;AAAA,QAC7D,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAboB;AAAA,EANZ,UAAU,oBAAI,IAA0B;AAAA,EACxC,aAAgC;AAAA,EAChC,iBAAwC;AAAA,EACxC,iBAAwC;AAAA,EACxC,aAAgC;AAAA,EAiBxC,MAAM,QAAuB;AAC3B,SAAK,iBAAiB;AACtB,UAAM,KAAK,0BAA0B;AAErC,SAAK,aAAa,IAAI,WAAW,KAAK,GAAG;AACzC,UAAM,UAAU,KAAK,WAAW,MAAM;AAEtC,eAAW,WAAW,KAAK,WAAW,cAAc,GAAG;AACrD,YAAM,MAAM,KAAK,QAAQ,IAAI,OAAO;AACpC,UAAI,KAAK;AACP,YAAI,SAAS;AACb,YAAI,SAAS,YAAY,QAAQ,MAAM;AACvC,aAAK,IAAI,eAAe,SAAS,WAAW,IAAI,MAAM;AAAA,MACxD;AAAA,IACF;AAEA,SAAK,iBAAiB,IAAI,eAAe,KAAK,GAAG;AACjD,QAAI,KAAK,eAAe,MAAM,GAAG;AAC/B,YAAM,MAAM,KAAK,QAAQ,IAAI,cAAc;AAC3C,UAAI,KAAK;AACP,YAAI,SAAS;AACb,YAAI,SAAS,WAAW,eAAe,UAAU,EAAE,SAAS,QAAQ,IAAI,iBAAiB,gBAAgB;AACzG,aAAK,IAAI,eAAe,gBAAgB,WAAW,IAAI,MAAM;AAAA,MAC/D;AAAA,IACF;AAGA,SAAK,iBAAiB,IAAI,eAAe,KAAK,GAAG;AACjD,QAAI,KAAK,eAAe,MAAM,GAAG;AAC/B,YAAM,OAAO,KAAK,QAAQ,IAAI,iBAAiB;AAC/C,UAAI,MAAM;AACR,aAAK,SAAS;AACd,aAAK,SAAS;AACd,aAAK,IAAI,eAAe,mBAAmB,WAAW,KAAK,MAAM;AAAA,MACnE;AAAA,IACF;AAGA,SAAK,aAAa,IAAI,WAAW,KAAK,GAAG;AACzC,QAAI,KAAK,WAAW,MAAM,GAAG;AAC3B,YAAM,OAAO,KAAK,QAAQ,IAAI,aAAa;AAC3C,UAAI,MAAM;AACR,aAAK,SAAS;AACd,aAAK,SAAS;AACd,aAAK,IAAI,eAAe,eAAe,WAAW,KAAK,MAAM;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,OAAsB;AAC1B,SAAK,YAAY,KAAK;AACtB,SAAK,gBAAgB,KAAK;AAC1B,SAAK,gBAAgB,KAAK;AAC1B,SAAK,YAAY,KAAK;AACtB,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,UAAI;AACF,YAAI,IAAI,YAAY,IAAI,WAAW,WAAW;AAC5C,gBAAM,IAAI,SAAS,KAAK;AAAA,QAC1B;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,SAAS;AACb,YAAI,SAAS,gBAAgB,OAAQ,IAAc,WAAW,GAAG,CAAC;AAClE,aAAK,IAAI,eAAe,IAAI,MAAM,SAAS,IAAI,MAAM;AACrD;AAAA,MACF;AACA,UAAI,SAAS;AACb,WAAK,IAAI,eAAe,IAAI,MAAM,SAAS;AAAA,IAC7C;AAAA,EACF;AAAA,EAEA,UAAoF;AAClF,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MAC5C,MAAM,EAAE;AAAA,MACR,QAAQ,EAAE;AAAA,MACV,QAAQ,EAAE;AAAA,MACV,QAAQ,EAAE;AAAA,IACZ,EAAE;AAAA,EACJ;AAAA,EAEQ,mBAAyB;AAC/B,UAAM,WAA2B;AAAA,MAC/B,EAAE,MAAM,eAAe,SAAS,SAAS,QAAQ,WAAW,QAAQ,UAAU,QAAQ,EAAE;AAAA,MACxF,EAAE,MAAM,aAAa,SAAS,SAAS,QAAQ,WAAW,QAAQ,UAAU,QAAQ,EAAE;AAAA,MACtF,EAAE,MAAM,gBAAgB,SAAS,SAAS,QAAQ,WAAW,QAAQ,UAAU,QAAQ,EAAE;AAAA,MACzF,EAAE,MAAM,mBAAmB,SAAS,SAAS,QAAQ,WAAW,QAAQ,UAAU,QAAQ,EAAE;AAAA,MAC5F,EAAE,MAAM,eAAe,SAAS,SAAS,QAAQ,WAAW,QAAQ,UAAU,QAAQ,EAAE;AAAA,IAC1F;AACA,eAAW,KAAK,SAAU,MAAK,QAAQ,IAAI,EAAE,MAAM,CAAC;AAAA,EACtD;AAAA,EAEA,MAAc,4BAA2C;AACvD,QAAI,KAAC,6BAAW,MAAM,SAAS,EAAG;AAClC,UAAM,UAAU,kBAAkB,MAAM,KAAK;AAC7C,UAAM,cAAU,8BAAY,MAAM,WAAW,EAAE,eAAe,KAAK,CAAC;AACpE,eAAW,SAAS,SAAS;AAC3B,UAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,YAAM,mBAAe,wBAAK,MAAM,WAAW,MAAM,MAAM,UAAU;AACjE,UAAI,KAAC,6BAAW,YAAY,EAAG;AAC/B,UAAI;AACF,cAAM,WAAW,aAAAC,QAAK,UAAM,+BAAa,cAAc,OAAO,CAAC;AAC/D,cAAM,OAAO,SAAS,QAAQ,QAAQ,MAAM;AAC5C,cAAM,WAAW,SAAS,QAAQ,QAAQ,YAAY,CAAC;AACvD,cAAM,SAAS;AAAA,UACb,SAAS;AAAA,UACT,GAAG;AAAA,UACH,GAAI,QAAQ,IAAI,IAAI,KAAK,CAAC;AAAA,QAC5B;AACA,cAAM,SAAuB;AAAA,UAC3B;AAAA,UACA,SAAS,SAAS,QAAQ,WAAW;AAAA,UACrC,QAAQ;AAAA,UACR,QAAQ,OAAO,YAAY,QAAQ,aAAa;AAAA,UAChD,QAAQ;AAAA,UACR,UAAM,wBAAK,MAAM,WAAW,MAAM,IAAI;AAAA,UACtC;AAAA,QACF;AACA,aAAK,QAAQ,IAAI,MAAM,MAAM;AAC7B,YAAI,OAAO,YAAY,MAAO;AAC9B,cAAM,KAAK,eAAe,MAAM;AAAA,MAClC,SAAS,KAAK;AACZ,cAAM,OAAO,MAAM;AACnB,aAAK,QAAQ,IAAI,MAAM;AAAA,UACrB;AAAA,UACA,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ,yBAAyB,OAAQ,IAAc,WAAW,GAAG,CAAC;AAAA,UACtE,UAAM,wBAAK,MAAM,WAAW,MAAM,IAAI;AAAA,QACxC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,eAAe,QAAqC;AAChE,UAAM,aAAa,KAAK,oBAAoB,OAAO,IAAK;AACxD,QAAI,CAAC,YAAY;AACf,aAAO,SAAS;AAChB,aAAO,SAAS;AAChB;AAAA,IACF;AAKA,UAAM,QAAQ,kBAAkB,OAAO,MAAM,OAAO,IAAK;AACzD,QAAI,CAAC,MAAM,IAAI;AACb,aAAO,SAAS;AAChB,aAAO,SAAS,qBAAqB,MAAM,MAAM;AACjD,WAAK,IAAI,eAAe,OAAO,MAAM,SAAS,OAAO,MAAM;AAC3D;AAAA,IACF;AAEA,QAAI;AACF,YAAM,WAAW,MAAM,WAAO,+BAAc,UAAU,EAAE;AACxD,YAAM,WAAW,SAAS,WAAW,SAAS,UAAU;AACxD,YAAM,WAAW,OAAO,aAAa,aAAa,IAAI,SAAS,IAAI;AACnE,UAAI,CAAC,KAAK,oBAAoB,QAAQ,GAAG;AACvC,cAAM,IAAI,MAAM,iDAAiD;AAAA,MACnE;AAEA,aAAO,WAAW;AAClB,YAAM,SAAS,KAAK,KAAK,WAAW,MAAM,CAAC;AAC3C,YAAM,SAAS,MAAM;AACrB,aAAO,SAAS;AAChB,aAAO,SAAS,gBAAgB,UAAU;AAC1C,WAAK,IAAI,eAAe,OAAO,MAAM,WAAW,OAAO,MAAM;AAAA,IAC/D,SAAS,KAAK;AACZ,aAAO,SAAS;AAChB,aAAO,SAAS,OAAQ,IAAc,WAAW,GAAG;AACpD,WAAK,IAAI,eAAe,OAAO,MAAM,SAAS,OAAO,MAAM;AAAA,IAC7D;AAAA,EACF;AAAA,EAEQ,oBAAoB,YAAmC;AAC7D,UAAM,kBAAc,wBAAK,YAAY,cAAc;AACnD,UAAM,aAAuB,CAAC;AAC9B,YAAI,6BAAW,WAAW,GAAG;AAC3B,UAAI;AACF,cAAM,MAAM,KAAK,UAAM,+BAAa,aAAa,OAAO,CAAC;AACzD,YAAI,IAAI,KAAM,YAAW,SAAK,wBAAK,YAAY,IAAI,IAAI,CAAC;AAAA,MAC1D,QAAQ;AAAA,MAER;AAAA,IACF;AACA,eAAW,SAAK,wBAAK,YAAY,QAAQ,UAAU,OAAG,wBAAK,YAAY,UAAU,CAAC;AAClF,WAAO,WAAW,KAAK,CAAC,kBAAc,6BAAW,SAAS,CAAC,KAAK;AAAA,EAClE;AAAA,EAEQ,oBAAoB,OAA4C;AACtE,WAAO;AAAA,MACL,SACA,OAAO,UAAU,YACjB,OAAQ,MAA4B,SAAS,cAC7C,OAAQ,MAA4B,UAAU,cAC9C,OAAQ,MAA4B,SAAS;AAAA,IAC/C;AAAA,EACF;AAAA,EAEQ,WAAW,QAAsB;AACvC,WAAO;AAAA,MACL,QAAQ,OAAO,UAAU,EAAE,SAAS,KAAK;AAAA,MACzC,QAAQ,KAAK,UAAU,OAAO,IAAI;AAAA,MAClC,MAAM,CAAC,UAAuB,KAAK,IAAI,QAAQ,KAAK;AAAA,MACpD,WAAW,CAAC,WAAmB,YAA0C;AACvE,aAAK,IAAI,GAAG,SAAS,CAAC,UAAU;AAC9B,cAAI,MAAM,aAAa,aAAa,MAAM,WAAW,UAAW,SAAQ,KAAK;AAAA,QAC/E,CAAC;AAAA,MACH;AAAA,MACA,OAAO,CAAC,UAAuB;AAC7B,aAAK,IAAI,KAAK,SAAS,MAAM,SAAS;AAAA,UACpC,WAAW,oBAAI,KAAK;AAAA,UACpB,QAAQ,OAAO;AAAA,UACf,UAAU;AAAA,UACV,UAAU,MAAM;AAAA,UAChB,SAAS,MAAM;AAAA,UACf,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI;AAAA,QAC/C,CAAC;AAAA,MACH;AAAA,MACA,UAAU,CAAC,QAAgB,eAAe,OAAO,MAAM,GAAG;AAAA,MAC1D,UAAU,CAAC,KAAa,UAAmB,eAAe,OAAO,MAAM,KAAK,KAAK;AAAA,IACnF;AAAA,EACF;AAAA,EAEQ,UAAU,YAAoB;AACpC,WAAO;AAAA,MACL,OAAO,CAAC,QAAgB,SAAoB,QAAQ,MAAM,IAAI,UAAU,KAAK,GAAG,IAAI,GAAG,IAAI;AAAA,MAC3F,MAAM,CAAC,QAAgB,SAAoB,QAAQ,KAAK,IAAI,UAAU,KAAK,GAAG,IAAI,GAAG,IAAI;AAAA,MACzF,MAAM,CAAC,QAAgB,SAAoB,QAAQ,KAAK,IAAI,UAAU,KAAK,GAAG,IAAI,GAAG,IAAI;AAAA,MACzF,OAAO,CAAC,QAAgB,SAAoB,QAAQ,MAAM,IAAI,UAAU,KAAK,GAAG,IAAI,GAAG,IAAI;AAAA,IAC7F;AAAA,EACF;AACF;;;AQrRA,IAAI,cAA6B;AAGjC,IAAI,aAAkB;AAatB,IAAM,gBAAwC;AAAA,EAC5C,MAAM;AAAA,EACN,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AACZ;AAEA,eAAe,kBAAkB,QAA4C;AAC3E,MAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,KAAM,QAAO;AACzC,MAAI,YAAa,QAAO;AAExB,MAAI,CAAC,YAAY;AACf,QAAI;AACF,mBAAa,MAAM,OAAO,YAAY;AAAA,IACxC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,gBAAc,WAAW,gBAAgB;AAAA,IACvC,MAAM,OAAO;AAAA,IACb,MAAM,OAAO,QAAQ;AAAA,IACrB,QAAQ,OAAO,UAAU;AAAA,IACzB,MAAM,OAAO,QAAQ,OAAO,OAAO,EAAE,MAAM,OAAO,MAAM,MAAM,OAAO,KAAK,IAAI;AAAA,EAChF,CAAC;AACD,SAAO;AACT;AAEA,SAAS,cAAc,OAAoB,KAA2C;AACpF,MAAI,CAAC,IAAK,QAAO;AACjB,UAAQ,cAAc,MAAM,QAAQ,KAAK,OAAO,cAAc,GAAG,KAAK;AACxE;AAEA,SAAS,WAAW,OAAoD;AACtE,QAAM,KAAK,MAAM,UAAU,YAAY;AACvC,QAAM,KAAK,MAAM,YAAY;AAAA,aAAgB,MAAM,SAAS,KAAK;AACjE,QAAM,OACJ,IAAI,MAAM,SAAS,YAAY,CAAC,KAAK,MAAM,MAAM;AAAA;AAAA,EAC9C,MAAM,OAAO,GAAG,EAAE;AAAA;AAAA,QACZ,EAAE;AAAA,YAAe,MAAM,QAAQ;AAC1C,QAAM,OACJ,mGACgC,MAAM,SAAS,YAAY,CAAC,WAAM,MAAM,MAAM,WACxE,MAAM,OAAO,UAClB,MAAM,YAAY,wCAAwC,MAAM,SAAS,gBAAgB,MAC1F,gDAAgD,EAAE,SAAM,MAAM,QAAQ;AAExE,SAAO,EAAE,MAAM,KAAK;AACtB;AAEO,SAAS,YAAY,QAA2D;AACrF,SAAO,OAAO,UAAU;AACtB,QAAI,CAAC,cAAc,OAAO,OAAO,YAAY,EAAG;AAChD,UAAM,IAAI,MAAM,kBAAkB,MAAM;AACxC,QAAI,CAAC,EAAG;AAER,UAAM,KAAK,MAAM,QAAQ,OAAO,EAAE,IAAI,OAAO,GAAG,KAAK,IAAI,IAAI,OAAO;AACpE,QAAI,CAAC,GAAI;AAET,UAAM,EAAE,MAAM,KAAK,IAAI,WAAW,KAAK;AACvC,UAAM,EAAE,SAAS;AAAA,MACf,MAAM,OAAO;AAAA,MACb;AAAA,MACA,SAAS,gBAAgB,MAAM,QAAQ,KAAK,MAAM,MAAM,WAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,CAAC;AAAA,MACxF;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;ACpFA,IAAMC,iBAAwC;AAAA,EAC5C,MAAM;AAAA,EAAG,KAAK;AAAA,EAAG,QAAQ;AAAA,EAAG,MAAM;AAAA,EAAG,UAAU;AACjD;AAEA,IAAM,kBAA0C;AAAA,EAC9C,MAAM;AAAA;AAAA,EACN,KAAK;AAAA;AAAA,EACL,QAAQ;AAAA;AAAA,EACR,MAAM;AAAA;AAAA,EACN,UAAU;AAAA;AACZ;AAEO,SAAS,eAAe,QAA8D;AAC3F,SAAO,OAAO,UAAU;AACtB,QAAI,OAAO,cAAc;AACvB,YAAM,YAAYA,eAAc,MAAM,QAAQ,KAAK;AACnD,YAAM,UAAUA,eAAc,OAAO,YAAY,KAAK;AACtD,UAAI,YAAY,QAAS;AAAA,IAC3B;AAEA,UAAM,QAAQ;AAAA,MACZ,OAAO,GAAG,MAAM,aAAa,aAAa,cAAO,cAAI,KAAK,MAAM,SAAS,YAAY,CAAC,KAAK,MAAM,MAAM;AAAA,MACvG,aAAa,MAAM;AAAA,MACnB,OAAO,gBAAgB,MAAM,QAAQ,KAAK;AAAA,MAC1C,QAAQ;AAAA,QACN,GAAI,MAAM,YAAY,CAAC,EAAE,MAAM,aAAa,OAAO,KAAK,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,IAAI,CAAC;AAAA,QAChG,EAAE,MAAM,YAAY,OAAO,MAAM,UAAU,QAAQ,KAAK;AAAA,QACxD,EAAE,MAAM,QAAQ,OAAO,MAAM,UAAU,YAAY,GAAG,QAAQ,KAAK;AAAA,MACrE;AAAA,MACA,QAAQ,EAAE,MAAM,6BAA6B;AAAA,IAC/C;AAEA,UAAM,MAAM,OAAO,aAAa;AAAA,MAC9B,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAAA,IAC1C,CAAC;AAAA,EACH;AACF;;;ACtCA,IAAMC,iBAAwC;AAAA,EAC5C,MAAM;AAAA,EAAG,KAAK;AAAA,EAAG,QAAQ;AAAA,EAAG,MAAM;AAAA,EAAG,UAAU;AACjD;AAGA,IAAM,cAAsC;AAAA,EAC1C,MAAM;AAAA,EACN,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AACZ;AAEO,SAAS,iBAAiB,QAAgE;AAC/F,SAAO,OAAO,UAAU;AACtB,QAAI,OAAO,cAAc;AACvB,YAAM,YAAYA,eAAc,MAAM,QAAQ,KAAK;AACnD,YAAM,UAAUA,eAAc,OAAO,YAAY,KAAK;AACtD,UAAI,YAAY,QAAS;AAAA,IAC3B;AAEA,UAAM,UAAU;AAAA,MACd,aAAa,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,SAAS;AAAA,QACP,SAAS,IAAI,MAAM,SAAS,YAAY,CAAC,KAAK,MAAM,MAAM,KAAK,MAAM,OAAO;AAAA,QAC5E,QAAQ;AAAA,QACR,UAAU,YAAY,MAAM,QAAQ,KAAK;AAAA,QACzC,WAAW,MAAM,UAAU,YAAY;AAAA,QACvC,gBAAgB;AAAA,UACd,QAAQ,MAAM;AAAA,UACd,UAAU,MAAM;AAAA,UAChB,WAAW,MAAM;AAAA,UACjB,SAAS,MAAM;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,2CAA2C;AAAA,MACrD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,IAC9B,CAAC;AAAA,EACH;AACF;;;AC1CO,IAAM,kBAAN,MAAsB;AAAA,EAI3B,YAAoBC,MAAuB,QAA2B;AAAlD,eAAAA;AAAuB;AACzC,SAAK,aAAa;AAClB,IAAAA,KAAI,GAAG,SAAS,CAAC,UAAU;AAAE,WAAK,KAAK,SAAS,KAAK;AAAA,IAAG,CAAC;AAAA,EAC3D;AAAA,EAHoB;AAAA,EAAuB;AAAA,EAHnC,WAAsB,CAAC;AAAA,EACvB,aAAa,oBAAI,IAAsB;AAAA,EAOvC,eAAqB;AAC3B,UAAM,SAAS,KAAK,OAAO,UAAU,CAAC;AACtC,eAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,MAAM,GAAG;AAChD,YAAM,MAAM;AACZ,UAAI,CAAC,IAAI,QAAS;AAClB,UAAI,SAAS,aAAa,OAAO,IAAI,QAAQ,UAAU;AACrD,aAAK,SAAS,KAAK,eAAe,IAAI,KAAK,IAAI,MAA4B,CAAC;AAAA,MAC9E;AACA,UAAI,SAAS,WAAW,OAAO,IAAI,gBAAgB,UAAU;AAC3D,aAAK,SAAS,KAAK,aAAa,IAAI,WAAW,CAAC;AAAA,MAClD;AACA,UAAI,SAAS,WAAW,OAAO,IAAI,SAAS,YAAY,OAAO,IAAI,SAAS,UAAU;AACpF,aAAK,SAAS,KAAK,YAAY,GAA4B,CAAC;AAAA,MAC9D;AACA,UAAI,SAAS,aAAa,OAAO,IAAI,gBAAgB,UAAU;AAC7D,aAAK,SAAS,KAAK,eAAe,GAA+B,CAAC;AAAA,MACpE;AACA,UAAI,SAAS,eAAe,OAAO,IAAI,gBAAgB,UAAU;AAC/D,aAAK,SAAS,KAAK,iBAAiB,GAAiC,CAAC;AAAA,MACxE;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,eAAe,YAAoB,aAAqB,IAAa;AAC3E,UAAM,MAAM,OAAO,UAAU;AAC7B,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,OAAO;AACb,QAAI,aAAa,KAAK,WAAW,IAAI,GAAG,KAAK,CAAC;AAC9C,iBAAa,WAAW,OAAO,OAAK,IAAI,MAAM,IAAI;AAClD,QAAI,WAAW,UAAU,WAAY,QAAO;AAC5C,eAAW,KAAK,GAAG;AACnB,SAAK,WAAW,IAAI,KAAK,UAAU;AACnC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,OAAmC;AACxD,UAAM,QAAQ,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,QAAQ;AAC/C,UAAI,CAAC,KAAK,eAAe,GAAG,EAAG,QAAO,QAAQ,QAAQ;AACtD,aAAO,GAAG,KAAK,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACjC,CAAC,CAAC;AAAA,EACJ;AACF;AAEA,SAAS,eAAe,KAAa,QAA0B;AAC7D,SAAO,OAAO,UAAU;AACtB,UAAM,OAAO,KAAK,UAAU,EAAE,MAAM,CAAC;AACrC,UAAM,UAAkC,EAAE,gBAAgB,mBAAmB;AAC7E,QAAI,OAAQ,SAAQ,yBAAyB,IAAI;AACjD,UAAM,MAAM,KAAK,EAAE,QAAQ,QAAQ,SAAS,KAAK,CAAC;AAAA,EACpD;AACF;AAEA,SAAS,aAAa,YAA6B;AACjD,SAAO,OAAO,UAAU;AACtB,UAAM,QAAQ,MAAM,aAAa,aAAa,qBAAqB;AACnE,UAAM,OAAO,GAAG,KAAK,MAAM,MAAM,SAAS,YAAY,CAAC,QAAQ,MAAM,MAAM,aAAQ,MAAM,OAAO,GAAG,MAAM,YAAY,UAAU,MAAM,SAAS,MAAM,EAAE;AACtJ,UAAM,MAAM,YAAY;AAAA,MACtB,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,KAAK,CAAC;AAAA,IAC/B,CAAC;AAAA,EACH;AACF;;;AChFA,IAAAC,mBAA8E;AAC9E,IAAAC,oBAAqB;AACrB,IAAAC,kBAAwB;AAEjB,IAAM,qBAAiB,4BAAK,yBAAQ,GAAG,cAAc;AACrD,IAAM,sBAAkB,wBAAK,gBAAgB,aAAa;AAa1D,SAAS,gBAA2B;AACzC,MAAI;AACF,WAAO,KAAK,UAAM,+BAAa,iBAAiB,OAAO,CAAC;AAAA,EAC1D,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAyBO,SAAS,aAAsB;AACpC,QAAM,MAAM,cAAc;AAC1B,MAAI,CAAC,IAAI,MAAO,QAAO;AACvB,MAAI,IAAI,cAAc,IAAI,aAAa,MAAO,KAAK,IAAI,EAAG,QAAO;AACjE,SAAO;AACT;AAEO,SAAS,cAAsC;AACpD,QAAM,MAAM,cAAc;AAC1B,QAAM,UAAkC,EAAE,gBAAgB,mBAAmB;AAC7E,MAAI,IAAI,MAAO,SAAQ,eAAe,IAAI,UAAU,IAAI,KAAK;AAC7D,SAAO;AACT;;;AC7DA,IAAAC,mBAAmE;AACnE,IAAAC,qBAAuC;;;ACDvC,IAAM,yBAAyB;AAE/B,IAAM,aAAa,CAAC,SAAS,MAAM,UAAQ,QAAU,OAAO,MAAM;AAElE,IAAM,cAAc,CAAC,SAAS,MAAM,UAAQ,QAAU,KAAK,MAAM,MAAM,IAAI;AAE3E,IAAM,cAAc,CAAC,SAAS,MAAM,CAAC,KAAK,OAAO,SAAS,QAAU,KAAK,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI;AAEzG,IAAM,SAAS;AAAA,EACd,UAAU;AAAA,IACT,OAAO,CAAC,GAAG,CAAC;AAAA;AAAA,IAEZ,MAAM,CAAC,GAAG,EAAE;AAAA,IACZ,KAAK,CAAC,GAAG,EAAE;AAAA,IACX,QAAQ,CAAC,GAAG,EAAE;AAAA,IACd,WAAW,CAAC,GAAG,EAAE;AAAA,IACjB,UAAU,CAAC,IAAI,EAAE;AAAA,IACjB,SAAS,CAAC,GAAG,EAAE;AAAA,IACf,QAAQ,CAAC,GAAG,EAAE;AAAA,IACd,eAAe,CAAC,GAAG,EAAE;AAAA,EACtB;AAAA,EACA,OAAO;AAAA,IACN,OAAO,CAAC,IAAI,EAAE;AAAA,IACd,KAAK,CAAC,IAAI,EAAE;AAAA,IACZ,OAAO,CAAC,IAAI,EAAE;AAAA,IACd,QAAQ,CAAC,IAAI,EAAE;AAAA,IACf,MAAM,CAAC,IAAI,EAAE;AAAA,IACb,SAAS,CAAC,IAAI,EAAE;AAAA,IAChB,MAAM,CAAC,IAAI,EAAE;AAAA,IACb,OAAO,CAAC,IAAI,EAAE;AAAA;AAAA,IAGd,aAAa,CAAC,IAAI,EAAE;AAAA,IACpB,MAAM,CAAC,IAAI,EAAE;AAAA;AAAA,IACb,MAAM,CAAC,IAAI,EAAE;AAAA;AAAA,IACb,WAAW,CAAC,IAAI,EAAE;AAAA,IAClB,aAAa,CAAC,IAAI,EAAE;AAAA,IACpB,cAAc,CAAC,IAAI,EAAE;AAAA,IACrB,YAAY,CAAC,IAAI,EAAE;AAAA,IACnB,eAAe,CAAC,IAAI,EAAE;AAAA,IACtB,YAAY,CAAC,IAAI,EAAE;AAAA,IACnB,aAAa,CAAC,IAAI,EAAE;AAAA,EACrB;AAAA,EACA,SAAS;AAAA,IACR,SAAS,CAAC,IAAI,EAAE;AAAA,IAChB,OAAO,CAAC,IAAI,EAAE;AAAA,IACd,SAAS,CAAC,IAAI,EAAE;AAAA,IAChB,UAAU,CAAC,IAAI,EAAE;AAAA,IACjB,QAAQ,CAAC,IAAI,EAAE;AAAA,IACf,WAAW,CAAC,IAAI,EAAE;AAAA,IAClB,QAAQ,CAAC,IAAI,EAAE;AAAA,IACf,SAAS,CAAC,IAAI,EAAE;AAAA;AAAA,IAGhB,eAAe,CAAC,KAAK,EAAE;AAAA,IACvB,QAAQ,CAAC,KAAK,EAAE;AAAA;AAAA,IAChB,QAAQ,CAAC,KAAK,EAAE;AAAA;AAAA,IAChB,aAAa,CAAC,KAAK,EAAE;AAAA,IACrB,eAAe,CAAC,KAAK,EAAE;AAAA,IACvB,gBAAgB,CAAC,KAAK,EAAE;AAAA,IACxB,cAAc,CAAC,KAAK,EAAE;AAAA,IACtB,iBAAiB,CAAC,KAAK,EAAE;AAAA,IACzB,cAAc,CAAC,KAAK,EAAE;AAAA,IACtB,eAAe,CAAC,KAAK,EAAE;AAAA,EACxB;AACD;AAEO,IAAM,gBAAgB,OAAO,KAAK,OAAO,QAAQ;AACjD,IAAM,uBAAuB,OAAO,KAAK,OAAO,KAAK;AACrD,IAAM,uBAAuB,OAAO,KAAK,OAAO,OAAO;AACvD,IAAM,aAAa,CAAC,GAAG,sBAAsB,GAAG,oBAAoB;AAE3E,SAAS,iBAAiB;AACzB,QAAM,QAAQ,oBAAI,IAAI;AAEtB,aAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACxD,eAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AACvD,aAAO,SAAS,IAAI;AAAA,QACnB,MAAM,QAAU,MAAM,CAAC,CAAC;AAAA,QACxB,OAAO,QAAU,MAAM,CAAC,CAAC;AAAA,MAC1B;AAEA,YAAM,SAAS,IAAI,OAAO,SAAS;AAEnC,YAAM,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAAA,IAC7B;AAEA,WAAO,eAAe,QAAQ,WAAW;AAAA,MACxC,OAAO;AAAA,MACP,YAAY;AAAA,IACb,CAAC;AAAA,EACF;AAEA,SAAO,eAAe,QAAQ,SAAS;AAAA,IACtC,OAAO;AAAA,IACP,YAAY;AAAA,EACb,CAAC;AAED,SAAO,MAAM,QAAQ;AACrB,SAAO,QAAQ,QAAQ;AAEvB,SAAO,MAAM,OAAO,WAAW;AAC/B,SAAO,MAAM,UAAU,YAAY;AACnC,SAAO,MAAM,UAAU,YAAY;AACnC,SAAO,QAAQ,OAAO,WAAW,sBAAsB;AACvD,SAAO,QAAQ,UAAU,YAAY,sBAAsB;AAC3D,SAAO,QAAQ,UAAU,YAAY,sBAAsB;AAG3D,SAAO,iBAAiB,QAAQ;AAAA,IAC/B,cAAc;AAAA,MACb,MAAM,KAAK,OAAO,MAAM;AAGvB,YAAI,QAAQ,SAAS,UAAU,MAAM;AACpC,cAAI,MAAM,GAAG;AACZ,mBAAO;AAAA,UACR;AAEA,cAAI,MAAM,KAAK;AACd,mBAAO;AAAA,UACR;AAEA,iBAAO,KAAK,OAAQ,MAAM,KAAK,MAAO,EAAE,IAAI;AAAA,QAC7C;AAEA,eAAO,KACH,KAAK,KAAK,MAAM,MAAM,MAAM,CAAC,IAC7B,IAAI,KAAK,MAAM,QAAQ,MAAM,CAAC,IAC/B,KAAK,MAAM,OAAO,MAAM,CAAC;AAAA,MAC7B;AAAA,MACA,YAAY;AAAA,IACb;AAAA,IACA,UAAU;AAAA,MACT,MAAM,KAAK;AACV,cAAM,UAAU,yBAAyB,KAAK,IAAI,SAAS,EAAE,CAAC;AAC9D,YAAI,CAAC,SAAS;AACb,iBAAO,CAAC,GAAG,GAAG,CAAC;AAAA,QAChB;AAEA,YAAI,CAAC,WAAW,IAAI;AAEpB,YAAI,YAAY,WAAW,GAAG;AAC7B,wBAAc,CAAC,GAAG,WAAW,EAAE,IAAI,eAAa,YAAY,SAAS,EAAE,KAAK,EAAE;AAAA,QAC/E;AAEA,cAAM,UAAU,OAAO,SAAS,aAAa,EAAE;AAE/C,eAAO;AAAA;AAAA,UAEL,WAAW,KAAM;AAAA,UACjB,WAAW,IAAK;AAAA,UACjB,UAAU;AAAA;AAAA,QAEX;AAAA,MACD;AAAA,MACA,YAAY;AAAA,IACb;AAAA,IACA,cAAc;AAAA,MACb,OAAO,SAAO,OAAO,aAAa,GAAG,OAAO,SAAS,GAAG,CAAC;AAAA,MACzD,YAAY;AAAA,IACb;AAAA,IACA,eAAe;AAAA,MACd,MAAM,MAAM;AACX,YAAI,OAAO,GAAG;AACb,iBAAO,KAAK;AAAA,QACb;AAEA,YAAI,OAAO,IAAI;AACd,iBAAO,MAAM,OAAO;AAAA,QACrB;AAEA,YAAI;AACJ,YAAI;AACJ,YAAI;AAEJ,YAAI,QAAQ,KAAK;AAChB,kBAAS,OAAO,OAAO,KAAM,KAAK;AAClC,kBAAQ;AACR,iBAAO;AAAA,QACR,OAAO;AACN,kBAAQ;AAER,gBAAM,YAAY,OAAO;AAEzB,gBAAM,KAAK,MAAM,OAAO,EAAE,IAAI;AAC9B,kBAAQ,KAAK,MAAM,YAAY,CAAC,IAAI;AACpC,iBAAQ,YAAY,IAAK;AAAA,QAC1B;AAEA,cAAM,QAAQ,KAAK,IAAI,KAAK,OAAO,IAAI,IAAI;AAE3C,YAAI,UAAU,GAAG;AAChB,iBAAO;AAAA,QACR;AAGA,YAAI,SAAS,MAAO,KAAK,MAAM,IAAI,KAAK,IAAM,KAAK,MAAM,KAAK,KAAK,IAAK,KAAK,MAAM,GAAG;AAEtF,YAAI,UAAU,GAAG;AAChB,oBAAU;AAAA,QACX;AAEA,eAAO;AAAA,MACR;AAAA,MACA,YAAY;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACV,OAAO,CAAC,KAAK,OAAO,SAAS,OAAO,cAAc,OAAO,aAAa,KAAK,OAAO,IAAI,CAAC;AAAA,MACvF,YAAY;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACV,OAAO,SAAO,OAAO,cAAc,OAAO,aAAa,GAAG,CAAC;AAAA,MAC3D,YAAY;AAAA,IACb;AAAA,EACD,CAAC;AAED,SAAO;AACR;AAEA,IAAM,aAAa,eAAe;AAElC,IAAO,sBAAQ;;;AC9Nf,0BAAoB;AACpB,IAAAC,kBAAe;AACf,sBAAgB;AAIhB,SAAS,QAAQ,MAAM,OAAO,WAAW,OAAO,WAAW,KAAK,OAAO,oBAAAC,QAAQ,MAAM;AACpF,QAAM,SAAS,KAAK,WAAW,GAAG,IAAI,KAAM,KAAK,WAAW,IAAI,MAAM;AACtE,QAAM,WAAW,KAAK,QAAQ,SAAS,IAAI;AAC3C,QAAM,qBAAqB,KAAK,QAAQ,IAAI;AAC5C,SAAO,aAAa,OAAO,uBAAuB,MAAM,WAAW;AACpE;AAEA,IAAM,EAAC,IAAG,IAAI,oBAAAA;AAEd,IAAI;AACJ,IACC,QAAQ,UAAU,KACf,QAAQ,WAAW,KACnB,QAAQ,aAAa,KACrB,QAAQ,aAAa,GACvB;AACD,mBAAiB;AAClB,WACC,QAAQ,OAAO,KACZ,QAAQ,QAAQ,KAChB,QAAQ,YAAY,KACpB,QAAQ,cAAc,GACxB;AACD,mBAAiB;AAClB;AAEA,SAAS,gBAAgB;AACxB,MAAI,iBAAiB,KAAK;AACzB,QAAI,IAAI,gBAAgB,QAAQ;AAC/B,aAAO;AAAA,IACR;AAEA,QAAI,IAAI,gBAAgB,SAAS;AAChC,aAAO;AAAA,IACR;AAEA,WAAO,IAAI,YAAY,WAAW,IAAI,IAAI,KAAK,IAAI,OAAO,SAAS,IAAI,aAAa,EAAE,GAAG,CAAC;AAAA,EAC3F;AACD;AAEA,SAAS,eAAe,OAAO;AAC9B,MAAI,UAAU,GAAG;AAChB,WAAO;AAAA,EACR;AAEA,SAAO;AAAA,IACN;AAAA,IACA,UAAU;AAAA,IACV,QAAQ,SAAS;AAAA,IACjB,QAAQ,SAAS;AAAA,EAClB;AACD;AAEA,SAAS,eAAe,YAAY,EAAC,aAAa,aAAa,KAAI,IAAI,CAAC,GAAG;AAC1E,QAAM,mBAAmB,cAAc;AACvC,MAAI,qBAAqB,QAAW;AACnC,qBAAiB;AAAA,EAClB;AAEA,QAAM,aAAa,aAAa,iBAAiB;AAEjD,MAAI,eAAe,GAAG;AACrB,WAAO;AAAA,EACR;AAEA,MAAI,YAAY;AACf,QAAI,QAAQ,WAAW,KACnB,QAAQ,YAAY,KACpB,QAAQ,iBAAiB,GAAG;AAC/B,aAAO;AAAA,IACR;AAEA,QAAI,QAAQ,WAAW,GAAG;AACzB,aAAO;AAAA,IACR;AAAA,EACD;AAIA,MAAI,cAAc,OAAO,gBAAgB,KAAK;AAC7C,WAAO;AAAA,EACR;AAEA,MAAI,cAAc,CAAC,eAAe,eAAe,QAAW;AAC3D,WAAO;AAAA,EACR;AAEA,QAAM,MAAM,cAAc;AAE1B,MAAI,IAAI,SAAS,QAAQ;AACxB,WAAO;AAAA,EACR;AAEA,MAAI,oBAAAA,QAAQ,aAAa,SAAS;AAGjC,UAAM,YAAY,gBAAAC,QAAG,QAAQ,EAAE,MAAM,GAAG;AACxC,QACC,OAAO,UAAU,CAAC,CAAC,KAAK,MACrB,OAAO,UAAU,CAAC,CAAC,KAAK,OAC1B;AACD,aAAO,OAAO,UAAU,CAAC,CAAC,KAAK,QAAS,IAAI;AAAA,IAC7C;AAEA,WAAO;AAAA,EACR;AAEA,MAAI,QAAQ,KAAK;AAChB,QAAI,CAAC,kBAAkB,iBAAiB,UAAU,EAAE,KAAK,SAAO,OAAO,GAAG,GAAG;AAC5E,aAAO;AAAA,IACR;AAEA,QAAI,CAAC,UAAU,YAAY,aAAa,aAAa,OAAO,EAAE,KAAK,UAAQ,QAAQ,GAAG,KAAK,IAAI,YAAY,YAAY;AACtH,aAAO;AAAA,IACR;AAEA,WAAO;AAAA,EACR;AAEA,MAAI,sBAAsB,KAAK;AAC9B,WAAO,gCAAgC,KAAK,IAAI,gBAAgB,IAAI,IAAI;AAAA,EACzE;AAEA,MAAI,IAAI,cAAc,aAAa;AAClC,WAAO;AAAA,EACR;AAEA,MAAI,IAAI,SAAS,eAAe;AAC/B,WAAO;AAAA,EACR;AAEA,MAAI,IAAI,SAAS,iBAAiB;AACjC,WAAO;AAAA,EACR;AAEA,MAAI,IAAI,SAAS,WAAW;AAC3B,WAAO;AAAA,EACR;AAEA,MAAI,kBAAkB,KAAK;AAC1B,UAAM,UAAU,OAAO,UAAU,IAAI,wBAAwB,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,EAAE;AAElF,YAAQ,IAAI,cAAc;AAAA,MACzB,KAAK,aAAa;AACjB,eAAO,WAAW,IAAI,IAAI;AAAA,MAC3B;AAAA,MAEA,KAAK,kBAAkB;AACtB,eAAO;AAAA,MACR;AAAA,IAED;AAAA,EACD;AAEA,MAAI,iBAAiB,KAAK,IAAI,IAAI,GAAG;AACpC,WAAO;AAAA,EACR;AAEA,MAAI,8DAA8D,KAAK,IAAI,IAAI,GAAG;AACjF,WAAO;AAAA,EACR;AAEA,MAAI,eAAe,KAAK;AACvB,WAAO;AAAA,EACR;AAEA,SAAO;AACR;AAEO,SAAS,oBAAoB,QAAQ,UAAU,CAAC,GAAG;AACzD,QAAM,QAAQ,eAAe,QAAQ;AAAA,IACpC,aAAa,UAAU,OAAO;AAAA,IAC9B,GAAG;AAAA,EACJ,CAAC;AAED,SAAO,eAAe,KAAK;AAC5B;AAEA,IAAM,gBAAgB;AAAA,EACrB,QAAQ,oBAAoB,EAAC,OAAO,gBAAAC,QAAI,OAAO,CAAC,EAAC,CAAC;AAAA,EAClD,QAAQ,oBAAoB,EAAC,OAAO,gBAAAA,QAAI,OAAO,CAAC,EAAC,CAAC;AACnD;AAEA,IAAO,yBAAQ;;;AC5LR,SAAS,iBAAiB,QAAQ,WAAW,UAAU;AAC7D,MAAI,QAAQ,OAAO,QAAQ,SAAS;AACpC,MAAI,UAAU,IAAI;AACjB,WAAO;AAAA,EACR;AAEA,QAAM,kBAAkB,UAAU;AAClC,MAAI,WAAW;AACf,MAAI,cAAc;AAClB,KAAG;AACF,mBAAe,OAAO,MAAM,UAAU,KAAK,IAAI,YAAY;AAC3D,eAAW,QAAQ;AACnB,YAAQ,OAAO,QAAQ,WAAW,QAAQ;AAAA,EAC3C,SAAS,UAAU;AAEnB,iBAAe,OAAO,MAAM,QAAQ;AACpC,SAAO;AACR;AAEO,SAAS,+BAA+B,QAAQ,QAAQ,SAAS,OAAO;AAC9E,MAAI,WAAW;AACf,MAAI,cAAc;AAClB,KAAG;AACF,UAAM,QAAQ,OAAO,QAAQ,CAAC,MAAM;AACpC,mBAAe,OAAO,MAAM,UAAW,QAAQ,QAAQ,IAAI,KAAM,IAAI,UAAU,QAAQ,SAAS,QAAQ;AACxG,eAAW,QAAQ;AACnB,YAAQ,OAAO,QAAQ,MAAM,QAAQ;AAAA,EACtC,SAAS,UAAU;AAEnB,iBAAe,OAAO,MAAM,QAAQ;AACpC,SAAO;AACR;;;ACzBA,IAAM,EAAC,QAAQ,aAAa,QAAQ,YAAW,IAAI;AAEnD,IAAM,YAAY,uBAAO,WAAW;AACpC,IAAM,SAAS,uBAAO,QAAQ;AAC9B,IAAM,WAAW,uBAAO,UAAU;AAGlC,IAAM,eAAe;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAEA,IAAMC,UAAS,uBAAO,OAAO,IAAI;AAEjC,IAAM,eAAe,CAAC,QAAQ,UAAU,CAAC,MAAM;AAC9C,MAAI,QAAQ,SAAS,EAAE,OAAO,UAAU,QAAQ,KAAK,KAAK,QAAQ,SAAS,KAAK,QAAQ,SAAS,IAAI;AACpG,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACtE;AAGA,QAAM,aAAa,cAAc,YAAY,QAAQ;AACrD,SAAO,QAAQ,QAAQ,UAAU,SAAY,aAAa,QAAQ;AACnE;AASA,IAAM,eAAe,aAAW;AAC/B,QAAMC,SAAQ,IAAI,YAAY,QAAQ,KAAK,GAAG;AAC9C,eAAaA,QAAO,OAAO;AAE3B,SAAO,eAAeA,QAAO,YAAY,SAAS;AAElD,SAAOA;AACR;AAEA,SAAS,YAAY,SAAS;AAC7B,SAAO,aAAa,OAAO;AAC5B;AAEA,OAAO,eAAe,YAAY,WAAW,SAAS,SAAS;AAE/D,WAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,mBAAU,GAAG;AAC5D,EAAAC,QAAO,SAAS,IAAI;AAAA,IACnB,MAAM;AACL,YAAM,UAAU,cAAc,MAAM,aAAa,MAAM,MAAM,MAAM,OAAO,KAAK,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC;AACvG,aAAO,eAAe,MAAM,WAAW,EAAC,OAAO,QAAO,CAAC;AACvD,aAAO;AAAA,IACR;AAAA,EACD;AACD;AAEAA,QAAO,UAAU;AAAA,EAChB,MAAM;AACL,UAAM,UAAU,cAAc,MAAM,KAAK,MAAM,GAAG,IAAI;AACtD,WAAO,eAAe,MAAM,WAAW,EAAC,OAAO,QAAO,CAAC;AACvD,WAAO;AAAA,EACR;AACD;AAEA,IAAM,eAAe,CAAC,OAAO,OAAO,SAAS,eAAe;AAC3D,MAAI,UAAU,OAAO;AACpB,QAAI,UAAU,WAAW;AACxB,aAAO,oBAAW,IAAI,EAAE,QAAQ,GAAG,UAAU;AAAA,IAC9C;AAEA,QAAI,UAAU,WAAW;AACxB,aAAO,oBAAW,IAAI,EAAE,QAAQ,oBAAW,aAAa,GAAG,UAAU,CAAC;AAAA,IACvE;AAEA,WAAO,oBAAW,IAAI,EAAE,KAAK,oBAAW,UAAU,GAAG,UAAU,CAAC;AAAA,EACjE;AAEA,MAAI,UAAU,OAAO;AACpB,WAAO,aAAa,OAAO,OAAO,MAAM,GAAG,oBAAW,SAAS,GAAG,UAAU,CAAC;AAAA,EAC9E;AAEA,SAAO,oBAAW,IAAI,EAAE,KAAK,EAAE,GAAG,UAAU;AAC7C;AAEA,IAAM,aAAa,CAAC,OAAO,OAAO,SAAS;AAE3C,WAAW,SAAS,YAAY;AAC/B,EAAAA,QAAO,KAAK,IAAI;AAAA,IACf,MAAM;AACL,YAAM,EAAC,MAAK,IAAI;AAChB,aAAO,YAAa,YAAY;AAC/B,cAAM,SAAS,aAAa,aAAa,OAAO,aAAa,KAAK,GAAG,SAAS,GAAG,UAAU,GAAG,oBAAW,MAAM,OAAO,KAAK,MAAM,CAAC;AAClI,eAAO,cAAc,MAAM,QAAQ,KAAK,QAAQ,CAAC;AAAA,MAClD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,UAAU,OAAO,MAAM,CAAC,EAAE,YAAY,IAAI,MAAM,MAAM,CAAC;AAC7D,EAAAA,QAAO,OAAO,IAAI;AAAA,IACjB,MAAM;AACL,YAAM,EAAC,MAAK,IAAI;AAChB,aAAO,YAAa,YAAY;AAC/B,cAAM,SAAS,aAAa,aAAa,OAAO,aAAa,KAAK,GAAG,WAAW,GAAG,UAAU,GAAG,oBAAW,QAAQ,OAAO,KAAK,MAAM,CAAC;AACtI,eAAO,cAAc,MAAM,QAAQ,KAAK,QAAQ,CAAC;AAAA,MAClD;AAAA,IACD;AAAA,EACD;AACD;AAEA,IAAM,QAAQ,OAAO,iBAAiB,MAAM;AAAC,GAAG;AAAA,EAC/C,GAAGA;AAAA,EACH,OAAO;AAAA,IACN,YAAY;AAAA,IACZ,MAAM;AACL,aAAO,KAAK,SAAS,EAAE;AAAA,IACxB;AAAA,IACA,IAAI,OAAO;AACV,WAAK,SAAS,EAAE,QAAQ;AAAA,IACzB;AAAA,EACD;AACD,CAAC;AAED,IAAM,eAAe,CAAC,MAAM,OAAO,WAAW;AAC7C,MAAI;AACJ,MAAI;AACJ,MAAI,WAAW,QAAW;AACzB,cAAU;AACV,eAAW;AAAA,EACZ,OAAO;AACN,cAAU,OAAO,UAAU;AAC3B,eAAW,QAAQ,OAAO;AAAA,EAC3B;AAEA,SAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AACD;AAEA,IAAM,gBAAgB,CAAC,MAAM,SAAS,aAAa;AAGlD,QAAM,UAAU,IAAI,eAAe,WAAW,SAAU,WAAW,WAAW,IAAM,KAAK,WAAW,CAAC,IAAK,WAAW,KAAK,GAAG,CAAC;AAI9H,SAAO,eAAe,SAAS,KAAK;AAEpC,UAAQ,SAAS,IAAI;AACrB,UAAQ,MAAM,IAAI;AAClB,UAAQ,QAAQ,IAAI;AAEpB,SAAO;AACR;AAEA,IAAM,aAAa,CAAC,MAAM,WAAW;AACpC,MAAI,KAAK,SAAS,KAAK,CAAC,QAAQ;AAC/B,WAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EAC9B;AAEA,MAAI,SAAS,KAAK,MAAM;AAExB,MAAI,WAAW,QAAW;AACzB,WAAO;AAAA,EACR;AAEA,QAAM,EAAC,SAAS,SAAQ,IAAI;AAC5B,MAAI,OAAO,SAAS,MAAQ,GAAG;AAC9B,WAAO,WAAW,QAAW;AAI5B,eAAS,iBAAiB,QAAQ,OAAO,OAAO,OAAO,IAAI;AAE3D,eAAS,OAAO;AAAA,IACjB;AAAA,EACD;AAKA,QAAM,UAAU,OAAO,QAAQ,IAAI;AACnC,MAAI,YAAY,IAAI;AACnB,aAAS,+BAA+B,QAAQ,UAAU,SAAS,OAAO;AAAA,EAC3E;AAEA,SAAO,UAAU,SAAS;AAC3B;AAEA,OAAO,iBAAiB,YAAY,WAAWA,OAAM;AAErD,IAAM,QAAQ,YAAY;AACnB,IAAM,cAAc,YAAY,EAAC,OAAO,cAAc,YAAY,QAAQ,EAAC,CAAC;AAoBnF,IAAO,iBAAQ;;;AC7Nf,IAAMC,mBAAgE;AAAA,EACpE,MAAM,eAAM;AAAA,EACZ,KAAK,eAAM;AAAA,EACX,QAAQ,eAAM;AAAA,EACd,MAAM,eAAM;AAAA,EACZ,UAAU,eAAM,MAAM,MAAM;AAC9B;AAEA,IAAM,eAAsD;AAAA,EAC1D,OAAO,eAAM;AAAA,EACb,MAAM,eAAM;AAAA,EACZ,MAAM,eAAM;AAAA,EACZ,OAAO,eAAM;AACf;;;AChBA,IAAAC,kBAAe;AAqBR,SAAS,cAAwC;AACtD,SAAO,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,EAAE;AAC5D;AAEO,SAAS,UAAU,UAAyD;AACjF,QAAM,SAAS,YAAY;AAC3B,aAAW,KAAK,SAAU,QAAO,EAAE,QAAQ,KAAK,OAAO,EAAE,QAAQ,KAAK,KAAK;AAC3E,SAAO;AACT;AAEO,SAAS,WAAmB;AACjC,SAAO,GAAG,gBAAAC,QAAG,SAAS,CAAC,IAAI,QAAQ,GAAG;AACxC;;;ACiBA,IAAM,yBACJ;AAGF,IAAM,kBACJ;AAGF,IAAM,mBACJ;AAeF,IAAM,yBAAyB;AAG/B,IAAM,wBAAwB;AAgB9B,IAAM,sBAAsB,OAAO;AAKnC,IAAM,wBAAwB;AAEvB,IAAM,aAAkC;AAAA;AAAA,EAE7C;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA;AAAA;AAAA;AAAA,IAIF,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA;AAAA;AAAA,IAGT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA;AAAA;AAAA;AAAA,IAIT,cAAc;AAAA;AAAA;AAAA;AAAA,IAId,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA;AAAA;AAAA;AAAA,IAIF,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS,IAAI;AAAA,MACX,uDAAuD,qBAAqB,IAAI,mBAAmB;AAAA,IACrG;AAAA,IACA,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS,IAAI;AAAA,MACX,gCAAgC,qBAAqB,IAAI,mBAAmB,gCAC3C,qBAAqB,IAAI,mBAAmB;AAAA,IAC/E;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMtC,SAAS,IAAI;AAAA,MACX;AAAA,IAKF;AAAA,IACA,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS,IAAI;AAAA,MACX,iCAAiC,qBAAqB,IAAI,mBAAmB;AAAA,IAC/E;AAAA,IACA,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA,IAGtC,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA,IAGtC,SAAS;AAAA,IACT,WAAW;AAAA,IACX,UAAU;AAAA,EACZ;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,cAAc;AAAA,IACd,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtC,SACE;AAAA;AAAA;AAAA;AAAA,IAIF,UAAU;AAAA,IACV,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUP,oBAAoB;AAAA,EACtB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,cAAc;AAAA,IACd,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,cAAc;AAAA,IACd,OAAO;AAAA;AAAA;AAAA;AAAA,IAIP,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,IAKtC,SACE;AAAA,IACF,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA;AAAA;AAAA;AAAA,IAIV,sBAAsB;AAAA,EACxB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA,IAGtC,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA;AAAA,IAItC,SACE;AAAA,IACF,UAAU;AAAA,EACZ;AACF;;;AC5aO,IAAM,iBAAsC,CAAC,QAAQ,OAAO,UAAU,QAAQ,UAAU;AAExF,SAAS,aAAa,UAA4B;AACvD,QAAM,QAAQ,eAAe,QAAQ,QAAQ;AAC7C,SAAO,UAAU,KAAK,IAAI;AAC5B;AASO,SAAS,YAAY,UAAoB,YAAkC;AAChF,MAAI,eAAe,UAAW,QAAO;AACrC,SAAO,aAAa,QAAQ,IAAI,aAAa,QAAQ,IAAI,WAAW;AACtE;;;ACsHA,IAAM,eACJ;AAEF,IAAM,eAAe;AAErB,IAAM,eAAe;AAErB,IAAM,eACJ;AAEF,IAAM,iBACJ;AAUF,IAAM,eACJ;AAGF,IAAM,gBACJ;AAEK,SAAS,oBAAoB,UAAgC;AAClE,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAmBO,IAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBX;AAAA;AAGF,IAAM,YACJ;AAUF,IAAM,mBACJ;AAGF,IAAM,YACJ;AAGF,IAAM,aAAa;AAyBnB,IAAM,eACJ;AAqBF,IAAM,gBAAgB,eAAe,YAAY;AACjD,IAAM,gBAAgB,eAAe,YAAY;AACjD,IAAM,aAAa,MAAM,aAAa,IAAI,aAAa;AAEhD,IAAM,aAAkC;AAAA;AAAA,EAE7C;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAeV,SAAS,IAAI;AAAA,MACX,GAAG,UAAU,WACR,UAAU,mBACV,UAAU;AAAA,MAEf;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SAAS,IAAI;AAAA,MACX,iBAAiB,YAAY,uCACR,YAAY,mCACZ,YAAY;AAAA,MACjC;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAmBA,4BAA4B;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM,MAAM;AAAA,IACxB,SAAS,IAAI;AAAA,MACX,8DAA8D,YAAY;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SACE;AAAA,EACJ;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,4BAA4B;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,IAAI;AAAA,IAChB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAeT,WACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SAAS;AAAA,EACX;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA,IACV,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,IACT,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SAAS;AAAA,EACX;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAqCtC,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,IACT,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SACE;AAAA,IACF,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,IAAI;AAAA,IAChB,SAAS;AAAA,IACT,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SAAS;AAAA,IACT,WAAW;AAAA;AAAA;AAAA;AAAA,IAIX,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SACE;AAAA,IACF,OAAO;AAAA,IACP,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA;AAAA;AAAA;AAAA,IAIlB,SAAS;AAAA,IACT,cAAc;AAAA,IACd,OAAO;AAAA,IACP,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,IACT,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SACE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA;AAAA;AAAA;AAAA,IAIpB,SACE;AAAA,IACF,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA;AAAA;AAAA;AAAA,IAIT,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOpB,SACE;AAAA,IACF,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAcV,WAAW,CAAC,cAAc,cAAc,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAC7E,SAAS;AAAA,EACX;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA;AAAA;AAAA;AAAA,IAIV,SACE;AAAA,EACJ;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,OAAO;AAAA;AAAA;AAAA,IAGnB,SAAS;AAAA;AAAA;AAAA,IAGT,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAenB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,IAKT,WACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKnB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,OAAO;AAAA,IACnB,SACE;AAAA;AAAA;AAAA;AAAA;AAAA,IAKF,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,OAAO;AAAA,IACnB,SAAS;AAAA;AAAA,IAET,WACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,OAAO;AAAA,IACnB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,OAAO;AAAA;AAAA;AAAA;AAAA,IAInB,SAAS;AAAA,IACT,OAAO;AAAA,IACP,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA;AAAA;AAAA;AAAA,IAIjB,SAAS,IAAI;AAAA,MACX,sGAAsG,YAAY,kCAAkC,UAAU;AAAA,MAC9J;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA,IACjB,SACE;AAAA;AAAA;AAAA,IAGF,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA,IACjB,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA,IACjB,SACE;AAAA;AAAA;AAAA;AAAA,IAIF,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA,IACjB,SAAS;AAAA;AAAA,IAET,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA,IACjB,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA,IACjB,SACE;AAAA,IACF,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA,IACjB,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA;AAAA;AAAA;AAAA,IAIlB,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SACE;AAAA,IACF,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SACE;AAAA;AAAA;AAAA,IAGF,OAAO;AAAA,IACP,cAAc;AAAA,IACd,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA;AAAA;AAAA,IAGlB,SACE;AAAA,IACF,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,IAAI;AAAA,IAChB,SACE;AAAA;AAAA;AAAA,IAGF,OAAO;AAAA,IACP,WAAW;AAAA,IACX,cAAc;AAAA,IACd,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,IAAI;AAAA;AAAA;AAAA,IAGhB,SAAS;AAAA,IACT,cAAc;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA;AAAA;AAAA;AAAA,IAIpB,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA;AAAA;AAAA;AAAA,IAIpB,SAAS;AAAA;AAAA;AAAA;AAAA,IAIT,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA;AAAA;AAAA,IAGpB,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SACE;AAAA,IACF,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA;AAAA;AAAA;AAAA;AAAA,IAKF,WAAW;AAAA,IACX,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,cAAc;AAAA,IACd,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAmBF,WAAW;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,GAAG;AACL;AA+CA,IAAM,iBAAiB;AAWvB,IAAM,oBACJ;AAUK,SAAS,UAAU,MAAuB;AAC/C,SAAO,eAAe,KAAK,IAAI;AACjC;AAYO,SAAS,WAAW,OAAuC;AAChE,QAAM,SAAS,oBAAI,IAAY;AAC/B,MAAI,YAA2B;AAE/B,QAAM,QAAQ,CAAC,MAAM,UAAU;AAC7B,QAAI,WAAW;AACb,aAAO,IAAI,KAAK;AAChB,UAAI,KAAK,SAAS,SAAS,EAAG,aAAY;AAC1C;AAAA,IACF;AACA,eAAW,aAAa,CAAC,OAAO,KAAK,GAAG;AACtC,YAAM,QAAQ,KAAK,QAAQ,SAAS;AACpC,UAAI,UAAU,GAAI;AAElB,UAAI,KAAK,QAAQ,WAAW,QAAQ,UAAU,MAAM,MAAM,GAAI;AAC9D,kBAAY;AACZ,aAAO,IAAI,KAAK;AAChB;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAEA,SAAS,UAAU,MAAc,OAAe,OAAsC;AACpF,SAAO,UAAU,IAAI,KAAK,kBAAkB,KAAK,IAAI,MAAM,OAAO,IAAI,KAAK,KAAK;AAClF;AAEA,SAAS,WACP,OACA,OACA,MACA,SACA,OACQ;AACR,QAAM,OAAO,KAAK,IAAI,GAAG,QAAQ,IAAI;AACrC,QAAM,KAAK,KAAK,IAAI,MAAM,SAAS,GAAG,QAAQ,OAAO;AACrD,QAAM,YAAsB,CAAC;AAC7B,WAAS,IAAI,MAAM,KAAK,IAAI,KAAK,GAAG;AAClC,UAAM,OAAO,MAAM,CAAC,KAAK;AACzB,QAAI,MAAM,SAAS,UAAU,MAAM,GAAG,KAAK,EAAG;AAC9C,cAAU,KAAK,IAAI;AAAA,EACrB;AACA,SAAO,UAAU,KAAK,IAAI;AAC5B;AAWA,IAAM,YAAY,oBAAI,QAAmC;AAEzD,SAAS,WAAW,OAAkC;AACpD,MAAI,OAAO,UAAU,IAAI,KAAK;AAC9B,MAAI,SAAS,QAAW;AACtB,WAAO,MAAM,KAAK,IAAI;AACtB,cAAU,IAAI,OAAO,IAAI;AAAA,EAC3B;AACA,SAAO;AACT;AA6BA,SAAS,oBAAoB,MAAsB;AACjD,SAAO,KAAK,QAAQ,cAAc,IAAI;AACxC;AAsBA,SAAS,eAAe,MAAc,MAAsB;AAC1D,MAAI,MAAM;AACV,SAAO,MAAM,MAAM,KAAK,MAAM,CAAC,MAAM,OAAO,KAAK,MAAM,CAAC,MAAM,KAAO,QAAO;AAC5E,MAAI,QAAQ;AACZ,SAAO,QAAQ,KAAK,SAAS,KAAK,KAAK,QAAQ,CAAC,CAAE,EAAG,UAAS;AAC9D,SAAO,KAAK,MAAM,OAAO,GAAG;AAC9B;AAEO,SAAS,iBACd,OACA,OACA,MACU;AACV,QAAM,SAAS,MAAM,MAAM,KAAK,IAAI,GAAG,QAAQ,IAAI,GAAG,KAAK,EAAE,KAAK,IAAI;AACtE,QAAM,QAAkB,CAAC;AACzB,MAAI,QAAuB;AAE3B,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,GAAG;AACzC,UAAM,KAAK,OAAO,CAAC;AACnB,QAAI,OAAO;AACT,UAAI,OAAO,KAAM,MAAK;AAAA,eACb,OAAO,MAAO,SAAQ;AAC/B;AAAA,IACF;AACA,QAAI,OAAO,OAAO,OAAO,OAAO,OAAO,IAAK,SAAQ;AAAA,aAC3C,OAAO,IAAK,OAAM,KAAK,eAAe,QAAQ,CAAC,CAAC;AAAA,aAChD,OAAO,IAAK,OAAM,IAAI;AAAA,EACjC;AACA,SAAO;AACT;AAeA,SAAS,eAAe,MAA+B;AACrD,QAAM,QAAkB,CAAC;AACzB,WAAS,IAAI,OAAO;AAClB,UAAM,QAAQ,KAAK,QAAQ,MAAM,CAAC;AAClC,QAAI,UAAU,GAAI;AAClB,UAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ,CAAC;AACvC,QAAI,QAAQ,GAAI,QAAO;AACvB,UAAM,KAAK,KAAK,MAAM,QAAQ,GAAG,GAAG,EAAE,KAAK,CAAC;AAC5C,QAAI,MAAM;AAAA,EACZ;AACA,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAGA,SAAS,iBAAiB,MAAc,UAA2B;AACjE,QAAM,UAAU,KAAK,QAAQ,uBAAuB,MAAM;AAC1D,SAAO,IAAI;AAAA,IACT,eAAe,OAAO;AAAA,EACxB,EAAE,KAAK,QAAQ;AACjB;AASO,SAAS,0BAA0B,MAAc,UAA2B;AACjF,QAAM,QAAQ,eAAe,IAAI;AACjC,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,MAAM;AAAA,IACX,CAAC,SAAS,qBAAqB,KAAK,IAAI,KAAK,iBAAiB,MAAM,QAAQ;AAAA,EAC9E;AACF;AAWA,IAAM,iBAAiB;AAWvB,IAAM,OAAO,OAAO;AAEpB,IAAM,qBAAqB,IAAI;AAAA,EAC7B,GAAG,IAAI;AACT;AASA,SAAS,kBAAkB,MAA6B;AACtD,SAAO,mBAAmB,KAAK,IAAI,IAAI,CAAC,KAAK;AAC/C;AAcA,IAAM,eAAkC;AAAA;AAAA,EAEtC;AAAA;AAAA,EAEA,IAAI,OAAO,GAAG,IAAI,oDAAoD,GAAG;AAAA;AAAA,EAEzE,IAAI,OAAO,GAAG,IAAI,kCAAkC,GAAG;AACzD;AAGA,SAAS,WAAW,MAAc,MAAuB;AACvD,aAAW,SAAS,cAAc;AAGhC,UAAM,YAAY;AAClB,aAAS,QAAQ,MAAM,KAAK,IAAI,GAAG,UAAU,MAAM,QAAQ,MAAM,KAAK,IAAI,GAAG;AAC3E,UAAI,MAAM,CAAC,MAAM,KAAM,QAAO;AAAA,IAChC;AAAA,EACF;AACA,SAAO;AACT;AAQO,SAAS,sBAAsB,KAA4B;AAChE,QAAM,OAAO,IAAI,MAAM,IAAI,KAAK,KAAK;AAIrC,MAAI,wDAAwD,KAAK,IAAI,EAAG,QAAO;AAE/E,QAAM,OAAO,kBAAkB,IAAI;AACnC,MAAI,CAAC,KAAM,QAAO;AAMlB,MAAI,WAAW,KAAK,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC,GAAG,IAAI,EAAG,QAAO;AAEhE,QAAM,OAAO,KAAK,IAAI,IAAI,MAAM,SAAS,GAAG,IAAI,QAAQ,cAAc;AACtE,WAAS,IAAI,IAAI,QAAQ,GAAG,KAAK,MAAM,KAAK,GAAG;AAC7C,UAAM,OAAO,IAAI,MAAM,CAAC,KAAK;AAC7B,QAAI,UAAU,MAAM,GAAG,IAAI,KAAK,EAAG;AACnC,QAAI,WAAW,MAAM,IAAI,EAAG,QAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEO,SAAS,aAAa,MAAgB,KAAqC;AAChF,MAAI,KAAK,aAAa,CAAC,KAAK,UAAU,SAAS,IAAI,QAAQ,EAAG,QAAO;AAErE,QAAM,OAAO,IAAI,MAAM,IAAI,KAAK,KAAK;AACrC,MAAI,UAAU,IAAI,KAAK,IAAI,OAAO,IAAI,IAAI,KAAK,EAAG,QAAO;AACzD,MAAI,CAAC,KAAK,QAAQ,KAAK,IAAI,EAAG,QAAO;AAIrC,MAAI,KAAK,gBAAgB,CAAC,KAAK,aAAa,KAAK,WAAW,IAAI,KAAK,CAAC,EAAG,QAAO;AAEhF,QAAM,OAAO,KAAK,aAAa;AAC/B,QAAM,UAAU,KAAK,gBAAgB;AACrC,QAAM,UAAU,WAAW,IAAI,OAAO,IAAI,OAAO,MAAM,SAAS,IAAI,KAAK;AAEzE,MAAI,KAAK,YAAY,CAAC,KAAK,SAAS,KAAK,OAAO,EAAG,QAAO;AAE1D,MAAI,KAAK,WAAW,KAAK,IAAI,EAAG,QAAO;AAEvC,MAAI,KAAK,oBAAoB;AAC3B,UAAM,UAAU,iBAAiB,IAAI,OAAO,IAAI,OAAO,IAAI;AAC3D,QAAI,QAAQ,KAAK,CAAC,WAAW,KAAK,mBAAoB,KAAK,MAAM,CAAC,EAAG,QAAO;AAAA,EAC9E;AAEA,MAAI,KAAK,8BAA8B,0BAA0B,MAAM,WAAW,IAAI,KAAK,CAAC,GAAG;AAC7F,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,wBAAwB,sBAAsB,GAAG,EAAG,QAAO;AAEpE,QAAM,QAAQ,KAAK,UAAU,SAAY,gBAAgB,KAAK;AAC9D,MAAI,UAAU,MAAM,KAAK,IAAI,KAAK,MAAM,KAAK,OAAO,GAAI,QAAO;AAE/D,QAAM,YAAY,oBAAoB,IAAI,QAAQ;AAClD,QAAM,YAAY,IAAI,aAAa,UAAU,oBAAoB,IAAI,IAAI;AACzE,QAAM,eAAe,IAAI,aAAa,UAAU,oBAAoB,OAAO,IAAI;AAC/E,QAAM,aAAa,UAAU,KAAK,SAAS,KAAK,UAAU,KAAK,YAAY;AAC3E,MAAI,KAAK,gBAAgB,CAAC,WAAY,QAAO;AAK7C,QAAM,aAAyB,KAAK,WAChC,aACA,aACE,eACA;AACN,SAAO,EAAE,MAAM,YAAY,UAAU,YAAY,KAAK,UAAU,UAAU,EAAE;AAC9E;;;ACh4DA,IAAM,cAAc;AAEpB,IAAM,kBACJ;AAEK,IAAM,iBAA0C;AAAA,EACrD;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC,QAAQ,eAAe,SAAS,aAAa,KAAK;AAAA;AAAA,IAE/D,SAAS;AAAA,IACT,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC,QAAQ,SAAS,MAAM;AAAA,IACpC,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC,QAAQ,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAK5B,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC,QAAQ,MAAM;AAAA;AAAA;AAAA,IAG3B,SAAS;AAAA;AAAA,IAET,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC,SAAS,KAAK;AAAA;AAAA,IAE3B,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC,QAAQ,aAAa,SAAS,UAAU,WAAW,KAAK;AAAA,IACrE,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC,OAAO;AAAA,IACpB,SAAS;AAAA,EACX;AACF;AAGO,IAAM,sBAA2C,IAAI;AAAA,EAC1D,eAAe,QAAQ,CAAC,SAAS,KAAK,UAAU;AAClD;AAcO,SAAS,sBACd,WACA,OACiB;AACjB,QAAM,MAAM,UAAU,YAAY;AAClC,QAAM,aAAa,eAAe,OAAO,CAAC,SAAS,KAAK,WAAW,SAAS,GAAG,CAAC;AAChF,MAAI,WAAW,WAAW,EAAG,QAAO,CAAC;AAErC,QAAM,UAA2B,CAAC;AAClC,QAAM,QAAQ,CAAC,MAAM,UAAU;AAC7B,eAAW,QAAQ,YAAY;AAC7B,UAAI,CAAC,KAAK,QAAQ,KAAK,IAAI,EAAG;AAC9B,UAAI,KAAK,WAAW,KAAK,IAAI,EAAG;AAChC,cAAQ,KAAK;AAAA,QACX;AAAA;AAAA;AAAA,QAGA,UAAU,YAAY,KAAK,UAAU,SAAS;AAAA,QAC9C,MAAM,QAAQ;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACD,SAAO;AACT;;;AClIA,IAAM,mBACJ;AAEK,IAAM,oBAAgD;AAAA,EAC3D;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,UACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA;AAAA;AAAA;AAAA,IAIV,UACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,UACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AACF;AASO,IAAM,eAAN,MAAmB;AAAA,EACP,OAAO,oBAAI,IAAY;AAAA;AAAA,EAEhC,aAA4B;AAAA,EAEpC,QAAQ,cAAsB,MAAoB;AAChD,QAAI,KAAK,eAAe,QAAQ,iBAAiB,KAAK,IAAI,GAAG;AAC3D,WAAK,aAAa;AAAA,IACpB;AACA,eAAW,WAAW,mBAAmB;AACvC,UAAI,KAAK,KAAK,IAAI,QAAQ,EAAE,EAAG;AAC/B,UAAI,QAAQ,SAAS,KAAK,IAAI,EAAG,MAAK,KAAK,IAAI,QAAQ,EAAE;AAAA,IAC3D;AAAA,EACF;AAAA;AAAA,EAGA,UAAsC;AACpC,QAAI,KAAK,eAAe,KAAM,QAAO,CAAC;AACtC,WAAO,kBAAkB,OAAO,CAAC,YAAY,CAAC,KAAK,KAAK,IAAI,QAAQ,EAAE,CAAC;AAAA,EACzE;AAAA,EAEA,WAA0B;AACxB,UAAM,SAAS,KAAK;AACpB,QAAI,WAAW,KAAM,QAAO,CAAC;AAE7B,WAAO,KAAK,QAAQ,EAAE,IAAI,CAAC,aAAa;AAAA,MACtC,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,MAAM;AAAA,MACN,MAAM;AAAA;AAAA;AAAA;AAAA,MAIN,UAAU,YAAY,QAAQ,UAAU,SAAS;AAAA,MACjD,YAAY;AAAA,MACZ,SAAS,GAAG,QAAQ,KAAK,4DAAuD,QAAQ,GAAG;AAAA,MAC3F,aAAa,QAAQ;AAAA,MACrB,KAAK,QAAQ;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,IACZ,EAAE;AAAA,EACJ;AACF;;;AC1HA,IAAM,cAAc;AAAA,EAClB;AAAA,EAAS;AAAA,EAAa;AAAA,EAAU;AAAA,EAAW;AAAA,EAAS;AAAA,EAAS;AAAA,EAAa;AAAA,EAC1E;AAAA,EAAU;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAc;AAAA,EAAW;AAAA,EAAQ;AAAA,EACtE;AAAA,EAAU;AAAA,EAAY;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAS;AAAA,EAClE;AAAA,EAAc;AAAA,EAAa;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAY;AAAA,EAAS;AAAA,EAClE;AAAA,EAAU;AAAA,EAAO;AAAA,EAAU;AAAA,EAAM;AAAA,EAAa;AAAA,EAAY;AAAA,EAAa;AAAA,EACvE;AAAA,EAAM;AAAA,EAAS;AAAA,EAAU;AAAA,EAAS;AAAA,EAAW;AAAA,EAAgB;AAAA,EAAU;AAAA,EACvE;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAU;AAAA,EAAe;AAAA,EAAU;AAAA,EAAc;AAAA,EACnE;AAAA,EAAc;AAAA,EAAW;AAAA,EAAS;AAAA,EAAU;AAAA,EAAW;AAAA,EAAS;AAAA,EAChE;AAAA,EAAe;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAU;AAAA,EAAW;AAAA,EAAQ;AACrE;AAEA,IAAM,eAAe;AAAA,EACnB;AAAA,EAAY;AAAA,EAAW;AAAA,EAAS;AAAA,EAAU;AAAA,EAAS;AAAA,EAAS;AAAA,EAAU;AAAA,EACtE;AAAA,EAAc;AAAA,EAAY;AAAA,EAAS;AAAA,EAAU;AAAA,EAAU;AAAA,EAAS;AAAA,EAChE;AAAA,EAAc;AAAA,EAAS;AAAA,EAAO;AAAA,EAAO;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAW;AAAA,EACnE;AAAA,EAAmB;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAO;AAAA,EAAS;AAAA,EAAU;AAAA,EAAQ;AAAA,EACvE;AAAA,EAAkB;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAc;AAAA,EAAW;AAAA,EAC7D;AAAA,EAAc;AAAA,EAAS;AAAA,EAAgB;AAAA,EAAU;AAAA,EAAa;AAAA,EAAS;AAAA,EACvE;AAAA,EAAU;AAAA,EAAS;AAAA,EAAY;AAAA,EAAW;AAAA,EAAgB;AAAA,EAAY;AACxE;AASA,IAAM,kBAAkB;AAGxB,SAAS,cAAc,MAAsB;AAC3C,SAAO,KAAK,YAAY,EAAE,QAAQ,MAAM,EAAE,EAAE,QAAQ,YAAY,EAAE;AACpE;AAUO,SAAS,aAAa,GAAW,GAAW,MAAM,GAAW;AAClE,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,KAAK,IAAI,EAAE,SAAS,EAAE,MAAM,IAAI,IAAK,QAAO,MAAM;AAEtD,QAAM,OAAmB,CAAC;AAC1B,WAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,KAAK,GAAG;AACrC,SAAK,KAAK,IAAI,MAAc,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;AACjD,SAAK,CAAC,EAAG,CAAC,IAAI;AAAA,EAChB;AACA,WAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,KAAK,EAAG,MAAK,CAAC,EAAG,CAAC,IAAI;AAErD,WAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,KAAK,GAAG;AACrC,aAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,KAAK,GAAG;AACrC,YAAM,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI;AACzC,UAAI,OAAO,KAAK;AAAA,QACd,KAAK,IAAI,CAAC,EAAG,CAAC,IAAK;AAAA,QACnB,KAAK,CAAC,EAAG,IAAI,CAAC,IAAK;AAAA,QACnB,KAAK,IAAI,CAAC,EAAG,IAAI,CAAC,IAAK;AAAA,MACzB;AACA,UAAI,IAAI,KAAK,IAAI,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG;AACpE,eAAO,KAAK,IAAI,MAAM,KAAK,IAAI,CAAC,EAAG,IAAI,CAAC,IAAK,CAAC;AAAA,MAChD;AACA,WAAK,CAAC,EAAG,CAAC,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,KAAK,EAAE,MAAM,EAAG,EAAE,MAAM;AACjC;AAeO,SAAS,gBAAgB,MAAc,WAAgD;AAC5F,QAAM,UAAU,cAAc,QAAQ,cAAc;AACpD,QAAM,QAAQ,KAAK,YAAY;AAoB/B,MAAI,YAAY,KAAK,KAAK,EAAG,QAAO;AAEpC,MAAI,QAAQ,SAAS,KAAK,EAAG,QAAO;AACpC,MAAI,MAAM,SAAS,EAAG,QAAO;AAE7B,QAAM,aAAa,cAAc,KAAK;AACtC,aAAW,aAAa,SAAS;AAC/B,UAAM,sBAAsB,cAAc,SAAS;AAInD,QAAI,eAAe,oBAAqB,QAAO,EAAE,cAAc,WAAW,MAAM,YAAY;AAC5F,QAAI,aAAa,YAAY,qBAAqB,CAAC,MAAM,GAAG;AAC1D,aAAO,EAAE,cAAc,WAAW,MAAM,OAAO;AAAA,IACjD;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAM,oBAAoB,CAAC,cAAc,WAAW,eAAe,WAAW,YAAY;AASnF,SAAS,gBAAgB,MAAiC;AAC/D,QAAM,WAA8B,CAAC;AACrC,QAAM,QAAQ,KAAK,MAAM,IAAI;AAE7B,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,CAAC,WAA2B;AACzC,UAAM,QAAQ,MAAM,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,GAAG,CAAC;AACpE,WAAO,UAAU,KAAK,IAAI,QAAQ;AAAA,EACpC;AAEA,QAAM,aAAa,CAAC,gBAAgB,mBAAmB,wBAAwB,kBAAkB;AACjG,aAAW,UAAU,YAAY;AAC/B,UAAM,OAAO,OAAO,MAAM;AAC1B,QAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,eAAW,QAAQ,OAAO,KAAK,IAA+B,GAAG;AAC/D,YAAM,OAAO,OAAO,IAAI;AAExB,UAAI,gBAAgB,KAAK,IAAI,GAAG;AAC9B,iBAAS,KAAK;AAAA,UACZ,QAAQ;AAAA,UACR,OAAO;AAAA,UACP;AAAA,UACA,UAAU;AAAA,UACV,KAAK;AAAA,UACL,SAAS,IAAI,IAAI;AAAA,UACjB,aACE;AAAA,UACF,UAAU,MAAM,OAAO,CAAC,KAAK,IAAI,KAAK;AAAA,QACxC,CAAC;AACD;AAAA,MACF;AAEA,YAAM,QAAQ,gBAAgB,MAAM,KAAK;AACzC,UAAI,OAAO;AACT,iBAAS,KAAK;AAAA,UACZ,QAAQ;AAAA,UACR,OAAO;AAAA,UACP;AAAA,UACA,UAAU;AAAA,UACV,KAAK;AAAA,UACL,SACE,MAAM,SAAS,cACX,IAAI,IAAI,mBAAmB,MAAM,YAAY,0BAC7C,IAAI,IAAI,uBAAuB,MAAM,YAAY;AAAA,UACvD,aACE;AAAA,UACF,UAAU,MAAM,OAAO,CAAC,KAAK,IAAI,KAAK;AAAA,QACxC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO;AACvB,MAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,eAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,OAAkC,GAAG;AAC7E,UAAI,CAAC,kBAAkB,SAAS,IAAI,EAAG;AACvC,eAAS,KAAK;AAAA,QACZ,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,OAAO,IAAI;AAAA,QACjB,UAAU;AAAA,QACV,KAAK;AAAA,QACL,SAAS,IAAI,IAAI,oCAAoC,OAAO,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC;AAAA,QAC/E,aACE;AAAA,QACF,UAAU,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK;AAAA,MAChD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAGO,SAAS,oBAAoB,MAAiC;AACnE,QAAM,WAA8B,CAAC;AACrC,QAAM,QAAQ,KAAK,MAAM,IAAI;AAE7B,QAAM,QAAQ,CAAC,KAAK,UAAU;AAC5B,UAAM,OAAO,IAAI,KAAK;AACtB,QAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,EAAG;AAE3D,UAAM,QAAQ,wCAAwC,KAAK,IAAI;AAC/D,UAAM,OAAO,QAAQ,CAAC;AACtB,QAAI,CAAC,KAAM;AAEX,QAAI,gBAAgB,KAAK,IAAI,GAAG;AAC9B,eAAS,KAAK;AAAA,QACZ,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,QAAQ;AAAA,QACd,UAAU;AAAA,QACV,KAAK;AAAA,QACL,SAAS,IAAI,IAAI;AAAA,QACjB,aACE;AAAA,QACF,SAAS;AAAA,MACX,CAAC;AACD;AAAA,IACF;AAEA,UAAM,QAAQ,gBAAgB,MAAM,MAAM;AAC1C,QAAI,OAAO;AACT,eAAS,KAAK;AAAA,QACZ,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,QAAQ;AAAA,QACd,UAAU;AAAA,QACV,KAAK;AAAA,QACL,SACE,MAAM,SAAS,cACX,IAAI,IAAI,mBAAmB,MAAM,YAAY,0BAC7C,IAAI,IAAI,uBAAuB,MAAM,YAAY;AAAA,QACvD,aACE;AAAA,QACF,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAED,SAAO;AACT;;;ACpPO,IAAM,eAAsC;AAAA,EACjD;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SACE;AAAA,IACF,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA;AAAA,IAGN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA;AAAA;AAAA,IAIN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AACF;AASA,IAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA;AACF;AAWO,SAAS,mBAAmB,MAAuB;AACxD,SAAO,mBAAmB,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AAChE;AAuCO,SAAS,uBAAuB,MAAc,OAAwB;AAC3E,QAAM,KAAK,KAAK,YAAY,KAAK;AACjC,MAAI,OAAO,GAAI,QAAO;AACtB,SAAO,iDAAiD,KAAK,KAAK,MAAM,GAAG,EAAE,CAAC;AAChF;AAsBO,SAAS,oBAAoB,OAAwB;AAC1D,QAAM,UAAU,MAAM,KAAK;AAI3B,QAAM,SAAS,wDAAwD,KAAK,OAAO;AACnF,MAAI,QAAQ;AACV,UAAM,WAAW,OAAO,CAAC;AACzB,QAAI,aAAa,UAAa,SAAS,KAAK,MAAM,GAAI,QAAO;AAC7D,WAAO,4BAA4B,KAAK,SAAS,KAAK,CAAC;AAAA,EACzD;AAEA,SACE,mBAAmB,KAAK,OAAO;AAAA,EAC/B,kBAAkB,KAAK,OAAO;AAAA,EAC9B,mBAAmB,KAAK,OAAO;AAAA,EAC/B,oBAAoB,KAAK,OAAO;AAAA,EAChC,iBAAiB,KAAK,OAAO;AAAA,EAC7B,kBAAkB,KAAK,OAAO;AAElC;AAGA,IAAM,gBAAgB;AAAA,EACpB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAW;AAAA,EAC9D;AAAA,EAAW;AAAA,EAAW;AAAA,EAAW;AAAA,EAAU;AAAA,EAAS;AAAA,EAAW;AAAA,EAC/D;AAAA,EAAY;AAAA,EAAU;AACxB;AASA,IAAM,YAAY,oBAAI,IAAI,CAAC,SAAS,QAAQ,UAAU,SAAS,SAAS,UAAU,OAAO,CAAC;AAG1F,SAAS,MAAM,MAAwB;AACrC,SAAO,KACJ,QAAQ,sBAAsB,OAAO,EACrC,QAAQ,eAAe,GAAG,EAC1B,YAAY,EACZ,MAAM,GAAG,EACT,OAAO,OAAO;AACnB;AA6BO,SAAS,mBAAmB,MAAc,OAAwB;AACvE,QAAM,aAAa,MAAM,KAAK;AAC9B,MAAI,WAAW,KAAK,CAAC,SAAS,cAAc,KAAK,CAAC,SAAS,KAAK,WAAW,IAAI,CAAC,CAAC,EAAG,QAAO;AAE3F,SAAO,mBAAmB,MAAM,KAAK;AACvC;AAiCO,SAAS,mBAAmB,MAAc,OAAwB;AACvE,MAAI,MAAM,SAAS,GAAI,QAAO;AAE9B,QAAM,UAAU,KAAK,YAAY,KAAK;AACtC,QAAM,MAAM,YAAY,KAAK,OAAO,KAAK,MAAM,GAAG,OAAO;AACzD,QAAM,YAAY,MAAM,KAAK,EAAE,KAAK,EAAE;AAEtC,SAAO,MAAM,GAAG,EACb,OAAO,CAAC,SAAS,KAAK,UAAU,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,EACzD,KAAK,CAAC,SAAS,UAAU,SAAS,IAAI,CAAC;AAC5C;AAUO,SAAS,aAAa,MAAsB;AACjD,SAAO,KAAK,QAAQ,6BAA6B,CAAC,UAAU;AAC1D,QAAI,MAAM,UAAU,GAAI,QAAO;AAC/B,WAAO,GAAG,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC;AAAA,EAC1E,CAAC;AACH;AAGO,IAAM,kBAAuF;AAAA,EAClG,EAAE,SAAS,QAAQ,SAAS,gFAA2E,UAAU,OAAO;AAAA,EACxH,EAAE,SAAS,cAAc,SAAS,oCAAoC,UAAU,OAAO;AAAA,EACvF,EAAE,SAAS,mBAAmB,SAAS,yCAAyC,UAAU,WAAW;AAAA,EACrG,EAAE,SAAS,UAAU,SAAS,6BAA6B,UAAU,WAAW;AAAA,EAChF,EAAE,SAAS,cAAc,SAAS,6BAA6B,UAAU,WAAW;AAAA,EACpF,EAAE,SAAS,YAAY,SAAS,6BAA6B,UAAU,WAAW;AAAA,EAClF,EAAE,SAAS,QAAQ,SAAS,yCAAyC,UAAU,OAAO;AAAA,EACtF,EAAE,SAAS,QAAQ,SAAS,8BAA8B,UAAU,OAAO;AAAA,EAC3E,EAAE,SAAS,QAAQ,SAAS,8BAA8B,UAAU,OAAO;AAAA,EAC3E,EAAE,SAAS,aAAa,SAAS,2BAA2B,UAAU,OAAO;AAAA;AAAA;AAAA;AAI/E;;;ACraA,SAAS,WAAW,MAAsB;AACxC,SAAO,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC;AAC7C;AAEA,SAAS,YAAY,MAAsB;AACzC,QAAM,OAAO,WAAW,IAAI;AAC5B,QAAM,MAAM,KAAK,YAAY,GAAG;AAChC,SAAO,OAAO,IAAI,KAAK,KAAK,MAAM,GAAG;AACvC;AAEO,IAAM,YAAY,oBAAI,IAAI;AAAA,EAC/B;AAAA,EAAgB;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAO;AAAA,EAClE;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAc;AAAA,EAAY;AAAA,EAAU;AAAA,EAC/D;AAAA,EAAU;AAAA,EAAW;AAAA,EAAS;AAAA,EAAW;AAAA,EAAoB;AAC/D,CAAC;AAEM,IAAM,kBAAkB,oBAAI,IAAI;AAAA,EACrC;AAAA,EAAO;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EACtD;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAS;AAAA,EAAO;AAAA,EAAU;AAAA,EAAQ;AAAA,EACvD;AAAA,EAAM;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAQ;AAAA,EAAO;AAAA,EAC1C;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAS;AAAA,EAC5D;AAAA,EAAO;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAe;AAAA,EAC9D;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/C,GAAG;AACL,CAAC;AAED,IAAM,wBAAsD;AAAA,EAC1D,OAAO;AAAA,EAAc,QAAQ;AAAA,EAAc,QAAQ;AAAA,EAAc,QAAQ;AAAA,EACzE,OAAO;AAAA,EAAc,QAAQ;AAAA,EAAc,QAAQ;AAAA,EAAc,QAAQ;AAAA,EACzE,QAAQ;AAAA,EAAc,WAAW;AAAA,EAAc,QAAQ;AAAA,EACvD,OAAO;AAAA,EACP,OAAO;AAAA,EAAQ,QAAQ;AAAA,EACvB,OAAO;AAAA,EACP,SAAS;AAAA,EAAQ,OAAO;AAAA,EAAQ,UAAU;AAAA,EAC1C,QAAQ;AAAA,EACR,OAAO;AAAA,EAAS,SAAS;AAAA,EAAS,QAAQ;AAAA,EAC1C,QAAQ;AAAA,EAAU,SAAS;AAAA,EAAU,SAAS;AAAA,EAAU,SAAS;AAAA,EACjE,QAAQ;AAAA,EAAU,QAAQ;AAAA,EAAU,SAAS;AAAA,EAAU,QAAQ;AAAA,EAC/D,OAAO;AAAA,EAAU,QAAQ;AAAA,EAAU,eAAe;AACpD;AAEO,SAAS,WAAW,UAAgC;AACzD,MAAI,SAAS,WAAW,MAAM,KAAK,SAAS,SAAS,MAAM,EAAG,QAAO;AACrE,SAAO,sBAAsB,YAAY,QAAQ,EAAE,YAAY,CAAC,KAAK;AACvE;AAGA,IAAM,0BAAwD;AAAA,EAC5D,IAAI;AAAA,EAAS,MAAM;AAAA,EAAS,KAAK;AAAA,EAAS,MAAM;AAAA,EAAS,KAAK;AAAA,EAAS,KAAK;AAAA,EAC5E,QAAQ;AAAA,EAAU,SAAS;AAAA,EAAU,SAAS;AAAA,EAC9C,MAAM;AAAA,EACN,MAAM;AAAA,EAAc,QAAQ;AAAA,EAAc,MAAM;AAAA,EAAc,KAAK;AAAA,EACnE,KAAK;AACP;AAcO,SAAS,kBAAkB,WAAwC;AACxE,QAAM,QAAQ,+BAA+B,KAAK,SAAS;AAC3D,MAAI,CAAC,MAAO,QAAO;AAGnB,QAAM,UAAU,WAAW,MAAM,CAAC,CAAE;AACpC,QAAM,OAAO,MAAM,CAAC,GAAG,KAAK,EAAE,MAAM,KAAK,KAAK,CAAC;AAC/C,QAAM,cAAc,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC,MAAM;AACpD,QAAM,OAAO,YAAY,QAAQ,WAAW,KAAK,cAAc,IAAI,CAAC,KAAK,EAAE,IAAI;AAE/E,QAAM,QAAQ,wBAAwB,IAAI;AAC1C,MAAI,MAAO,QAAO;AAGlB,QAAM,WAAW,KAAK,QAAQ,WAAW,EAAE;AAC3C,UAAQ,WAAW,wBAAwB,QAAQ,IAAI,WAAc;AACvE;AAiBA,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AAoCtB,IAAM,mBAAmB;AAElB,SAAS,oBAAoB,MAAuB;AACzD,SAAO,iBAAiB,KAAK,IAAI;AACnC;AAQO,SAAS,oBAAoB,OAAwC;AAC1E,QAAM,SAAS,oBAAI,IAAyB;AAC5C,MAAI,QAAQ;AAEZ,QAAM,MAAM,CAAC,OAAe,WAAqC;AAC/D,UAAM,WAAW,OAAO,IAAI,KAAK,KAAK,oBAAI,IAAY;AACtD,aAAS,IAAI,UAAU,GAAG;AAC1B,WAAO,IAAI,OAAO,QAAQ;AAC1B,aAAS;AAAA,EACX;AAEA,QAAM,QAAQ,CAAC,MAAM,UAAU;AAC7B,UAAM,OAAO,cAAc,KAAK,IAAI;AACpC,QAAI,KAAM,KAAI,QAAQ,GAAG,KAAK,CAAC,CAAC;AAChC,UAAM,OAAO,cAAc,KAAK,IAAI;AAGpC,QAAI,QAAQ,CAAC,KAAM,KAAI,OAAO,KAAK,CAAC,CAAC;AAAA,EACvC,CAAC;AAED,SAAO,EAAE,QAAQ,MAAM;AACzB;AAEA,SAAS,aAAa,cAA4B,OAAe,QAAyB;AACxF,QAAM,QAAQ,aAAa,OAAO,IAAI,KAAK;AAC3C,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,MAAM;AAC3C;AAYO,SAAS,WAAW,cAA+B;AACxD,QAAM,IAAI,aAAa,QAAQ,OAAO,GAAG;AACzC,SACE,wGAAwG,KAAK,CAAC,KAC9G,oCAAoC,KAAK,CAAC,KAC1C,+BAA+B,KAAK,CAAC,KACrC,kBAAkB,KAAK,CAAC;AAE5B;AAwBO,SAAS,UAAU,cAA+B;AACvD,QAAM,IAAI,aAAa,QAAQ,OAAO,GAAG;AACzC,SACE,0CAA0C,KAAK,CAAC,KAChD,mCAAmC,KAAK,CAAC;AAE7C;AAkBA,IAAM,kBAAwC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,UAAU,SAAgE;AACjF,SAAO,gBAAgB,KAAK,CAAC,WAAW,QAAQ,MAAM,CAAC,KAAK;AAC9D;AAGA,IAAM,mBAA8C;AAAA,EAClD,MAAM;AAAA,EACN,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,mBACE;AACJ;AAGA,IAAM,iBAA4C;AAAA,EAChD,MAAM;AAAA,EACN,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,mBAAmB;AACrB;AAGO,SAAS,SACd,cACA,MACA,WAAyB,WAAW,YAAY,GACjC;AACf,QAAM,WAA0B,CAAC;AACjC,QAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,QAAM,eAAe,oBAAoB,KAAK;AAC9C,QAAM,UAAU,WAAW,YAAY;AACvC,QAAM,SAAS,UAAU,YAAY;AAGrC,QAAM,QAAQ,CAAC,MAAM,UAAU;AAC7B,eAAW,QAAQ,cAAc;AAC/B,YAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI;AACpC,UAAI,CAAC,MAAO;AACZ,UAAI,mBAAmB,MAAM,CAAC,CAAC,EAAG;AAClC,UAAI,aAAa,cAAc,OAAO,KAAK,EAAE,EAAG;AAKhD,YAAM,QAAQ,MAAM,CAAC,KAAK,MAAM,CAAC;AAGjC,UAAI,oBAAoB,KAAK,EAAG;AAIhC,UAAI,WAAW,KAAK,iBAAiB,mBAAmB,MAAM,KAAK,EAAG;AActE,YAAM,OAAO,UAAU;AAAA,QACrB,MAAM;AAAA,QACN,YAAY,oBAAoB,IAAI;AAAA,QACpC,aAAa,uBAAuB,MAAM,KAAK;AAAA,QAC/C,mBAAmB,KAAK,kBAAkB,QAAQ,mBAAmB,MAAM,KAAK;AAAA,MAClF,CAAC;AAED,eAAS,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA;AAAA;AAAA,QAGd,UAAU,OAAO,QAAQ,KAAK;AAAA;AAAA,QAE9B,YAAY;AAAA,QACZ,SAAS,OACL,YAAY,KAAK,IAAI,aAAa,iBAAiB,IAAI,CAAC,KACxD,YAAY,KAAK,IAAI;AAAA,QACzB,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK;AAAA,QACV,SAAS,aAAa,KAAK,KAAK,CAAC,EAAE,MAAM,GAAG,GAAG;AAAA,QAC/C,WAAW;AAAA,QACX,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAGD,QAAM,QAAQ,WAAW,KAAK;AAC9B,QAAM,QAAQ,CAAC,OAAO,UAAU;AAC9B,eAAW,QAAQ,YAAY;AAC7B,UAAI,aAAa,cAAc,OAAO,KAAK,EAAE,EAAG;AAChD,YAAM,QAAQ,aAAa,MAAM,EAAE,OAAO,OAAO,UAAU,MAAM,CAAC;AAClE,UAAI,CAAC,MAAO;AAUZ,YAAM,OAAO,UAAU;AAAA,QACrB,MAAM;AAAA,QACN,MAAM;AAAA,QACN,YAAY,oBAAoB,MAAM,KAAK,KAAK,EAAE;AAAA,MACpD,CAAC;AAED,eAAS,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,UAAU,OAAO,QAAQ,MAAM;AAAA,QAC/B,YAAY,MAAM;AAAA,QAClB,SAAS,OAAO,GAAG,KAAK,KAAK,KAAK,KAAK,GAAG,YAAO,eAAe,IAAI,CAAC,KAAK,GAAG,KAAK,KAAK,KAAK,KAAK,GAAG;AAAA,QACpG,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK;AAAA,QACV,UAAU,MAAM,KAAK,KAAK,IAAI,KAAK,EAAE,MAAM,GAAG,GAAG;AAAA,QACjD,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAQD,aAAW,SAAS,sBAAsB,YAAY,YAAY,GAAG,KAAK,GAAG;AAC3E,UAAM,QAAQ,MAAM,OAAO;AAC3B,QAAI,aAAa,cAAc,OAAO,MAAM,KAAK,EAAE,EAAG;AAEtD,UAAM,OAAO,UAAU;AAAA,MACrB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,YAAY,oBAAoB,MAAM,KAAK,KAAK,EAAE;AAAA,IACpD,CAAC;AAED,aAAS,KAAK;AAAA,MACZ,QAAQ,MAAM,KAAK;AAAA,MACnB,OAAO,MAAM,KAAK;AAAA,MAClB,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,UAAU,OAAO,QAAQ,MAAM;AAAA,MAC/B,YAAY;AAAA,MACZ,SAAS,OACL,GAAG,MAAM,KAAK,KAAK,KAAK,MAAM,KAAK,GAAG,YAAO,eAAe,IAAI,CAAC,KACjE,GAAG,MAAM,KAAK,KAAK,KAAK,MAAM,KAAK,GAAG;AAAA,MAC1C,aAAa,MAAM,KAAK;AAAA,MACxB,KAAK,MAAM,KAAK;AAAA,MAChB,UAAU,MAAM,KAAK,KAAK,IAAI,KAAK,EAAE,MAAM,GAAG,GAAG;AAAA,MACjD,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEO,SAAS,aAAa,cAAsB,UAAkB,MAA6B;AAChG,QAAM,mBACJ,aAAa,iBACT,gBAAgB,IAAI,IACpB,aAAa,qBACX,oBAAoB,IAAI,IACxB,CAAC;AAET,SAAO,iBAAiB,IAAI,CAAC,aAAa;AAAA,IACxC,QAAQ,QAAQ;AAAA,IAChB,OAAO,QAAQ;AAAA,IACf,MAAM;AAAA,IACN,MAAM,QAAQ;AAAA,IACd,UAAU,QAAQ;AAAA,IAClB,YAAY;AAAA,IACZ,SAAS,QAAQ;AAAA,IACjB,aAAa,QAAQ;AAAA,IACrB,KAAK,QAAQ;AAAA,IACb,SAAS,QAAQ,QAAQ,MAAM,GAAG,GAAG;AAAA,IACrC,UAAU;AAAA,EACZ,EAAE;AACJ;;;ACheA,IAAAC,mBAEO;AACP,IAAAC,oBAAgE;AAuDzD,SAAS,gBAAgB,UAA2D;AACzF,QAAM,WAAW,SACd,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,EAAE,WAAW,GAAG,CAAC,EAChD,IAAI,cAAc;AACrB,MAAI,SAAS,WAAW,EAAG,QAAO,MAAM;AACxC,SAAO,CAAC,YAAY;AAClB,UAAM,OAAO,QAAQ,MAAM,GAAG;AAC9B,WAAO,SAAS,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;AAAA,EACrC;AACF;AAeA,IAAM,WAAW,uBAAO,UAAU;AAGlC,SAAS,eAAe,SAAuD;AAI7E,QAAM,cAAc,QAAQ,QAAQ,UAAU,EAAE;AAChD,MAAI,MAAM,YAAY;AACtB,SAAO,MAAM,KAAK,YAAY,MAAM,CAAC,MAAM,IAAK,QAAO;AACvD,QAAM,IAAI,YAAY,MAAM,GAAG,GAAG;AAIlC,MAAI,CAAC,EAAE,SAAS,GAAG,GAAG;AACpB,QAAI,MAAM,KAAM,QAAO,MAAM;AAC7B,UAAM,KAAK,YAAY,CAAC;AACxB,WAAO,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;AAAA,EAC9C;AAEA,QAAM,MAAM,EAAE,MAAM,GAAG;AAGvB,QAAM,mBAAmB,IAAI,IAAI,SAAS,CAAC,MAAM;AACjD,QAAM,OAAO,mBAAmB,IAAI,MAAM,GAAG,EAAE,IAAI;AACnD,QAAM,QAAsB,KAAK,IAAI,CAAC,MAAO,MAAM,OAAO,WAAW,YAAY,CAAC,CAAE;AAEpF,SAAO,CAAC,SAAS;AACf,UAAMC,OAAM,YAAY,OAAO,IAAI;AACnC,QAAIA,OAAM,EAAG,QAAO;AAIpB,WAAO,mBAAmBA,OAAM,KAAK,SAAS;AAAA,EAChD;AACF;AAGA,SAAS,YAAY,KAAqB;AACxC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,GAAG;AACtC,UAAM,IAAI,IAAI,CAAC;AACf,QAAI,MAAM,KAAK;AAGb,aAAO,IAAI,IAAI,CAAC,MAAM,IAAK,MAAK;AAChC,cAAQ;AAAA,IACV,WAAW,MAAM,KAAK;AACpB,cAAQ;AAAA,IACV,OAAO;AACL,cAAQ,EAAE,QAAQ,qBAAqB,MAAM;AAAA,IAC/C;AAAA,EACF;AACA,SAAO,IAAI,OAAO,IAAI,IAAI,GAAG;AAC/B;AAQA,SAAS,YAAY,OAA8B,MAAiC;AAClF,MAAI,KAAK;AACT,MAAI,KAAK;AACT,MAAI,OAAO;AACX,MAAI,SAAS;AAEb,SAAO,KAAK,MAAM,QAAQ;AACxB,UAAM,OAAO,MAAM,EAAE;AACrB,QAAI,SAAS,UAAU;AACrB,aAAO;AACP,eAAS;AACT,YAAM;AAAA,IACR,WAAW,KAAK,KAAK,UAAU,KAAK,KAAK,KAAK,EAAE,CAAE,GAAG;AACnD,YAAM;AACN,YAAM;AAAA,IACR,WAAW,SAAS,MAAM,SAAS,KAAK,QAAQ;AAC9C,gBAAU;AACV,WAAK;AACL,WAAK,OAAO;AAAA,IACd,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,eAAe,MAAwB;AAC9C,MAAI;AACF,eAAO,mCAAa,wBAAK,MAAM,oBAAoB,GAAG,OAAO,EAAE,MAAM,IAAI;AAAA,EAC3E,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAgCO,SAAS,SAAS,YAAoB,UAAuB,CAAC,GAAe;AAClF,QAAM,eAAe,QAAQ,gBAAgB,OAAO;AACpD,QAAM,UAAU,QAAQ,aAAa,IAAI,IAAI,QAAQ,UAAU,IAAI;AACnE,QAAM,WAA0B,CAAC;AACjC,QAAM,WAAW,IAAI,aAAa;AAClC,QAAM,aAAuB,CAAC;AAC9B,MAAI,eAAe;AACnB,MAAI,aAAa;AACjB,MAAI,WAAW;AAMf,QAAM,mBAAmB,MAAM;AAC7B,QAAI;AACF,iBAAO,2BAAS,UAAU,EAAE,YAAY;AAAA,IAC1C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF,GAAG;AACH,QAAM,WAAW,kBAAkB,iBAAa,2BAAQ,UAAU;AAKlE,QAAM,aAAa,gBAAgB,CAAC,GAAI,QAAQ,WAAW,CAAC,GAAI,GAAG,eAAe,QAAQ,CAAC,CAAC;AAE5F,QAAM,WAAW,CAAC,UAAkB,aAA2B;AAC7D,UAAM,eAAe,WAAW,UAAU,QAAQ;AAClD,UAAM,gBAAY,2BAAQ,QAAQ,EAAE,YAAY;AAChD,UAAM,aAAa,aAAa,kBAAkB,aAAa;AAC/D,UAAM,YAAY,gBAAgB,IAAI,SAAS,KAAK,SAAS,WAAW,MAAM;AAS9E,UAAM,wBAAwB,CAAC,aAAa,CAAC,cAAc,cAAc;AAEzE,QAAI,CAAC,aAAa,CAAC,cAAc,CAAC,uBAAuB;AACvD,0BAAoB,UAAU,cAAc,UAAU,CAAC,CAAC;AACxD;AAAA,IACF;AAaA,QAAI;AACJ,QAAI;AACJ,QAAI,WAAgC;AACpC,QAAI;AACF,mBAAS,2BAAS,UAAU,GAAG;AAAA,IACjC,QAAQ;AACN,iBAAW,KAAK,YAAY;AAC5B;AAAA,IACF;AAEA,QAAI;AACF,cAAI,4BAAU,MAAM,EAAE,OAAO,aAAc;AAK3C,UAAI,uBAAuB;AACzB,cAAM,SAAS,OAAO,MAAM,GAAG;AAC/B,cAAM,WAAO,2BAAS,QAAQ,QAAQ,GAAG,OAAO,QAAQ,CAAC;AACzD,mBAAW,kBAAkB,OAAO,SAAS,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,MAAM,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE;AAC/F,YAAI,CAAC,SAAU;AAAA,MACjB;AAEA,iBAAO,+BAAa,QAAQ,OAAO;AAAA,IACrC,QAAQ;AACN,iBAAW,KAAK,YAAY;AAC5B;AAAA,IACF,UAAE;AACA,UAAI;AACF,wCAAU,MAAM;AAAA,MAClB,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,oBAAgB;AAChB,YAAQ,SAAS,YAAY;AAC7B,kBAAc,oBAAoB,KAAK,MAAM,IAAI,CAAC,EAAE;AAKpD,aAAS,QAAQ,cAAc,IAAI;AAEnC,UAAM,eAAe;AAAA,MACnB,GAAG,SAAS,cAAc,MAAM,YAAY,WAAW,QAAQ,CAAC;AAAA,MAChE,GAAI,aAAa,aAAa,cAAc,UAAU,IAAI,IAAI,CAAC;AAAA,IACjE;AAEA,aAAS,KAAK,GAAG,YAAY;AAC7B,wBAAoB,UAAU,cAAc,UAAU,YAAY;AAAA,EACpE;AAEA,QAAM,OAAO,CAAC,gBAA8B;AAC1C,QAAI;AACJ,QAAI;AACF,oBAAU,8BAAY,aAAa,EAAE,eAAe,KAAK,CAAC;AAAA,IAC5D,QAAQ;AACN,iBAAW,KAAK,WAAW,UAAU,WAAW,CAAC;AACjD;AAAA,IACF;AAEA,eAAW,SAAS,SAAS;AAC3B,YAAM,eAAW,wBAAK,aAAa,MAAM,IAAI;AAC7C,YAAM,eAAe,WAAW,UAAU,QAAQ;AAElD,UAAI,MAAM,YAAY,GAAG;AACvB,YAAI,UAAU,IAAI,MAAM,IAAI,EAAG;AAG/B,YAAI,WAAW,YAAY,GAAG;AAC5B,sBAAY;AACZ;AAAA,QACF;AACA,aAAK,QAAQ;AACb;AAAA,MACF;AACA,UAAI,CAAC,MAAM,OAAO,EAAG;AACrB,UAAI,WAAW,YAAY,GAAG;AAC5B,oBAAY;AACZ;AAAA,MACF;AAEA,eAAS,UAAU,MAAM,IAAI;AAAA,IAC/B;AAAA,EACF;AAEA,MAAI,iBAAiB;AACnB,SAAK,UAAU;AAAA,EACjB,WAAW,WAAW,WAAW,UAAU,UAAU,CAAC,GAAG;AACvD,gBAAY;AAAA,EACd,OAAO;AACL,aAAS,gBAAY,4BAAS,UAAU,CAAC;AAAA,EAC3C;AAIA,MAAI,QAAQ,gBAAiB,UAAS,KAAK,GAAG,SAAS,SAAS,CAAC;AAEjE,QAAM,WAAW,UAAU,SAAS,OAAO,CAAC,MAAM,QAAQ,IAAI,EAAE,QAAQ,CAAC,IAAI;AAC7E,WAAS;AAAA,IACP,CAAC,GAAG,MACF,aAAa,EAAE,QAAQ,IAAI,aAAa,EAAE,QAAQ,KAClD,EAAE,KAAK,cAAc,EAAE,IAAI,KAC3B,EAAE,OAAO,EAAE;AAAA,EACf;AAEA,SAAO,EAAE,UAAU,UAAU,cAAc,YAAY,YAAY,UAAU,MAAM,SAAS;AAC9F;AAWA,SAAS,oBACP,UACA,cACA,MACA,cACM;AACN,MAAI,aAAa,SAAS,EAAG;AAE7B,aAAW,aAAa,iBAAiB;AACvC,UAAM,UAAU,aAAa,UAAU,WAAW,SAAS,SAAS,UAAU,OAAO;AACrF,QAAI,CAAC,QAAS;AACd,SAAK,KAAK;AAAA,MACR,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,MAAM;AAAA,MACN,MAAM;AAAA,MACN,UAAU,UAAU;AAAA,MACpB,YAAY;AAAA,MACZ,SAAS,UAAU;AAAA,MACnB,aAAa;AAAA,MACb,KAAK;AAAA,MACL,SAAS;AAAA,MACT,WAAW;AAAA,MACX,UAAU;AAAA,IACZ,CAAC;AACD;AAAA,EACF;AACF;AAEA,SAAS,WAAW,MAAc,QAAwB;AACxD,QAAM,UAAM,4BAAS,MAAM,MAAM;AACjC,UAAQ,QAAQ,KAAK,SAAS,KAAK,MAAM,qBAAG,EAAE,KAAK,GAAG;AACxD;;;ACxZA,IAAAC,mBAAyC;AACzC,IAAAC,oBAAqB;AAwBrB,IAAM,wBAAwB;AAE9B,eAAsB,iBAAiB,YAA4C;AACjF,QAAM,WAA0B,CAAC;AAEjC,aAAW,EAAE,MAAM,WAAW,MAAM,KAAK,WAAW;AAClD,UAAM,eAAW,wBAAK,YAAY,IAAI;AACtC,QAAI,KAAC,6BAAW,QAAQ,EAAG;AAE3B,QAAI;AACJ,QAAI;AACF,aAAO,OAAO,UAAM,+BAAa,UAAU,OAAO,CAAC,CAAC;AAAA,IACtD,QAAQ;AACN;AAAA,IACF;AAKA,QAAI,KAAK,WAAW,GAAG;AACrB,eAAS,KAAK,kBAAkB,MAAM,mDAAmD,CAAC;AAC1F;AAAA,IACF;AAEA,QAAI,KAAK,SAAS,uBAAuB;AACvC,eAAS;AAAA,QACP;AAAA,UACE;AAAA,UACA,kBAAkB,qBAAqB,OAAO,KAAK,MAAM;AAAA,QAC3D;AAAA,MACF;AAAA,IACF;AAEA,eAAW,OAAO,KAAK,MAAM,GAAG,qBAAqB,GAAG;AACtD,UAAI;AACJ,UAAI;AACF,gBAAQ,MAAM,SAAS,IAAI,MAAM,IAAI,SAAS,SAAS;AAAA,MACzD,QAAQ;AACN;AAAA,MACF;AAEA,iBAAW,QAAQ,OAAO;AACxB,cAAM,OAAO,KAAK,UAAU,KAAK,CAAC,UAAU,MAAM,SAAS,SAAS,GAAG;AACvE,iBAAS,KAAK;AAAA,UACZ,QAAQ;AAAA,UACR,OAAO;AAAA,UACP;AAAA,UACA,MAAM;AAAA,UACN,UAAU,iBAAiB,IAAI;AAAA,UAC/B,YAAY;AAAA,UACZ,SAAS,GAAG,IAAI,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,WAAW,KAAK,EAAE;AAAA,UAC/D,aAAa;AAAA,UACb,SAAS,GAAG,KAAK,EAAE,GAAG,OAAO,WAAW,IAAI,MAAM,EAAE;AAAA,UACpD,UAAU;AAAA,QACZ,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAOA,SAAS,kBAAkB,MAAc,SAA8B;AACrE,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,OAAO;AAAA,IACP;AAAA,IACA,MAAM;AAAA,IACN,UAAU;AAAA,IACV,YAAY;AAAA,IACZ;AAAA,IACA,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AACF;AAEA,SAAS,iBAAiB,OAAqC;AAC7D,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,OAAO,WAAW,KAAK;AACrC,MAAI,OAAO,MAAM,KAAK,EAAG,QAAO;AAChC,MAAI,SAAS,EAAG,QAAO;AACvB,MAAI,SAAS,EAAG,QAAO;AACvB,MAAI,SAAS,EAAG,QAAO;AACvB,SAAO;AACT;AAQA,SAAS,OAAO,MAA8C;AAC5D,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAA6B,CAAC;AACpC,aAAW,OAAO,MAAM;AACtB,UAAM,MAAM,GAAG,IAAI,IAAI,IAAI,IAAI,OAAO;AACtC,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACA,SAAO;AACT;AASA,SAAS,iBAAiB,MAAuC;AAC/D,QAAM,KAAK,KAAK,YAAY,GAAG;AAC/B,MAAI,MAAM,EAAG,QAAO;AACpB,QAAM,OAAO,KAAK,MAAM,GAAG,EAAE;AAC7B,QAAM,UAAU,KAAK,MAAM,KAAK,CAAC;AACjC,MAAI,CAAC,QAAQ,CAAC,QAAS,QAAO;AAC9B,SAAO,EAAE,MAAM,QAAQ;AACzB;AAUA,SAAS,aAAa,KAA4B;AAChD,QAAM,UAAU,IAAI,KAAK,EAAE,QAAQ,UAAU,EAAE;AAC/C,SAAO,yBAAyB,KAAK,OAAO,IAAI,UAAU;AAC5D;AAEA,SAAS,iBAAiB,SAAqC;AAC7D,QAAM,OAAO,KAAK,MAAM,OAAO;AAI/B,QAAM,WAAW,KAAK,YAAY,KAAK,gBAAgB,CAAC;AACxD,QAAM,OAA2B,CAAC;AAClC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAGnD,UAAM,OAAO,IAAI,QAAQ,qBAAqB,EAAE;AAChD,UAAM,UAAU,OAAO;AACvB,QAAI,QAAQ,WAAW,CAAC,KAAK,WAAW,GAAG,EAAG,MAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AAAA,EAC3E;AACA,SAAO;AACT;AAkBA,SAAS,cAAc,SAAqC;AAC1D,QAAM,OAA2B,CAAC;AAClC,MAAI,aAAa;AAEjB,aAAW,QAAQ,QAAQ,MAAM,IAAI,GAAG;AACtC,QAAI,YAAY,KAAK,IAAI,GAAG;AAC1B,mBAAa,KAAK,WAAW,WAAW;AACxC;AAAA,IACF;AACA,QAAI,CAAC,WAAY;AAGjB,UAAM,QAAQ,sBAAsB,KAAK,IAAI;AAC7C,QAAI,CAAC,QAAQ,CAAC,EAAG;AAEjB,QAAI,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,gBAAgB,EAAE;AACpD,UAAM,IAAI,QAAQ,OAAO,EAAE;AAG3B,UAAM,IAAI,QAAQ,SAAS,EAAE;AAK7B,QAAI;AACJ,QAAI;AACJ,UAAM,UAAU,4BAA4B,KAAK,GAAG;AACpD,QAAI,UAAU,CAAC,KAAK,QAAQ,CAAC,GAAG;AAC9B,aAAO,QAAQ,CAAC;AAChB,mBAAa,QAAQ,CAAC;AAAA,IACxB,OAAO;AACL,YAAM,MAAM,iBAAiB,GAAG;AAChC,UAAI,CAAC,IAAK;AACV,aAAO,IAAI;AACX,mBAAa,IAAI;AAAA,IACnB;AAIA,UAAM,UAAU,aAAa,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAC3D,QAAI,QAAS,MAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AAAA,EAC1C;AAEA,SAAO;AACT;AAWA,SAAS,cAAc,SAAqC;AAC1D,QAAM,OAA2B,CAAC;AAClC,MAAI,cAA6B;AAEjC,aAAW,QAAQ,QAAQ,MAAM,IAAI,GAAG;AACtC,QAAI,KAAK,WAAW,GAAG,KAAK,KAAK,KAAK,MAAM,GAAI;AAEhD,QAAI,CAAC,MAAM,KAAK,IAAI,GAAG;AACrB,oBAAc;AACd,YAAM,SAAS,KAAK,QAAQ,SAAS,EAAE;AAGvC,YAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,QAAQ,gBAAgB,EAAE;AACrE,UAAI,CAAC,MAAO;AAEZ,UAAI,CAAC,MAAM,SAAS,GAAG,KAAK,UAAU,aAAc;AAKpD,UAAI,8CAA8C,KAAK,KAAK,EAAG;AAC/D,YAAM,MAAM,iBAAiB,MAAM,QAAQ,SAAS,GAAG,CAAC;AACxD,UAAI,IAAK,eAAc,IAAI;AAC3B;AAAA,IACF;AAEA,QAAI,CAAC,YAAa;AAClB,UAAM,UAAU,2CAA2C,KAAK,IAAI;AACpE,QAAI,CAAC,UAAU,CAAC,EAAG;AACnB,UAAM,QAAQ,aAAa,QAAQ,CAAC,CAAC;AACrC,QAAI,MAAO,MAAK,KAAK,EAAE,MAAM,aAAa,SAAS,MAAM,CAAC;AAC1D,kBAAc;AAAA,EAChB;AAEA,SAAO;AACT;AAGA,SAAS,iBAAiB,SAAqC;AAC7D,QAAM,OAAO,KAAK,MAAM,OAAO;AAC/B,QAAM,OAA2B,CAAC;AAElC,aAAW,WAAW,CAAC,WAAW,SAAS,GAAG;AAC5C,UAAM,WAAW,KAAK,OAAO;AAC7B,QAAI,CAAC,YAAY,OAAO,aAAa,SAAU;AAC/C,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAGpD,YAAM,UAAU,aAAa,OAAO,OAAO,WAAW,EAAE,EAAE,QAAQ,OAAO,EAAE,CAAC;AAC5E,UAAI,QAAQ,QAAS,MAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AAAA,IAClD;AAAA,EACF;AAEA,SAAO;AACT;AAQA,SAAS,qBAAqB,SAAqC;AACjE,QAAM,OAA2B,CAAC;AAElC,aAAW,OAAO,QAAQ,MAAM,IAAI,GAAG;AAGrC,UAAM,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACpD,QAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,EAAG;AAEnC,UAAM,QAAQ,wDAAwD,KAAK,IAAI;AAC/E,QAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAG;AAE9B,UAAM,UAAU,aAAa,MAAM,CAAC,CAAC;AACrC,QAAI,QAAS,MAAK,KAAK,EAAE,MAAM,MAAM,CAAC,GAAG,QAAQ,CAAC;AAAA,EACpD;AAEA,SAAO;AACT;AAEA,IAAM,YAAwC;AAAA,EAC5C,EAAE,MAAM,qBAAqB,WAAW,OAAO,OAAO,iBAAiB;AAAA,EACvE,EAAE,MAAM,kBAAkB,WAAW,OAAO,OAAO,cAAc;AAAA,EACjE,EAAE,MAAM,aAAa,WAAW,OAAO,OAAO,cAAc;AAAA,EAC5D,EAAE,MAAM,oBAAoB,WAAW,QAAQ,OAAO,qBAAqB;AAAA,EAC3E,EAAE,MAAM,gBAAgB,WAAW,QAAQ,OAAO,iBAAiB;AACrE;AAGO,IAAM,mBAA6D,OAAO;AAAA,EAC/E,UAAU,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,MAAM,KAAK,CAAC;AACpD;AAGA,SAAS,mBAAmB,MAAuB;AACjD,SAAO,6BAA6B,KAAK,IAAI;AAC/C;AAEA,SAAS,eAAe,SAA0B;AAChD,SAAO,2BAA2B,KAAK,OAAO;AAChD;AAEA,eAAe,SAAS,MAAc,SAAiB,WAAgD;AACrG,MAAI,CAAC,mBAAmB,IAAI,KAAK,CAAC,eAAe,OAAO,EAAG,QAAO,CAAC;AAEnE,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,gCAAgC;AAAA,MAC3D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,GAAG,QAAQ,CAAC;AAAA,MAC9D,QAAQ,YAAY,QAAQ,GAAI;AAAA,IAClC,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,QAAO,CAAC;AAC1B,UAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,KAAK,SAAS,CAAC;AAAA,EACxB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;;;AC/WA,IAAAC,sBAA2B;AAC3B,IAAAC,oBAAmD;;;AjBiCnD,SAAS,cAAsB;AAC7B,aAAW,aAAa;AAAA,QACtB,yBAAK,WAAW,MAAM,cAAc;AAAA,QACpC,yBAAK,WAAW,MAAM,MAAM,cAAc;AAAA,EAC5C,GAAG;AACD,QAAI;AACF,aACG,KAAK,UAAM,+BAAa,WAAW,OAAO,CAAC,EAA2B,WAAW;AAAA,IAEtF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAM,cAAc,YAAY;AAmBhC,SAAS,YACP,YACA,UACA,cACW;AACX,QAAM,aAAkC,SAAS,IAAI,CAAC,aAAa;AAAA,IACjE,MAAM,QAAQ;AAAA,IACd,UAAU,QAAQ;AAAA,IAClB,SAAS,QAAQ;AAAA,IACjB,UAAU,GAAG,QAAQ,IAAI,IAAI,QAAQ,IAAI;AAAA,IACzC,SAAS;AAAA,MACP,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,SAAS,QAAQ;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB,YAAY,QAAQ;AAAA,MACpB,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,IAC5C;AAAA,EACF,EAAE;AACF,QAAM,SAAS,UAAU,UAAU;AAEnC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,kBAAkB;AAAA,IAClB,SACE,SAAS,WAAW,IAChB,0BAA0B,YAAY,WACtC,GAAG,SAAS,MAAM,cAAc,OAAO,QAAQ,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,KAAK,OAAO,GAAG;AAAA,EACxG;AACF;AAEA,SAAS,aAAa,YAAoB,SAA4B;AACpE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU,CAAC;AAAA,IACX,kBAAkB,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,EAAE;AAAA,IACrE,SAAS,gBAAgB,OAAO;AAAA,IAChC,OAAO;AAAA,EACT;AACF;AASA,eAAsB,QAAQ,YAAwC;AACpE,MAAI;AACF,UAAM,SAAS,SAAS,UAAU;AAClC,UAAM,WAAW,CAAC,GAAG,OAAO,UAAU,GAAI,MAAM,iBAAiB,UAAU,CAAE;AAC7E,WAAO,YAAY,YAAY,UAAU,OAAO,YAAY;AAAA,EAC9D,SAAS,KAAK;AACZ,WAAO,aAAa,YAAa,IAAc,OAAO;AAAA,EACxD;AACF;;;AkB1IA,IAAM,iBAAiB;AAAA,EACrB;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,SAAiB,6DAA6D,KAAK,IAAI;AAAA,IAC9F,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,KAAa,SAAiB,KAAK,SAAS,eAAe,KAAK,KAAK,SAAS,iBAAiB;AAAA,IACtG,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,MAAc,OAAe,YAAoC;AACtE,YAAM,WAAW,CAAC,0BAA0B,mBAAmB,2BAA2B;AAC1F,YAAM,UAAU,SAAS,OAAO,OAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AAC9D,aAAO,QAAQ,SAAS;AAAA,IAC1B;AAAA,IACA,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,MAAc,OAAe,YAAoC;AACtE,aAAO,CAAC,EAAE,QAAQ,QAAQ,KAAK,2BAA2B,KAAK,QAAQ,QAAQ,CAAC;AAAA,IAClF;AAAA,IACA,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,SAAiB,0CAA0C,KAAK,IAAI;AAAA,IAC3E,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,SAAiB,mDAAmD,KAAK,IAAI;AAAA,IACpF,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA;AAAA,EAEA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,MAAc,OAAe,YAAoC;AACtE,YAAM,OAAO,QAAQ,6BAA6B;AAClD,aAAO,SAAS,OAAO,SAAS;AAAA,IAClC;AAAA,IACA,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,MAAc,OAAe,YAAoC;AACtE,YAAM,YAAY,QAAQ,YAAY,KAAK;AAC3C,aAAO,UAAU,SAAS,MAAM,CAAC,UAAU,SAAS,UAAU,KAAK,CAAC,UAAU,SAAS,QAAQ;AAAA,IACjG;AAAA,IACA,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,MAAc,OAAe,YAAoC;AACtE,aAAO,CAAC,QAAQ,yBAAyB;AAAA,IAC3C;AAAA,IACA,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,SAAiB,sDAAsD,KAAK,IAAI;AAAA,IACvF,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AACF;AAEA,eAAsB,WAAW,QAAoC;AACnE,QAAM,YAAY,OAAO,WAAW,MAAM,IAAI,SAAS,WAAW,MAAM;AACxE,QAAM,UAAU,MAAM,sBAAsB,SAAS;AACrD,QAAM,aAAkC,QAAQ,IAAI,CAAC,OAAO;AAAA,IAC1D,MAAM,EAAE;AAAA,IACR,UAAU,EAAE,aAAa,QAAQ,QAAS,EAAE;AAAA,IAC5C,SAAS,EAAE;AAAA,IACX,UAAU,EAAE;AAAA,IACZ,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAC/C,EAAE;AACF,QAAM,SAAS,UAAU,UAAU;AACnC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,kBAAkB;AAAA,IAClB,SAAS,WAAW,WAAW,IAC3B,gCACA,GAAG,WAAW,MAAM,cAAc,OAAO,QAAQ,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,KAAK,OAAO,GAAG;AAAA,EACxG;AACF;AAEA,eAAe,sBAAsB,WAA6C;AAChF,QAAM,UAA2B,CAAC;AAClC,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,WAAW,EAAE,UAAU,SAAS,CAAC;AAC1D,UAAM,UAAkC,CAAC;AACzC,SAAK,QAAQ,QAAQ,CAAC,GAAG,MAAM;AAAE,cAAQ,CAAC,IAAI;AAAA,IAAG,CAAC;AAClD,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,eAAW,SAAS,gBAAgB;AAClC,UAAI;AACF,YAAI,MAAM,KAAK,MAAM,MAAM,OAAO,GAAG;AACnC,kBAAQ,KAAK,EAAE,KAAK,WAAW,MAAM,MAAM,MAAM,UAAU,MAAM,UAAU,SAAS,MAAM,QAAQ,CAAC;AAAA,QACrG;AAAA,MACF,QAAQ;AAAA,MAAa;AAAA,IACvB;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,CAAC,cAAc,0BAA0B,cAAc;AAC5E,aAAW,WAAW,cAAc;AAClC,QAAI;AACF,YAAM,UAAU,GAAG,SAAS,OAAO,mBAAmB,OAAO,CAAC;AAC9D,YAAM,OAAO,MAAM,MAAM,SAAS,EAAE,UAAU,UAAU,QAAQ,YAAY,QAAQ,GAAI,EAAE,CAAC;AAC3F,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAI,yDAAyD,KAAK,IAAI,GAAG;AACvE,gBAAQ,KAAK,EAAE,KAAK,SAAS,MAAM,iBAAiB,UAAU,YAAY,SAAS,2BAA2B,OAAO,GAAG,CAAC;AAAA,MAC3H;AAAA,IACF,QAAQ;AAAA,IAAa;AAAA,EACvB;AAEA,QAAM,iBAAiB,CAAC,oBAAoB,0BAA0B,wBAAwB;AAC9F,aAAW,QAAQ,gBAAgB;AACjC,QAAI;AACF,YAAM,UAAU,GAAG,SAAS,IAAI,IAAI;AACpC,YAAM,OAAO,MAAM,MAAM,SAAS,EAAE,UAAU,UAAU,QAAQ,YAAY,QAAQ,GAAI,EAAE,CAAC;AAC3F,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAI,+CAA+C,KAAK,IAAI,GAAG;AAC7D,gBAAQ,KAAK,EAAE,KAAK,SAAS,MAAM,kBAAkB,UAAU,YAAY,SAAS,oCAAoC,IAAI,GAAG,CAAC;AAAA,MAClI;AAAA,IACF,QAAQ;AAAA,IAAa;AAAA,EACvB;AAEA,QAAM,UAAU,CAAC,WAAW,SAAS,UAAU,KAAK;AACpD,aAAW,UAAU,SAAS;AAC5B,QAAI;AACF,YAAM,OAAO,MAAM,MAAM,WAAW,EAAE,QAAQ,QAAQ,YAAY,QAAQ,GAAI,EAAE,CAAC;AACjF,UAAI,KAAK,SAAS,OAAO,WAAW,WAAW;AAC7C,gBAAQ,KAAK,EAAE,KAAK,WAAW,MAAM,uBAAuB,MAAM,IAAI,UAAU,UAAU,SAAS,GAAG,MAAM,oBAAoB,KAAK,MAAM,IAAI,CAAC;AAAA,MAClJ;AACA,UAAI,WAAW,WAAW;AACxB,cAAM,QAAQ,KAAK,QAAQ,IAAI,OAAO;AACtC,YAAI,SAAS,oBAAoB,KAAK,KAAK,GAAG;AAC5C,kBAAQ,KAAK,EAAE,KAAK,WAAW,MAAM,gBAAgB,UAAU,OAAO,SAAS,oBAAoB,KAAK,GAAG,CAAC;AAAA,QAC9G;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAa;AAAA,EACvB;AAEA,SAAO;AACT;;;ACzKA,IAAM,UAAU,QAAQ,IAAI,uBAAuB;AACnD,IAAM,mBAAmB;AACzB,IAAM,uBAAuB;AAiBtB,IAAM,aAAN,MAAiB;AAAA,EAMtB,YAAoBC,MAAe;AAAf,eAAAA;AAAA,EAAgB;AAAA,EAAhB;AAAA,EALZ,YAAmC;AAAA,EACnC,gBAAuC;AAAA,EACvC,UAAU;AAAA,EACV,SAAmB,CAAC;AAAA,EAI5B,MAAM,QAAuB;AAC3B,QAAI,CAAC,WAAW,EAAG;AAEnB,QAAI;AACF,YAAM,KAAK,YAAY;AAAA,IACzB,QAAQ;AAAA,IAER;AAEA,SAAK,IAAI,eAAe,eAAe,WAAW,QAAQ,mBAAmB,GAAI,GAAG;AACpF,SAAK,KAAK;AACV,SAAK,aAAa;AAClB,SAAK,YAAY,YAAY,MAAM,KAAK,KAAK,GAAG,gBAAgB;AAChE,SAAK,gBAAgB,YAAY,MAAM,KAAK,aAAa,GAAG,oBAAoB;AAAA,EAClF;AAAA,EAEA,OAAa;AACX,QAAI,KAAK,UAAW,eAAc,KAAK,SAAS;AAChD,QAAI,KAAK,cAAe,eAAc,KAAK,aAAa;AACxD,SAAK,YAAY;AACjB,SAAK,gBAAgB;AACrB,SAAK,IAAI,eAAe,eAAe,SAAS;AAAA,EAClD;AAAA,EAEA,MAAc,eAA8B;AAC1C,QAAI,CAAC,WAAW,EAAG;AACnB,QAAI;AACF,UAAI,KAAK,OAAO,WAAW,EAAG,OAAM,KAAK,YAAY;AACrD,iBAAW,SAAS,KAAK,QAAQ;AAC/B,YAAI;AACF,gBAAM,MAAM,GAAG,OAAO,aAAa,KAAK,mBAAmB;AAAA,YACzD,QAAQ;AAAA,YACR,SAAS,YAAY;AAAA,UACvB,CAAC;AAAA,QACH,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAc,OAAsB;AAClC,QAAI,KAAK,QAAS;AAClB,QAAI,CAAC,WAAW,EAAG;AAEnB,SAAK,UAAU;AACf,QAAI;AACF,UAAI,KAAK,OAAO,WAAW,EAAG,OAAM,KAAK,YAAY;AACrD,iBAAW,SAAS,KAAK,QAAQ;AAC/B,cAAM,UAAU,MAAM,KAAK,SAAS,KAAK;AACzC,YAAI,CAAC,QAAS;AAEd,cAAM,SAAS,MAAM,KAAK,QAAQ,OAAO;AACzC,cAAM,KAAK,SAAS,OAAO,SAAS,MAAM;AAAA,MAC5C;AAAA,IACF,QAAQ;AAAA,IAER,UAAE;AACA,WAAK,UAAU;AAAA,IACjB;AAAA,EACF;AAAA,EAEA,MAAc,cAA6B;AACzC,UAAM,MAAM,MAAM,MAAM,GAAG,OAAO,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;AACzE,QAAI,CAAC,IAAI,GAAI;AACb,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,SAAK,UAAU,KAAK,iBAAiB,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,EAC1D;AAAA,EAEA,MAAc,SAAS,OAA2C;AAChE,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,GAAG,OAAO,aAAa,KAAK,iBAAiB;AAAA,QACnE,QAAQ;AAAA,QACR,SAAS,YAAY;AAAA,QACrB,MAAM,KAAK,UAAU,EAAE,WAAW,SAAS,EAAE,CAAC;AAAA,MAChD,CAAC;AACD,UAAI,CAAC,IAAI,GAAI,QAAO;AACpB,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,KAAK,OAAO;AAAA,IACrB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,QAAQ,KAAqC;AACzD,UAAM,SAAS,IAAI,UAAU;AAC7B,QAAI,CAAC,QAAQ;AACX,aAAO;AAAA,QACL,MAAM,IAAI;AAAA,QACV,QAAQ;AAAA,QACR,UAAU,CAAC;AAAA,QACX,kBAAkB,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,EAAE;AAAA,QACrE,SAAS;AAAA,QACT,OAAO;AAAA,MACT;AAAA,IACF;AAEA,SAAK,IAAI,eAAe,eAAe,WAAW,GAAG,IAAI,IAAI,IAAI,IAAI,UAAU,QAAQ,MAAM,EAAE;AAE/F,QAAI;AACF,UAAI,IAAI,SAAS,OAAQ,QAAO,MAAM,QAAQ,MAAM;AACpD,aAAO,MAAM,WAAW,MAAM;AAAA,IAChC,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,MAAM,IAAI;AAAA,QACV;AAAA,QACA,UAAU,CAAC;AAAA,QACX,kBAAkB,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,EAAE;AAAA,QACrE,SAAS,WAAY,IAAc,OAAO;AAAA,QAC1C,OAAQ,IAAc;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,SAAS,OAAe,SAAqB,QAAkC;AAC3F,QAAI;AACF,YAAM;AAAA,QACJ,GAAG,OAAO,aAAa,KAAK,eAAe,QAAQ,WAAW,SAAS,QAAQ,EAAE;AAAA,QACjF;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,YAAY;AAAA,UACrB,MAAM,KAAK,UAAU;AAAA,YACnB,QAAQ,OAAO,QAAQ,WAAW;AAAA,YAClC,gBAAgB,OAAO,SAAS;AAAA,YAChC,kBAAkB,OAAO;AAAA,YACzB,SAAS,OAAO;AAAA,YAChB,UAAU,OAAO;AAAA,YACjB,OAAO,OAAO;AAAA,YACd,QAAQ;AAAA,YACR,WAAW,SAAS;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER,UAAE;AACA,WAAK,IAAI,eAAe,eAAe,MAAM;AAAA,IAC/C;AAAA,EACF;AACF;;;AC1IO,IAAM,aAAN,MAAiB;AAAA,EAItB,YAAoB,aAQR;AARQ;AAAA,EAQP;AAAA,EARO;AAAA,EAHZ,QAAyB,CAAC;AAAA,EAC1B,UAAU,oBAAI,IAAyB;AAAA,EAY/C,UAAU,OAA8B;AACtC,SAAK,QAAQ,MAAM,OAAO,OAAK,EAAE,YAAY,KAAK;AAAA,EACpD;AAAA,EAEA,WAA4B;AAC1B,WAAO,CAAC,GAAG,KAAK,KAAK;AAAA,EACvB;AAAA,EAEA,SAAS,OAA0B;AACjC,UAAM,MAAM,KAAK,IAAI;AAErB,eAAW,QAAQ,KAAK,OAAO;AAE7B,UAAI,KAAK,aAAa,SAAS,KAAK,CAAC,KAAK,aAAa,SAAS,MAAM,MAAM,KAAK,CAAC,KAAK,aAAa,SAAS,MAAM,QAAQ,GAAG;AAC5H;AAAA,MACF;AAGA,UAAI,CAAC,KAAK,iBAAiB,OAAO,KAAK,KAAK,EAAG;AAG/C,YAAM,YAAY,GAAG,KAAK,EAAE,IAAI,MAAM,aAAa,QAAQ;AAC3D,UAAI,SAAS,KAAK,QAAQ,IAAI,SAAS;AACvC,UAAI,CAAC,QAAQ;AACX,iBAAS,EAAE,QAAQ,CAAC,GAAG,WAAW,EAAE;AACpC,aAAK,QAAQ,IAAI,WAAW,MAAM;AAAA,MACpC;AAGA,aAAO,OAAO,KAAK,EAAE,WAAW,KAAK,MAAM,CAAC;AAG5C,YAAM,SAAS,MAAO,KAAK,iBAAiB;AAC5C,aAAO,SAAS,OAAO,OAAO,OAAO,OAAK,EAAE,aAAa,MAAM;AAG/D,UAAI,OAAO,OAAO,SAAS,KAAK,UAAW;AAG3C,UAAI,OAAO,YAAY,KAAM,MAAM,OAAO,YAAc,KAAK,mBAAmB,IAAO;AAGvF,aAAO,YAAY;AACnB,aAAO,SAAS,CAAC;AAEjB,WAAK,YAAY;AAAA,QACf,SAAS,KAAK;AAAA,QACd,UAAU,KAAK;AAAA,QACf,OAAO,KAAK;AAAA,QACZ,aAAa,GAAG,KAAK,WAAW,KAAK,KAAK,SAAS,cAAc,KAAK,cAAc;AAAA,QACpF,WAAW,MAAM;AAAA,QACjB,UAAU,MAAM,SAAS,QAAkB;AAAA,QAC3C,cAAc;AAAA,UACZ,cAAc,KAAK;AAAA,UACnB,MAAM,KAAK;AAAA,UACX,UAAU,KAAK;AAAA,UACf,aAAa,KAAK;AAAA,QACpB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEQ,iBAAiB,OAAoB,OAA2B;AACtE,UAAM,aAAa,KAAK,cAAc,OAAO,MAAM,KAAK;AACxD,QAAI,eAAe,OAAW,QAAO;AAErC,UAAM,WAAW,OAAO,UAAU;AAClC,QAAI,SAAS;AAEb,YAAQ,MAAM,UAAU;AAAA,MACtB,KAAK;AACH,iBAAS,SAAS,YAAY,EAAE,SAAS,OAAO,MAAM,KAAK,EAAE,YAAY,CAAC;AAC1E;AAAA,MACF,KAAK;AACH,YAAI;AAAE,mBAAS,IAAI,OAAO,OAAO,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,QAAQ;AAAA,QAAG,QAAQ;AAAE,mBAAS;AAAA,QAAO;AAC9F;AAAA,MACF,KAAK;AACH,iBAAS,aAAa,OAAO,MAAM,KAAK;AACxC;AAAA,MACF,KAAK;AACH,iBAAS,SAAS,WAAW,OAAO,MAAM,KAAK,CAAC;AAChD;AAAA,MACF,KAAK;AACH,iBAAS,SAAS,SAAS,OAAO,MAAM,KAAK,CAAC;AAC9C;AAAA,IACJ;AAGA,QAAI,UAAU,MAAM,KAAK;AACvB,eAAS,MAAM,IAAI,MAAM,OAAK,KAAK,iBAAiB,OAAO,CAAC,CAAC;AAAA,IAC/D;AAGA,QAAI,CAAC,UAAU,MAAM,IAAI;AACvB,eAAS,MAAM,GAAG,KAAK,OAAK,KAAK,iBAAiB,OAAO,CAAC,CAAC;AAAA,IAC7D;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,cAAc,OAAoB,OAAwB;AAChE,YAAQ,OAAO;AAAA,MACb,KAAK;AAAW,eAAO,MAAM;AAAA,MAC7B,KAAK;AAAY,eAAO,MAAM;AAAA,MAC9B,KAAK;AAAU,eAAO,MAAM;AAAA,MAC5B,KAAK;AAAY,eAAO,MAAM;AAAA,MAC9B,KAAK;AAAa,eAAO,MAAM;AAAA,MAC/B;AACE,eAAO,MAAM,UAAU,KAAK;AAAA,IAChC;AAAA,EACF;AAAA;AAAA,EAGA,UAAgB;AACd,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,KAAK,MAAM,KAAK,KAAK,QAAQ,QAAQ,GAAG;AAClD,UAAI,OAAO,OAAO,WAAW,KAAM,MAAM,OAAO,YAAa,MAAU;AACrE,aAAK,QAAQ,OAAO,GAAG;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AACF;;;AC3KA,IAAAC,mBAAsD;AACtD,IAAAC,qBAAqB;;;ACCd,IAAM,gBAAiC;AAAA,EAC5C;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,aAAa,MAAM;AAAA,IAClC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,eAAe,qBAAqB;AAAA,IAClD,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,aAAa,MAAM;AAAA,IAClC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,sBAAsB;AAAA,IACpC,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,aAAa,MAAM;AAAA,IAClC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,aAAa;AAAA,IAC3B,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,aAAa,MAAM;AAAA,IAClC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,eAAe,gBAAgB;AAAA,IAC7C,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,gBAAgB,QAAQ;AAAA,IACvC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,QAAQ,sBAAsB;AAAA,IACrC,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,eAAe,KAAK;AAAA,IACnC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,QAAQ,WAAW;AAAA,IACjC,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,eAAe,KAAK;AAAA,IACnC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,kBAAkB,KAAK;AAAA,IACrC,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,eAAe,KAAK;AAAA,IACnC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,OAAO,WAAW;AAAA,IAChC,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,eAAe,KAAK;AAAA,IACnC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,WAAW,gBAAgB;AAAA,IACzC,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,mBAAmB,SAAS;AAAA,IAC3C,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,WAAW,aAAa,gBAAgB;AAAA,IAC/C,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,gBAAgB,QAAQ;AAAA,IACvC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,UAAU,UAAU;AAAA,IAC3B,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,eAAe,KAAK;AAAA,IACnC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,WAAW,OAAO;AAAA,IAChC,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AACF;;;AD/QA,IAAM,YAAY;AAEX,SAAS,aAAa,WAAqC;AAChE,QAAM,QAAQ,CAAC,GAAG,aAAa;AAC/B,QAAM,MAAM,aAAa;AAEzB,UAAI,6BAAW,GAAG,GAAG;AACnB,UAAM,YAAQ,8BAAY,GAAG,EAAE,OAAO,OAAK,EAAE,SAAS,OAAO,CAAC;AAC9D,eAAW,QAAQ,OAAO;AACxB,UAAI;AACF,cAAM,UAAM,mCAAa,yBAAK,KAAK,IAAI,GAAG,OAAO;AACjD,cAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,cAAM,cAA+B,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;AAC7E,mBAAW,QAAQ,aAAa;AAC9B,cAAI,CAAC,KAAK,MAAM,CAAC,KAAK,SAAS,CAAC,KAAK,OAAO;AAC1C,oBAAQ,KAAK,oCAAoC,IAAI,2BAA2B;AAChF;AAAA,UACF;AACA,gBAAM,cAAc,MAAM,UAAU,OAAK,EAAE,OAAO,KAAK,EAAE;AACzD,cAAI,eAAe,GAAG;AACpB,kBAAM,WAAW,IAAI,EAAE,GAAG,MAAM,WAAW,GAAG,GAAG,KAAK;AAAA,UACxD,OAAO;AACL,kBAAM,KAAK,IAAI;AAAA,UACjB;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ,KAAK,0BAA0B,IAAI,KAAM,IAAc,OAAO,EAAE;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;;;AErCA,IAAAC,6BAAoC;AACpC,IAAAC,mBAAqB;AAWrB,SAAS,sBAAsB,IAAkB;AAC/C,UAAI,uBAAK,EAAE,MAAM,GAAG;AAClB,UAAM,IAAI,MAAM,yBAAyB,EAAE,EAAE;AAAA,EAC/C;AACF;AAEO,IAAM,kBAAN,MAAiD;AAAA,EACtD,OAAO;AAAA,EACC,QAAQ;AAAA,EACR,MAAM;AAAA,EAEd,cAAuB;AACrB,UAAM,aAAS,sCAAU,OAAO,CAAC,WAAW,GAAG,EAAE,OAAO,OAAO,CAAC;AAChE,WAAO,OAAO,WAAW;AAAA,EAC3B;AAAA,EAEQ,cAAoB;AAC1B,QAAI;AACF,+CAAS,uBAAuB,KAAK,KAAK,gBAAgB,EAAE,OAAO,OAAO,CAAC;AAAA,IAC7E,QAAQ;AACN,+CAAS,sBAAsB,KAAK,KAAK,EAAE;AAC3C,+CAAS,oBAAoB,KAAK,KAAK,IAAI,KAAK,GAAG,uCAAuC;AAC1F,+CAAS,sBAAsB,KAAK,KAAK,iEAAiE;AAC1G,+CAAS,qBAAqB,KAAK,KAAK,oBAAoB,KAAK,GAAG,OAAO;AAAA,IAC7E;AAAA,EACF;AAAA,EAEA,MAAM,MAAM,IAA2B;AACrC,0BAAsB,EAAE;AACxB,SAAK,YAAY;AACjB,6CAAS,wBAAwB,KAAK,KAAK,IAAI,KAAK,GAAG,OAAO,EAAE,KAAK;AAAA,EACvE;AAAA,EAEA,MAAM,QAAQ,IAA2B;AACvC,0BAAsB,EAAE;AACxB,QAAI;AACF,+CAAS,2BAA2B,KAAK,KAAK,IAAI,KAAK,GAAG,OAAO,EAAE,KAAK;AAAA,IAC1E,QAAQ;AAAA,IAA8B;AAAA,EACxC;AAAA,EAEA,MAAM,UAAU,IAA8B;AAC5C,0BAAsB,EAAE;AACxB,QAAI;AACF,YAAM,aAAS,qCAAS,qBAAqB,KAAK,KAAK,IAAI,KAAK,GAAG,IAAI,EAAE,UAAU,QAAQ,CAAC;AAC5F,aAAO,OAAO,SAAS,EAAE;AAAA,IAC3B,QAAQ;AAAE,aAAO;AAAA,IAAO;AAAA,EAC1B;AAAA,EAEA,MAAM,cAAiC;AACrC,QAAI;AACF,YAAM,aAAS,qCAAS,qBAAqB,KAAK,KAAK,IAAI,KAAK,GAAG,IAAI,EAAE,UAAU,QAAQ,CAAC;AAC5F,YAAM,QAAQ,OAAO,MAAM,4BAA4B;AACvD,UAAI,CAAC,MAAO,QAAO,CAAC;AACpB,aAAO,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,OAAO;AAAA,IAC7E,QAAQ;AAAE,aAAO,CAAC;AAAA,IAAG;AAAA,EACvB;AACF;AAEO,IAAM,kBAAN,MAAiD;AAAA,EACtD,OAAO;AAAA,EACC,QAAQ;AAAA,EAEhB,cAAuB;AACrB,UAAM,aAAS,sCAAU,YAAY,CAAC,WAAW,GAAG,EAAE,OAAO,OAAO,CAAC;AACrE,WAAO,OAAO,WAAW;AAAA,EAC3B;AAAA,EAEQ,cAAoB;AAC1B,QAAI;AACF,+CAAS,kBAAkB,KAAK,KAAK,gBAAgB,EAAE,OAAO,OAAO,CAAC;AAAA,IACxE,QAAQ;AACN,+CAAS,eAAe,KAAK,KAAK,EAAE;AACpC,+CAAS,0BAA0B,KAAK,KAAK,EAAE;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,MAAM,MAAM,IAA2B;AACrC,0BAAsB,EAAE;AACxB,SAAK,YAAY;AACjB,QAAI,MAAM,KAAK,UAAU,EAAE,EAAG;AAC9B,6CAAS,eAAe,KAAK,KAAK,OAAO,EAAE,UAAU;AAAA,EACvD;AAAA,EAEA,MAAM,QAAQ,IAA2B;AACvC,0BAAsB,EAAE;AACxB,QAAI;AAAE,+CAAS,eAAe,KAAK,KAAK,OAAO,EAAE,UAAU;AAAA,IAAG,QACxD;AAAA,IAA2B;AAAA,EACnC;AAAA,EAEA,MAAM,UAAU,IAA8B;AAC5C,0BAAsB,EAAE;AACxB,QAAI;AACF,YAAM,aAAS,qCAAS,kBAAkB,KAAK,KAAK,IAAI,EAAE,UAAU,QAAQ,CAAC;AAC7E,aAAO,OAAO,SAAS,EAAE;AAAA,IAC3B,QAAQ;AAAE,aAAO;AAAA,IAAO;AAAA,EAC1B;AAAA,EAEA,MAAM,cAAiC;AACrC,QAAI;AACF,YAAM,aAAS,qCAAS,kBAAkB,KAAK,KAAK,IAAI,EAAE,UAAU,QAAQ,CAAC;AAC7E,YAAM,MAAgB,CAAC;AACvB,iBAAW,QAAQ,OAAO,MAAM,IAAI,GAAG;AACrC,cAAM,QAAQ,KAAK,MAAM,wCAAwC;AACjE,YAAI,MAAO,KAAI,KAAK,MAAM,CAAC,CAAC;AAAA,MAC9B;AACA,aAAO;AAAA,IACT,QAAQ;AAAE,aAAO,CAAC;AAAA,IAAG;AAAA,EACvB;AACF;AAEO,IAAM,gBAAN,MAA+C;AAAA,EACpD,OAAO;AAAA,EACC,UAAU,oBAAI,IAAY;AAAA,EAElC,cAAuB;AAAE,WAAO;AAAA,EAAM;AAAA,EACtC,MAAM,MAAM,IAA2B;AAAE,0BAAsB,EAAE;AAAG,SAAK,QAAQ,IAAI,EAAE;AAAA,EAAG;AAAA,EAC1F,MAAM,QAAQ,IAA2B;AAAE,0BAAsB,EAAE;AAAG,SAAK,QAAQ,OAAO,EAAE;AAAA,EAAG;AAAA,EAC/F,MAAM,UAAU,IAA8B;AAAE,0BAAsB,EAAE;AAAG,WAAO,KAAK,QAAQ,IAAI,EAAE;AAAA,EAAG;AAAA,EACxG,MAAM,cAAiC;AAAE,WAAO,CAAC,GAAG,KAAK,OAAO;AAAA,EAAG;AACrE;AAEO,SAAS,wBAAyC;AACvD,QAAM,MAAM,IAAI,gBAAgB;AAChC,MAAI,IAAI,YAAY,EAAG,QAAO;AAC9B,QAAM,MAAM,IAAI,gBAAgB;AAChC,MAAI,IAAI,YAAY,EAAG,QAAO;AAC9B,SAAO,IAAI,cAAc;AAC3B;;;AC3IA,IAAAC,mBAA+B;AAwB/B,IAAMC,kBAAoC;AAAA,EACxC,SAAS;AAAA,EACT,SAAS;AAAA,EACT,qBAAqB;AAAA,EACrB,cAAc;AAAA,EACd,WAAW,CAAC,aAAa,KAAK;AAChC;AAEA,IAAMC,iBAAwC;AAAA,EAC5C,MAAM;AAAA,EAAG,KAAK;AAAA,EAAG,QAAQ;AAAA,EAAG,MAAM;AAAA,EAAG,UAAU;AACjD;AAEO,IAAM,qBAAN,MAAyB;AAAA,EAK9B,YACU,SACAC,MACR,QACA;AAHQ;AACA,eAAAA;AAGR,SAAK,SAAS,EAAE,GAAGF,iBAAgB,GAAG,OAAO;AAC7C,SAAK,UAAU;AACf,SAAK,kBAAkB;AAAA,EACzB;AAAA,EAPU;AAAA,EACA;AAAA,EANF;AAAA,EACA,YAA0B,CAAC;AAAA,EAC3B,cAAqC;AAAA,EAY7C,MAAM,gBAAgB,OAAmC;AACvD,QAAI,CAAC,KAAK,OAAO,QAAS;AAE1B,UAAM,YAAYC,eAAc,MAAM,QAAQ,KAAK;AACnD,UAAM,UAAUA,eAAc,KAAK,OAAO,YAAY,KAAK;AAC3D,QAAI,YAAY,QAAS;AAEzB,UAAM,KAAK,MAAM;AACjB,QAAI,CAAC,GAAI;AACT,QAAI,KAAK,cAAc,EAAE,EAAG;AAC5B,QAAI,KAAK,UAAU,KAAK,OAAK,EAAE,OAAO,EAAE,EAAG;AAE3C,UAAM,kBAAkB,MAAM,SAAS;AACvC,UAAM,MAAO,iBAAiB,eAA0B,KAAK,OAAO;AACpE,UAAM,SAAS,MAAM,SAAS;AAE9B,UAAM,KAAK,QAAQ,IAAI,MAAM,SAAS,QAAQ,GAAG;AAAA,EACnD;AAAA,EAEA,MAAM,QAAQ,IAAY,QAAgB,QAAiB,YAAuC;AAChG,QAAI,KAAK,cAAc,EAAE,EAAG,QAAO;AAEnC,UAAM,QAAoB;AAAA,MACxB;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,YAAY,KAAK,IAAI;AAAA,MACrB,YAAY,aAAa,KAAK,IAAI,IAAK,aAAa,MAAQ;AAAA,MAC5D,SAAS,KAAK,OAAO;AAAA,IACvB;AAEA,QAAI,CAAC,KAAK,OAAO,SAAS;AACxB,UAAI;AACF,cAAM,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC7B,SAAS,KAAK;AACZ,aAAK,QAAQ,uCAAuC,EAAE,KAAM,IAAc,OAAO,EAAE;AACnF,aAAK,IAAI,QAAQ;AAAA,UACf,WAAW,oBAAI,KAAK;AAAA,UACpB,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,UAAU;AAAA,UACV,SAAS,mBAAmB,EAAE,KAAM,IAAc,OAAO;AAAA,QAC3D,CAAC;AACD,eAAO;AAAA,MACT;AAAA,IACF;AAEA,SAAK,UAAU,KAAK,KAAK;AACzB,SAAK,UAAU;AAEf,UAAM,OAAO,KAAK,OAAO,UAAU,eAAe;AAClD,UAAM,YAAY,aAAa,gBAAgB,UAAU,OAAO;AAChE,SAAK,QAAQ,cAAc,IAAI,WAAW,EAAE,KAAK,MAAM,GAAG,SAAS,EAAE;AAErE,SAAK,IAAI,QAAQ;AAAA,MACf,WAAW,oBAAI,KAAK;AAAA,MACpB,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,SAAS,GAAG,IAAI,WAAW,EAAE,KAAK,MAAM,GAAG,SAAS;AAAA,MACpD,WAAW;AAAA,MACX,SAAS,EAAE,QAAQ,SAAS,SAAS,QAAQ,SAAS,KAAK,OAAO,SAAS,aAAa,WAAW;AAAA,IACrG,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,UAAU,IAA8B;AAC5C,UAAM,MAAM,KAAK,UAAU,UAAU,OAAK,EAAE,OAAO,EAAE;AACrD,QAAI,MAAM,EAAG,QAAO;AAEpB,UAAM,QAAQ,KAAK,UAAU,GAAG;AAChC,QAAI,CAAC,MAAM,SAAS;AAClB,UAAI;AACF,cAAM,KAAK,QAAQ,QAAQ,EAAE;AAAA,MAC/B,SAAS,KAAK;AACZ,aAAK,QAAQ,+BAA+B,EAAE,KAAM,IAAc,OAAO,EAAE;AAC3E,eAAO;AAAA,MACT;AAAA,IACF;AAEA,SAAK,UAAU,OAAO,KAAK,CAAC;AAC5B,SAAK,UAAU;AAEf,SAAK,QAAQ,wBAAwB,EAAE,EAAE;AACzC,SAAK,IAAI,QAAQ;AAAA,MACf,WAAW,oBAAI,KAAK;AAAA,MACpB,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,SAAS,aAAa,EAAE;AAAA,MACxB,WAAW;AAAA,MACX,SAAS,EAAE,QAAQ,UAAU;AAAA,IAC/B,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EAEA,cAAc,IAAqB;AACjC,WAAO,KAAK,OAAO,UAAU,SAAS,EAAE;AAAA,EAC1C;AAAA,EAEA,eAAe,IAAkB;AAC/B,QAAI,CAAC,KAAK,OAAO,UAAU,SAAS,EAAE,GAAG;AACvC,WAAK,OAAO,UAAU,KAAK,EAAE;AAAA,IAC/B;AAAA,EACF;AAAA,EAEA,oBAAoB,IAAkB;AACpC,SAAK,OAAO,YAAY,KAAK,OAAO,UAAU,OAAO,OAAK,MAAM,EAAE;AAAA,EACpE;AAAA,EAEA,eAA6B;AAAE,WAAO,CAAC,GAAG,KAAK,SAAS;AAAA,EAAG;AAAA,EAC3D,eAAyB;AAAE,WAAO,CAAC,GAAG,KAAK,OAAO,SAAS;AAAA,EAAG;AAAA,EAE9D,OAAa;AACX,QAAI,KAAK,YAAa,eAAc,KAAK,WAAW;AACpD,SAAK,cAAc;AAAA,EACrB;AAAA,EAEQ,oBAA0B;AAChC,SAAK,cAAc,YAAY,MAAM,KAAK,KAAK,gBAAgB,GAAG,GAAM;AAAA,EAC1E;AAAA,EAEA,MAAc,kBAAiC;AAC7C,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,UAAU,KAAK,UAAU,OAAO,OAAK,EAAE,cAAc,EAAE,cAAc,GAAG;AAC9E,eAAW,SAAS,SAAS;AAC3B,YAAM,KAAK,UAAU,MAAM,EAAE;AAAA,IAC/B;AAAA,EACF;AAAA,EAEQ,YAAkB;AACxB,QAAI;AACF,YAAM,QAAQ,eAAe,kBAAkB,WAAW;AAC1D,UAAI,MAAM,QAAQ,KAAK,EAAG,MAAK,YAAY;AAAA,IAC7C,QAAQ;AAAA,IAAsC;AAAA,EAChD;AAAA,EAEQ,YAAkB;AACxB,QAAI;AAAE,qBAAe,kBAAkB,aAAa,KAAK,SAAS;AAAA,IAAG,QAC/D;AAAA,IAAsC;AAAA,EAC9C;AAAA,EAEQ,QAAQ,MAAoB;AAClC,QAAI;AAAE,2CAAe,MAAM,SAAS,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,IAAI;AAAA,CAAI;AAAA,IAAG,QACxE;AAAA,IAAoB;AAAA,EAC5B;AACF;;;AChMA,IAAI,QAAQ;AAIZ,IAAI,SAAc;AAElB,eAAe,aAA4B;AACzC,MAAI,OAAQ;AACZ,MAAI;AACF,aAAS,MAAM,OAAO,cAAc;AAAA,EACtC,QAAQ;AACN,aAAS;AAAA,EACX;AACF;AAEA,eAAsB,cAAc,SAA0C;AAC5E,MAAI,MAAO;AACX,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK;AAEV,QAAM,WAAW;AACjB,MAAI,CAAC,OAAQ;AAEb,SAAO,KAAK;AAAA,IACV;AAAA,IACA,aAAa,QAAQ,IAAI,YAAY;AAAA,IACrC,SAAS,QAAQ,IAAI;AAAA,IACrB,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,WAAW,OAAgC;AACzC,YAAM,MAAO,MAA6D;AAC1E,UAAI,KAAK,SAAS;AAChB,eAAO,IAAI,QAAQ;AACnB,eAAO,IAAI,QAAQ;AAAA,MACrB;AACA,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AAED,UAAQ;AACV;AAEO,SAAS,iBAAiB,KAAoB;AACnD,MAAI,CAAC,SAAS,CAAC,OAAQ;AACvB,SAAO,iBAAiB,GAAG;AAC7B;AAEA,eAAsB,eAAe,YAAY,KAAqB;AACpE,MAAI,CAAC,SAAS,CAAC,OAAQ;AACvB,MAAI;AAAE,UAAM,OAAO,MAAM,SAAS;AAAA,EAAG,QAAQ;AAAA,EAAe;AAC9D;;;A7CvCA,SAASE,eAAsB;AAC7B,MAAI;AACF,UAAM,MAAM,KAAK,UAAM,mCAAa,yBAAK,WAAW,MAAM,cAAc,GAAG,OAAO,CAAC;AACnF,WAAO,IAAI,WAAW;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,QAAQ,MAAoB;AACnC,MAAI;AACF,yCAAe,MAAM,SAAS,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,IAAI;AAAA,CAAI;AAAA,EACvE,QAAQ;AAAA,EAER;AACF;AAEA,eAAsB,YAA2B;AAC/C,MAAI,kBAAkB,GAAG;AACvB,YAAQ,MAAM,6CAA6C,MAAM,OAAO,IAAI;AAC5E,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,oBAAkB;AAClB,eAAa;AAEb,QAAM,cAAc,QAAQ;AAC5B,UAAQ,GAAG,qBAAqB,CAAC,QAAQ;AACvC,YAAQ,+BAA+B,IAAI,OAAO,EAAE;AACpD,qBAAiB,GAAG;AAAA,EACtB,CAAC;AACD,UAAQ,GAAG,sBAAsB,CAAC,WAAW;AAC3C,YAAQ,gCAAgC,OAAO,MAAM,CAAC,EAAE;AACxD,qBAAiB,MAAM;AAAA,EACzB,CAAC;AAED,QAAM,UAAUA,aAAY;AAC5B,UAAQ,mCAAmC,OAAO,SAAS,MAAM,IAAI,EAAE;AAEvE,MAAI;AACF,gBAAY,MAAM,OAAO;AAAA,EAC3B,SAAS,KAAK;AACZ,YAAQ,kCAAmC,IAAc,OAAO,EAAE;AAAA,EACpE;AAEA,QAAM,SAAS,eAAW,6BAAW,MAAM,UAAU,IAAI,MAAM,aAAa,MAAS;AAErF,MAAI,GAAG,SAAS,CAAC,UAAuB;AACtC,YAAQ,WAAW,MAAM,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO,EAAE;AAAA,EACtE,CAAC;AAED,QAAM,aAAa,IAAI,WAAW,GAAG;AACrC,QAAM,WAAW,MAAM;AAGvB,QAAM,aAAa,IAAI,WAAW,CAAC,cAAc;AAC/C,UAAM,QAAqB;AAAA,MACzB,WAAW,oBAAI,KAAK;AAAA,MACpB,QAAQ;AAAA,MACR,UAAW,UAAU,cAAc,YAAoB;AAAA,MACvD,UAAU,UAAU;AAAA,MACpB,SAAS,eAAe,UAAU,KAAK;AAAA,MACvC,WAAW,UAAU;AAAA,MACrB,SAAS;AAAA,QACP,SAAS,UAAU;AAAA,QACnB,UAAU,UAAU;AAAA,QACpB,GAAG,UAAU;AAAA,MACf;AAAA,IACF;AACA,QAAI,QAAQ,KAAK;AAAA,EACnB,CAAC;AACD,aAAW,UAAU,aAAa,CAAC;AACnC,MAAI,GAAG,SAAS,CAAC,UAAU;AACzB,QAAI,MAAM,WAAW,cAAe,YAAW,SAAS,KAAK;AAAA,EAC/D,CAAC;AACD,UAAQ,+BAA+B,WAAW,SAAS,EAAE,MAAM,QAAQ;AAC3E,cAAY,MAAM,WAAW,QAAQ,GAAG,GAAO;AAG/C,QAAM,kBAAkB,sBAAsB;AAC9C,QAAM,cAAc,IAAI,mBAAmB,iBAAiB,KAAM,OAAe,WAAW;AAC5F,MAAI,GAAG,SAAS,CAAC,UAAU;AACzB,QAAI,MAAM,WAAW,kBAAkB;AACrC,WAAK,YAAY,gBAAgB,KAAK;AAAA,IACxC;AAAA,EACF,CAAC;AACD,UAAQ,iDAAiD,gBAAgB,IAAI,aAAc,OAAe,aAAa,WAAW,IAAI,GAAG;AAEzI,MAAI,gBAAgB,KAAK,MAAM;AAE/B,QAAM,aAAa,IAAI,WAAW,GAAG;AACrC,MAAI;AACF,UAAM,WAAW,MAAM;AAAA,EACzB,SAAS,KAAK;AACZ,YAAQ,yCAA0C,IAAc,OAAO,EAAE;AAAA,EAC3E;AAEA,QAAM,MAAM,IAAI,UAAU,SAAS,UAAU;AAC7C,QAAM,IAAI,MAAM;AAChB,UAAQ,6BAA6B,MAAM,MAAM,EAAE;AAEnD,QAAM,WAAW,OAAO,WAAmB;AACzC,YAAQ,qBAAqB,MAAM,iBAAiB;AACpD,QAAI;AAAE,kBAAY,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAC;AACnC,QAAI;AAAE,iBAAW,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAC;AAClC,QAAI;AAAE,YAAM,WAAW,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAC;AACxC,QAAI;AAAE,YAAM,IAAI,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAC;AACjC,QAAI;AAAE,cAAQ;AAAA,IAAG,QAAQ;AAAA,IAAC;AAC1B,QAAI;AAAE,YAAM,eAAe;AAAA,IAAG,QAAQ;AAAA,IAAC;AACvC,kBAAc;AACd,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,UAAQ,GAAG,UAAU,MAAM;AAAE,SAAK,SAAS,QAAQ;AAAA,EAAG,CAAC;AACvD,UAAQ,GAAG,WAAW,MAAM;AAAE,SAAK,SAAS,SAAS;AAAA,EAAG,CAAC;AACzD,UAAQ,GAAG,UAAU,MAAM;AAAE,SAAK,SAAS,QAAQ;AAAA,EAAG,CAAC;AAGvD,cAAY,MAAM;AAAA,EAAC,GAAG,KAAK,EAAE;AAC/B;;;A8CtIA,UAAU,EAAE,MAAM,CAAC,QAAQ;AACzB,UAAQ,MAAM,iCAAiC,GAAG;AAClD,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":["exports","module","exports","module","exports","module","exports","module","exports","module","Date","exports","module","exports","module","exports","module","exports","module","resolve","index","blocksize","exports","module","resolve","exports","module","exports","module","tomlType","str","exports","import_node_fs","import_node_path","import_node_fs","import_node_fs","import_node_fs","import_node_path","Database","module","resolve","isRoot","import_node_fs","import_node_path","import_toml","import_node_crypto","import_node_fs","import_node_path","verifySignature","import_node_fs","bus","bus","isRoot","import_node_child_process","import_node_fs","bus","import_node_fs","import_node_readline","bus","import_node_fs","import_node_path","TOML","bus","TOML","SEVERITY_RANK","SEVERITY_RANK","bus","import_node_fs","import_node_path","import_node_os","import_node_fs","import_node_path","import_node_os","process","os","tty","styles","chalk","styles","SEVERITY_COLORS","import_node_os","os","import_node_fs","import_node_path","end","import_node_fs","import_node_path","import_node_crypto","import_node_path","bus","import_node_fs","import_node_path","import_node_child_process","import_node_net","import_node_fs","DEFAULT_CONFIG","SEVERITY_RANK","bus","readVersion"]}
1
+ {"version":3,"sources":["../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/lib/parser.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/lib/create-datetime.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/lib/format-num.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/lib/create-datetime-float.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/lib/create-date.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/lib/create-time.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/lib/toml-parser.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/parse-pretty-error.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/parse-string.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/parse-async.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/parse-stream.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/parse.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/stringify.js","../../../node_modules/.pnpm/@iarna+toml@2.2.5/node_modules/@iarna/toml/toml.js","../src/daemon/index.ts","../src/daemon/paths.ts","../src/daemon/pidfile.ts","../src/daemon/ipc-server.ts","../src/daemon/control-token.ts","../src/daemon/event-bus.ts","../src/core/state.ts","../src/daemon/module-host.ts","../src/daemon/module-trust.ts","../src/daemon/watchers/log-watcher.ts","../src/core/log-parser.ts","../src/daemon/watchers/journal-watcher.ts","../src/modules/network-monitor/index.ts","../src/modules/dns-monitor/index.ts","../src/core/config.ts","../src/daemon/alerts/smtp.ts","../src/daemon/alerts/discord.ts","../src/daemon/alerts/pagerduty.ts","../src/daemon/alerts/index.ts","../src/core/cli-config.ts","../src/commands/scan.ts","../../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js","../../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/vendor/supports-color/index.js","../../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/utilities.js","../../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/index.js","../src/core/logger.ts","../src/core/run-result.ts","../../../packages/scan/src/node-rules.ts","../../../packages/scan/src/types.ts","../../../packages/scan/src/code-rules.ts","../../../packages/scan/src/template-rules.ts","../../../packages/scan/src/controls.ts","../../../packages/scan/src/manifest-rules.ts","../../../packages/scan/src/secret-rules.ts","../../../packages/scan/src/text.ts","../../../packages/scan/src/node/walk.ts","../../../packages/scan/src/node/dependencies.ts","../../../packages/scan/src/node/sarif.ts","../src/commands/pentest.ts","../src/daemon/workers/runs-worker.ts","../src/daemon/rules/engine.ts","../src/daemon/rules/loader.ts","../src/daemon/rules/default-rules.ts","../src/daemon/firewall/adapters.ts","../src/daemon/firewall/remediation.ts","../src/core/telemetry.ts","../src/daemon-entry.ts"],"sourcesContent":["'use strict'\nconst ParserEND = 0x110000\nclass ParserError extends Error {\n /* istanbul ignore next */\n constructor (msg, filename, linenumber) {\n super('[ParserError] ' + msg, filename, linenumber)\n this.name = 'ParserError'\n this.code = 'ParserError'\n if (Error.captureStackTrace) Error.captureStackTrace(this, ParserError)\n }\n}\nclass State {\n constructor (parser) {\n this.parser = parser\n this.buf = ''\n this.returned = null\n this.result = null\n this.resultTable = null\n this.resultArr = null\n }\n}\nclass Parser {\n constructor () {\n this.pos = 0\n this.col = 0\n this.line = 0\n this.obj = {}\n this.ctx = this.obj\n this.stack = []\n this._buf = ''\n this.char = null\n this.ii = 0\n this.state = new State(this.parseStart)\n }\n\n parse (str) {\n /* istanbul ignore next */\n if (str.length === 0 || str.length == null) return\n\n this._buf = String(str)\n this.ii = -1\n this.char = -1\n let getNext\n while (getNext === false || this.nextChar()) {\n getNext = this.runOne()\n }\n this._buf = null\n }\n nextChar () {\n if (this.char === 0x0A) {\n ++this.line\n this.col = -1\n }\n ++this.ii\n this.char = this._buf.codePointAt(this.ii)\n ++this.pos\n ++this.col\n return this.haveBuffer()\n }\n haveBuffer () {\n return this.ii < this._buf.length\n }\n runOne () {\n return this.state.parser.call(this, this.state.returned)\n }\n finish () {\n this.char = ParserEND\n let last\n do {\n last = this.state.parser\n this.runOne()\n } while (this.state.parser !== last)\n\n this.ctx = null\n this.state = null\n this._buf = null\n\n return this.obj\n }\n next (fn) {\n /* istanbul ignore next */\n if (typeof fn !== 'function') throw new ParserError('Tried to set state to non-existent state: ' + JSON.stringify(fn))\n this.state.parser = fn\n }\n goto (fn) {\n this.next(fn)\n return this.runOne()\n }\n call (fn, returnWith) {\n if (returnWith) this.next(returnWith)\n this.stack.push(this.state)\n this.state = new State(fn)\n }\n callNow (fn, returnWith) {\n this.call(fn, returnWith)\n return this.runOne()\n }\n return (value) {\n /* istanbul ignore next */\n if (this.stack.length === 0) throw this.error(new ParserError('Stack underflow'))\n if (value === undefined) value = this.state.buf\n this.state = this.stack.pop()\n this.state.returned = value\n }\n returnNow (value) {\n this.return(value)\n return this.runOne()\n }\n consume () {\n /* istanbul ignore next */\n if (this.char === ParserEND) throw this.error(new ParserError('Unexpected end-of-buffer'))\n this.state.buf += this._buf[this.ii]\n }\n error (err) {\n err.line = this.line\n err.col = this.col\n err.pos = this.pos\n return err\n }\n /* istanbul ignore next */\n parseStart () {\n throw new ParserError('Must declare a parseStart method')\n }\n}\nParser.END = ParserEND\nParser.Error = ParserError\nmodule.exports = Parser\n","'use strict'\nmodule.exports = value => {\n const date = new Date(value)\n /* istanbul ignore if */\n if (isNaN(date)) {\n throw new TypeError('Invalid Datetime')\n } else {\n return date\n }\n}\n","'use strict'\nmodule.exports = (d, num) => {\n num = String(num)\n while (num.length < d) num = '0' + num\n return num\n}\n","'use strict'\nconst f = require('./format-num.js')\n\nclass FloatingDateTime extends Date {\n constructor (value) {\n super(value + 'Z')\n this.isFloating = true\n }\n toISOString () {\n const date = `${this.getUTCFullYear()}-${f(2, this.getUTCMonth() + 1)}-${f(2, this.getUTCDate())}`\n const time = `${f(2, this.getUTCHours())}:${f(2, this.getUTCMinutes())}:${f(2, this.getUTCSeconds())}.${f(3, this.getUTCMilliseconds())}`\n return `${date}T${time}`\n }\n}\n\nmodule.exports = value => {\n const date = new FloatingDateTime(value)\n /* istanbul ignore if */\n if (isNaN(date)) {\n throw new TypeError('Invalid Datetime')\n } else {\n return date\n }\n}\n","'use strict'\nconst f = require('./format-num.js')\nconst DateTime = global.Date\n\nclass Date extends DateTime {\n constructor (value) {\n super(value)\n this.isDate = true\n }\n toISOString () {\n return `${this.getUTCFullYear()}-${f(2, this.getUTCMonth() + 1)}-${f(2, this.getUTCDate())}`\n }\n}\n\nmodule.exports = value => {\n const date = new Date(value)\n /* istanbul ignore if */\n if (isNaN(date)) {\n throw new TypeError('Invalid Datetime')\n } else {\n return date\n }\n}\n","'use strict'\nconst f = require('./format-num.js')\n\nclass Time extends Date {\n constructor (value) {\n super(`0000-01-01T${value}Z`)\n this.isTime = true\n }\n toISOString () {\n return `${f(2, this.getUTCHours())}:${f(2, this.getUTCMinutes())}:${f(2, this.getUTCSeconds())}.${f(3, this.getUTCMilliseconds())}`\n }\n}\n\nmodule.exports = value => {\n const date = new Time(value)\n /* istanbul ignore if */\n if (isNaN(date)) {\n throw new TypeError('Invalid Datetime')\n } else {\n return date\n }\n}\n","'use strict'\n/* eslint-disable no-new-wrappers, no-eval, camelcase, operator-linebreak */\nmodule.exports = makeParserClass(require('./parser.js'))\nmodule.exports.makeParserClass = makeParserClass\n\nclass TomlError extends Error {\n constructor (msg) {\n super(msg)\n this.name = 'TomlError'\n /* istanbul ignore next */\n if (Error.captureStackTrace) Error.captureStackTrace(this, TomlError)\n this.fromTOML = true\n this.wrapped = null\n }\n}\nTomlError.wrap = err => {\n const terr = new TomlError(err.message)\n terr.code = err.code\n terr.wrapped = err\n return terr\n}\nmodule.exports.TomlError = TomlError\n\nconst createDateTime = require('./create-datetime.js')\nconst createDateTimeFloat = require('./create-datetime-float.js')\nconst createDate = require('./create-date.js')\nconst createTime = require('./create-time.js')\n\nconst CTRL_I = 0x09\nconst CTRL_J = 0x0A\nconst CTRL_M = 0x0D\nconst CTRL_CHAR_BOUNDARY = 0x1F // the last non-character in the latin1 region of unicode, except DEL\nconst CHAR_SP = 0x20\nconst CHAR_QUOT = 0x22\nconst CHAR_NUM = 0x23\nconst CHAR_APOS = 0x27\nconst CHAR_PLUS = 0x2B\nconst CHAR_COMMA = 0x2C\nconst CHAR_HYPHEN = 0x2D\nconst CHAR_PERIOD = 0x2E\nconst CHAR_0 = 0x30\nconst CHAR_1 = 0x31\nconst CHAR_7 = 0x37\nconst CHAR_9 = 0x39\nconst CHAR_COLON = 0x3A\nconst CHAR_EQUALS = 0x3D\nconst CHAR_A = 0x41\nconst CHAR_E = 0x45\nconst CHAR_F = 0x46\nconst CHAR_T = 0x54\nconst CHAR_U = 0x55\nconst CHAR_Z = 0x5A\nconst CHAR_LOWBAR = 0x5F\nconst CHAR_a = 0x61\nconst CHAR_b = 0x62\nconst CHAR_e = 0x65\nconst CHAR_f = 0x66\nconst CHAR_i = 0x69\nconst CHAR_l = 0x6C\nconst CHAR_n = 0x6E\nconst CHAR_o = 0x6F\nconst CHAR_r = 0x72\nconst CHAR_s = 0x73\nconst CHAR_t = 0x74\nconst CHAR_u = 0x75\nconst CHAR_x = 0x78\nconst CHAR_z = 0x7A\nconst CHAR_LCUB = 0x7B\nconst CHAR_RCUB = 0x7D\nconst CHAR_LSQB = 0x5B\nconst CHAR_BSOL = 0x5C\nconst CHAR_RSQB = 0x5D\nconst CHAR_DEL = 0x7F\nconst SURROGATE_FIRST = 0xD800\nconst SURROGATE_LAST = 0xDFFF\n\nconst escapes = {\n [CHAR_b]: '\\u0008',\n [CHAR_t]: '\\u0009',\n [CHAR_n]: '\\u000A',\n [CHAR_f]: '\\u000C',\n [CHAR_r]: '\\u000D',\n [CHAR_QUOT]: '\\u0022',\n [CHAR_BSOL]: '\\u005C'\n}\n\nfunction isDigit (cp) {\n return cp >= CHAR_0 && cp <= CHAR_9\n}\nfunction isHexit (cp) {\n return (cp >= CHAR_A && cp <= CHAR_F) || (cp >= CHAR_a && cp <= CHAR_f) || (cp >= CHAR_0 && cp <= CHAR_9)\n}\nfunction isBit (cp) {\n return cp === CHAR_1 || cp === CHAR_0\n}\nfunction isOctit (cp) {\n return (cp >= CHAR_0 && cp <= CHAR_7)\n}\nfunction isAlphaNumQuoteHyphen (cp) {\n return (cp >= CHAR_A && cp <= CHAR_Z)\n || (cp >= CHAR_a && cp <= CHAR_z)\n || (cp >= CHAR_0 && cp <= CHAR_9)\n || cp === CHAR_APOS\n || cp === CHAR_QUOT\n || cp === CHAR_LOWBAR\n || cp === CHAR_HYPHEN\n}\nfunction isAlphaNumHyphen (cp) {\n return (cp >= CHAR_A && cp <= CHAR_Z)\n || (cp >= CHAR_a && cp <= CHAR_z)\n || (cp >= CHAR_0 && cp <= CHAR_9)\n || cp === CHAR_LOWBAR\n || cp === CHAR_HYPHEN\n}\nconst _type = Symbol('type')\nconst _declared = Symbol('declared')\n\nconst hasOwnProperty = Object.prototype.hasOwnProperty\nconst defineProperty = Object.defineProperty\nconst descriptor = {configurable: true, enumerable: true, writable: true, value: undefined}\n\nfunction hasKey (obj, key) {\n if (hasOwnProperty.call(obj, key)) return true\n if (key === '__proto__') defineProperty(obj, '__proto__', descriptor)\n return false\n}\n\nconst INLINE_TABLE = Symbol('inline-table')\nfunction InlineTable () {\n return Object.defineProperties({}, {\n [_type]: {value: INLINE_TABLE}\n })\n}\nfunction isInlineTable (obj) {\n if (obj === null || typeof (obj) !== 'object') return false\n return obj[_type] === INLINE_TABLE\n}\n\nconst TABLE = Symbol('table')\nfunction Table () {\n return Object.defineProperties({}, {\n [_type]: {value: TABLE},\n [_declared]: {value: false, writable: true}\n })\n}\nfunction isTable (obj) {\n if (obj === null || typeof (obj) !== 'object') return false\n return obj[_type] === TABLE\n}\n\nconst _contentType = Symbol('content-type')\nconst INLINE_LIST = Symbol('inline-list')\nfunction InlineList (type) {\n return Object.defineProperties([], {\n [_type]: {value: INLINE_LIST},\n [_contentType]: {value: type}\n })\n}\nfunction isInlineList (obj) {\n if (obj === null || typeof (obj) !== 'object') return false\n return obj[_type] === INLINE_LIST\n}\n\nconst LIST = Symbol('list')\nfunction List () {\n return Object.defineProperties([], {\n [_type]: {value: LIST}\n })\n}\nfunction isList (obj) {\n if (obj === null || typeof (obj) !== 'object') return false\n return obj[_type] === LIST\n}\n\n// in an eval, to let bundlers not slurp in a util proxy\nlet _custom\ntry {\n const utilInspect = eval(\"require('util').inspect\")\n _custom = utilInspect.custom\n} catch (_) {\n /* eval require not available in transpiled bundle */\n}\n/* istanbul ignore next */\nconst _inspect = _custom || 'inspect'\n\nclass BoxedBigInt {\n constructor (value) {\n try {\n this.value = global.BigInt.asIntN(64, value)\n } catch (_) {\n /* istanbul ignore next */\n this.value = null\n }\n Object.defineProperty(this, _type, {value: INTEGER})\n }\n isNaN () {\n return this.value === null\n }\n /* istanbul ignore next */\n toString () {\n return String(this.value)\n }\n /* istanbul ignore next */\n [_inspect] () {\n return `[BigInt: ${this.toString()}]}`\n }\n valueOf () {\n return this.value\n }\n}\n\nconst INTEGER = Symbol('integer')\nfunction Integer (value) {\n let num = Number(value)\n // -0 is a float thing, not an int thing\n if (Object.is(num, -0)) num = 0\n /* istanbul ignore else */\n if (global.BigInt && !Number.isSafeInteger(num)) {\n return new BoxedBigInt(value)\n } else {\n /* istanbul ignore next */\n return Object.defineProperties(new Number(num), {\n isNaN: {value: function () { return isNaN(this) }},\n [_type]: {value: INTEGER},\n [_inspect]: {value: () => `[Integer: ${value}]`}\n })\n }\n}\nfunction isInteger (obj) {\n if (obj === null || typeof (obj) !== 'object') return false\n return obj[_type] === INTEGER\n}\n\nconst FLOAT = Symbol('float')\nfunction Float (value) {\n /* istanbul ignore next */\n return Object.defineProperties(new Number(value), {\n [_type]: {value: FLOAT},\n [_inspect]: {value: () => `[Float: ${value}]`}\n })\n}\nfunction isFloat (obj) {\n if (obj === null || typeof (obj) !== 'object') return false\n return obj[_type] === FLOAT\n}\n\nfunction tomlType (value) {\n const type = typeof value\n if (type === 'object') {\n /* istanbul ignore if */\n if (value === null) return 'null'\n if (value instanceof Date) return 'datetime'\n /* istanbul ignore else */\n if (_type in value) {\n switch (value[_type]) {\n case INLINE_TABLE: return 'inline-table'\n case INLINE_LIST: return 'inline-list'\n /* istanbul ignore next */\n case TABLE: return 'table'\n /* istanbul ignore next */\n case LIST: return 'list'\n case FLOAT: return 'float'\n case INTEGER: return 'integer'\n }\n }\n }\n return type\n}\n\nfunction makeParserClass (Parser) {\n class TOMLParser extends Parser {\n constructor () {\n super()\n this.ctx = this.obj = Table()\n }\n\n /* MATCH HELPER */\n atEndOfWord () {\n return this.char === CHAR_NUM || this.char === CTRL_I || this.char === CHAR_SP || this.atEndOfLine()\n }\n atEndOfLine () {\n return this.char === Parser.END || this.char === CTRL_J || this.char === CTRL_M\n }\n\n parseStart () {\n if (this.char === Parser.END) {\n return null\n } else if (this.char === CHAR_LSQB) {\n return this.call(this.parseTableOrList)\n } else if (this.char === CHAR_NUM) {\n return this.call(this.parseComment)\n } else if (this.char === CTRL_J || this.char === CHAR_SP || this.char === CTRL_I || this.char === CTRL_M) {\n return null\n } else if (isAlphaNumQuoteHyphen(this.char)) {\n return this.callNow(this.parseAssignStatement)\n } else {\n throw this.error(new TomlError(`Unknown character \"${this.char}\"`))\n }\n }\n\n // HELPER, this strips any whitespace and comments to the end of the line\n // then RETURNS. Last state in a production.\n parseWhitespaceToEOL () {\n if (this.char === CHAR_SP || this.char === CTRL_I || this.char === CTRL_M) {\n return null\n } else if (this.char === CHAR_NUM) {\n return this.goto(this.parseComment)\n } else if (this.char === Parser.END || this.char === CTRL_J) {\n return this.return()\n } else {\n throw this.error(new TomlError('Unexpected character, expected only whitespace or comments till end of line'))\n }\n }\n\n /* ASSIGNMENT: key = value */\n parseAssignStatement () {\n return this.callNow(this.parseAssign, this.recordAssignStatement)\n }\n recordAssignStatement (kv) {\n let target = this.ctx\n let finalKey = kv.key.pop()\n for (let kw of kv.key) {\n if (hasKey(target, kw) && (!isTable(target[kw]) || target[kw][_declared])) {\n throw this.error(new TomlError(\"Can't redefine existing key\"))\n }\n target = target[kw] = target[kw] || Table()\n }\n if (hasKey(target, finalKey)) {\n throw this.error(new TomlError(\"Can't redefine existing key\"))\n }\n // unbox our numbers\n if (isInteger(kv.value) || isFloat(kv.value)) {\n target[finalKey] = kv.value.valueOf()\n } else {\n target[finalKey] = kv.value\n }\n return this.goto(this.parseWhitespaceToEOL)\n }\n\n /* ASSSIGNMENT expression, key = value possibly inside an inline table */\n parseAssign () {\n return this.callNow(this.parseKeyword, this.recordAssignKeyword)\n }\n recordAssignKeyword (key) {\n if (this.state.resultTable) {\n this.state.resultTable.push(key)\n } else {\n this.state.resultTable = [key]\n }\n return this.goto(this.parseAssignKeywordPreDot)\n }\n parseAssignKeywordPreDot () {\n if (this.char === CHAR_PERIOD) {\n return this.next(this.parseAssignKeywordPostDot)\n } else if (this.char !== CHAR_SP && this.char !== CTRL_I) {\n return this.goto(this.parseAssignEqual)\n }\n }\n parseAssignKeywordPostDot () {\n if (this.char !== CHAR_SP && this.char !== CTRL_I) {\n return this.callNow(this.parseKeyword, this.recordAssignKeyword)\n }\n }\n\n parseAssignEqual () {\n if (this.char === CHAR_EQUALS) {\n return this.next(this.parseAssignPreValue)\n } else {\n throw this.error(new TomlError('Invalid character, expected \"=\"'))\n }\n }\n parseAssignPreValue () {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else {\n return this.callNow(this.parseValue, this.recordAssignValue)\n }\n }\n recordAssignValue (value) {\n return this.returnNow({key: this.state.resultTable, value: value})\n }\n\n /* COMMENTS: #...eol */\n parseComment () {\n do {\n if (this.char === Parser.END || this.char === CTRL_J) {\n return this.return()\n }\n } while (this.nextChar())\n }\n\n /* TABLES AND LISTS, [foo] and [[foo]] */\n parseTableOrList () {\n if (this.char === CHAR_LSQB) {\n this.next(this.parseList)\n } else {\n return this.goto(this.parseTable)\n }\n }\n\n /* TABLE [foo.bar.baz] */\n parseTable () {\n this.ctx = this.obj\n return this.goto(this.parseTableNext)\n }\n parseTableNext () {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else {\n return this.callNow(this.parseKeyword, this.parseTableMore)\n }\n }\n parseTableMore (keyword) {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else if (this.char === CHAR_RSQB) {\n if (hasKey(this.ctx, keyword) && (!isTable(this.ctx[keyword]) || this.ctx[keyword][_declared])) {\n throw this.error(new TomlError(\"Can't redefine existing key\"))\n } else {\n this.ctx = this.ctx[keyword] = this.ctx[keyword] || Table()\n this.ctx[_declared] = true\n }\n return this.next(this.parseWhitespaceToEOL)\n } else if (this.char === CHAR_PERIOD) {\n if (!hasKey(this.ctx, keyword)) {\n this.ctx = this.ctx[keyword] = Table()\n } else if (isTable(this.ctx[keyword])) {\n this.ctx = this.ctx[keyword]\n } else if (isList(this.ctx[keyword])) {\n this.ctx = this.ctx[keyword][this.ctx[keyword].length - 1]\n } else {\n throw this.error(new TomlError(\"Can't redefine existing key\"))\n }\n return this.next(this.parseTableNext)\n } else {\n throw this.error(new TomlError('Unexpected character, expected whitespace, . or ]'))\n }\n }\n\n /* LIST [[a.b.c]] */\n parseList () {\n this.ctx = this.obj\n return this.goto(this.parseListNext)\n }\n parseListNext () {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else {\n return this.callNow(this.parseKeyword, this.parseListMore)\n }\n }\n parseListMore (keyword) {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else if (this.char === CHAR_RSQB) {\n if (!hasKey(this.ctx, keyword)) {\n this.ctx[keyword] = List()\n }\n if (isInlineList(this.ctx[keyword])) {\n throw this.error(new TomlError(\"Can't extend an inline array\"))\n } else if (isList(this.ctx[keyword])) {\n const next = Table()\n this.ctx[keyword].push(next)\n this.ctx = next\n } else {\n throw this.error(new TomlError(\"Can't redefine an existing key\"))\n }\n return this.next(this.parseListEnd)\n } else if (this.char === CHAR_PERIOD) {\n if (!hasKey(this.ctx, keyword)) {\n this.ctx = this.ctx[keyword] = Table()\n } else if (isInlineList(this.ctx[keyword])) {\n throw this.error(new TomlError(\"Can't extend an inline array\"))\n } else if (isInlineTable(this.ctx[keyword])) {\n throw this.error(new TomlError(\"Can't extend an inline table\"))\n } else if (isList(this.ctx[keyword])) {\n this.ctx = this.ctx[keyword][this.ctx[keyword].length - 1]\n } else if (isTable(this.ctx[keyword])) {\n this.ctx = this.ctx[keyword]\n } else {\n throw this.error(new TomlError(\"Can't redefine an existing key\"))\n }\n return this.next(this.parseListNext)\n } else {\n throw this.error(new TomlError('Unexpected character, expected whitespace, . or ]'))\n }\n }\n parseListEnd (keyword) {\n if (this.char === CHAR_RSQB) {\n return this.next(this.parseWhitespaceToEOL)\n } else {\n throw this.error(new TomlError('Unexpected character, expected whitespace, . or ]'))\n }\n }\n\n /* VALUE string, number, boolean, inline list, inline object */\n parseValue () {\n if (this.char === Parser.END) {\n throw this.error(new TomlError('Key without value'))\n } else if (this.char === CHAR_QUOT) {\n return this.next(this.parseDoubleString)\n } if (this.char === CHAR_APOS) {\n return this.next(this.parseSingleString)\n } else if (this.char === CHAR_HYPHEN || this.char === CHAR_PLUS) {\n return this.goto(this.parseNumberSign)\n } else if (this.char === CHAR_i) {\n return this.next(this.parseInf)\n } else if (this.char === CHAR_n) {\n return this.next(this.parseNan)\n } else if (isDigit(this.char)) {\n return this.goto(this.parseNumberOrDateTime)\n } else if (this.char === CHAR_t || this.char === CHAR_f) {\n return this.goto(this.parseBoolean)\n } else if (this.char === CHAR_LSQB) {\n return this.call(this.parseInlineList, this.recordValue)\n } else if (this.char === CHAR_LCUB) {\n return this.call(this.parseInlineTable, this.recordValue)\n } else {\n throw this.error(new TomlError('Unexpected character, expecting string, number, datetime, boolean, inline array or inline table'))\n }\n }\n recordValue (value) {\n return this.returnNow(value)\n }\n\n parseInf () {\n if (this.char === CHAR_n) {\n return this.next(this.parseInf2)\n } else {\n throw this.error(new TomlError('Unexpected character, expected \"inf\", \"+inf\" or \"-inf\"'))\n }\n }\n parseInf2 () {\n if (this.char === CHAR_f) {\n if (this.state.buf === '-') {\n return this.return(-Infinity)\n } else {\n return this.return(Infinity)\n }\n } else {\n throw this.error(new TomlError('Unexpected character, expected \"inf\", \"+inf\" or \"-inf\"'))\n }\n }\n\n parseNan () {\n if (this.char === CHAR_a) {\n return this.next(this.parseNan2)\n } else {\n throw this.error(new TomlError('Unexpected character, expected \"nan\"'))\n }\n }\n parseNan2 () {\n if (this.char === CHAR_n) {\n return this.return(NaN)\n } else {\n throw this.error(new TomlError('Unexpected character, expected \"nan\"'))\n }\n }\n\n /* KEYS, barewords or basic, literal, or dotted */\n parseKeyword () {\n if (this.char === CHAR_QUOT) {\n return this.next(this.parseBasicString)\n } else if (this.char === CHAR_APOS) {\n return this.next(this.parseLiteralString)\n } else {\n return this.goto(this.parseBareKey)\n }\n }\n\n /* KEYS: barewords */\n parseBareKey () {\n do {\n if (this.char === Parser.END) {\n throw this.error(new TomlError('Key ended without value'))\n } else if (isAlphaNumHyphen(this.char)) {\n this.consume()\n } else if (this.state.buf.length === 0) {\n throw this.error(new TomlError('Empty bare keys are not allowed'))\n } else {\n return this.returnNow()\n }\n } while (this.nextChar())\n }\n\n /* STRINGS, single quoted (literal) */\n parseSingleString () {\n if (this.char === CHAR_APOS) {\n return this.next(this.parseLiteralMultiStringMaybe)\n } else {\n return this.goto(this.parseLiteralString)\n }\n }\n parseLiteralString () {\n do {\n if (this.char === CHAR_APOS) {\n return this.return()\n } else if (this.atEndOfLine()) {\n throw this.error(new TomlError('Unterminated string'))\n } else if (this.char === CHAR_DEL || (this.char <= CTRL_CHAR_BOUNDARY && this.char !== CTRL_I)) {\n throw this.errorControlCharInString()\n } else {\n this.consume()\n }\n } while (this.nextChar())\n }\n parseLiteralMultiStringMaybe () {\n if (this.char === CHAR_APOS) {\n return this.next(this.parseLiteralMultiString)\n } else {\n return this.returnNow()\n }\n }\n parseLiteralMultiString () {\n if (this.char === CTRL_M) {\n return null\n } else if (this.char === CTRL_J) {\n return this.next(this.parseLiteralMultiStringContent)\n } else {\n return this.goto(this.parseLiteralMultiStringContent)\n }\n }\n parseLiteralMultiStringContent () {\n do {\n if (this.char === CHAR_APOS) {\n return this.next(this.parseLiteralMultiEnd)\n } else if (this.char === Parser.END) {\n throw this.error(new TomlError('Unterminated multi-line string'))\n } else if (this.char === CHAR_DEL || (this.char <= CTRL_CHAR_BOUNDARY && this.char !== CTRL_I && this.char !== CTRL_J && this.char !== CTRL_M)) {\n throw this.errorControlCharInString()\n } else {\n this.consume()\n }\n } while (this.nextChar())\n }\n parseLiteralMultiEnd () {\n if (this.char === CHAR_APOS) {\n return this.next(this.parseLiteralMultiEnd2)\n } else {\n this.state.buf += \"'\"\n return this.goto(this.parseLiteralMultiStringContent)\n }\n }\n parseLiteralMultiEnd2 () {\n if (this.char === CHAR_APOS) {\n return this.return()\n } else {\n this.state.buf += \"''\"\n return this.goto(this.parseLiteralMultiStringContent)\n }\n }\n\n /* STRINGS double quoted */\n parseDoubleString () {\n if (this.char === CHAR_QUOT) {\n return this.next(this.parseMultiStringMaybe)\n } else {\n return this.goto(this.parseBasicString)\n }\n }\n parseBasicString () {\n do {\n if (this.char === CHAR_BSOL) {\n return this.call(this.parseEscape, this.recordEscapeReplacement)\n } else if (this.char === CHAR_QUOT) {\n return this.return()\n } else if (this.atEndOfLine()) {\n throw this.error(new TomlError('Unterminated string'))\n } else if (this.char === CHAR_DEL || (this.char <= CTRL_CHAR_BOUNDARY && this.char !== CTRL_I)) {\n throw this.errorControlCharInString()\n } else {\n this.consume()\n }\n } while (this.nextChar())\n }\n recordEscapeReplacement (replacement) {\n this.state.buf += replacement\n return this.goto(this.parseBasicString)\n }\n parseMultiStringMaybe () {\n if (this.char === CHAR_QUOT) {\n return this.next(this.parseMultiString)\n } else {\n return this.returnNow()\n }\n }\n parseMultiString () {\n if (this.char === CTRL_M) {\n return null\n } else if (this.char === CTRL_J) {\n return this.next(this.parseMultiStringContent)\n } else {\n return this.goto(this.parseMultiStringContent)\n }\n }\n parseMultiStringContent () {\n do {\n if (this.char === CHAR_BSOL) {\n return this.call(this.parseMultiEscape, this.recordMultiEscapeReplacement)\n } else if (this.char === CHAR_QUOT) {\n return this.next(this.parseMultiEnd)\n } else if (this.char === Parser.END) {\n throw this.error(new TomlError('Unterminated multi-line string'))\n } else if (this.char === CHAR_DEL || (this.char <= CTRL_CHAR_BOUNDARY && this.char !== CTRL_I && this.char !== CTRL_J && this.char !== CTRL_M)) {\n throw this.errorControlCharInString()\n } else {\n this.consume()\n }\n } while (this.nextChar())\n }\n errorControlCharInString () {\n let displayCode = '\\\\u00'\n if (this.char < 16) {\n displayCode += '0'\n }\n displayCode += this.char.toString(16)\n\n return this.error(new TomlError(`Control characters (codes < 0x1f and 0x7f) are not allowed in strings, use ${displayCode} instead`))\n }\n recordMultiEscapeReplacement (replacement) {\n this.state.buf += replacement\n return this.goto(this.parseMultiStringContent)\n }\n parseMultiEnd () {\n if (this.char === CHAR_QUOT) {\n return this.next(this.parseMultiEnd2)\n } else {\n this.state.buf += '\"'\n return this.goto(this.parseMultiStringContent)\n }\n }\n parseMultiEnd2 () {\n if (this.char === CHAR_QUOT) {\n return this.return()\n } else {\n this.state.buf += '\"\"'\n return this.goto(this.parseMultiStringContent)\n }\n }\n parseMultiEscape () {\n if (this.char === CTRL_M || this.char === CTRL_J) {\n return this.next(this.parseMultiTrim)\n } else if (this.char === CHAR_SP || this.char === CTRL_I) {\n return this.next(this.parsePreMultiTrim)\n } else {\n return this.goto(this.parseEscape)\n }\n }\n parsePreMultiTrim () {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else if (this.char === CTRL_M || this.char === CTRL_J) {\n return this.next(this.parseMultiTrim)\n } else {\n throw this.error(new TomlError(\"Can't escape whitespace\"))\n }\n }\n parseMultiTrim () {\n // explicitly whitespace here, END should follow the same path as chars\n if (this.char === CTRL_J || this.char === CHAR_SP || this.char === CTRL_I || this.char === CTRL_M) {\n return null\n } else {\n return this.returnNow()\n }\n }\n parseEscape () {\n if (this.char in escapes) {\n return this.return(escapes[this.char])\n } else if (this.char === CHAR_u) {\n return this.call(this.parseSmallUnicode, this.parseUnicodeReturn)\n } else if (this.char === CHAR_U) {\n return this.call(this.parseLargeUnicode, this.parseUnicodeReturn)\n } else {\n throw this.error(new TomlError('Unknown escape character: ' + this.char))\n }\n }\n parseUnicodeReturn (char) {\n try {\n const codePoint = parseInt(char, 16)\n if (codePoint >= SURROGATE_FIRST && codePoint <= SURROGATE_LAST) {\n throw this.error(new TomlError('Invalid unicode, character in range 0xD800 - 0xDFFF is reserved'))\n }\n return this.returnNow(String.fromCodePoint(codePoint))\n } catch (err) {\n throw this.error(TomlError.wrap(err))\n }\n }\n parseSmallUnicode () {\n if (!isHexit(this.char)) {\n throw this.error(new TomlError('Invalid character in unicode sequence, expected hex'))\n } else {\n this.consume()\n if (this.state.buf.length >= 4) return this.return()\n }\n }\n parseLargeUnicode () {\n if (!isHexit(this.char)) {\n throw this.error(new TomlError('Invalid character in unicode sequence, expected hex'))\n } else {\n this.consume()\n if (this.state.buf.length >= 8) return this.return()\n }\n }\n\n /* NUMBERS */\n parseNumberSign () {\n this.consume()\n return this.next(this.parseMaybeSignedInfOrNan)\n }\n parseMaybeSignedInfOrNan () {\n if (this.char === CHAR_i) {\n return this.next(this.parseInf)\n } else if (this.char === CHAR_n) {\n return this.next(this.parseNan)\n } else {\n return this.callNow(this.parseNoUnder, this.parseNumberIntegerStart)\n }\n }\n parseNumberIntegerStart () {\n if (this.char === CHAR_0) {\n this.consume()\n return this.next(this.parseNumberIntegerExponentOrDecimal)\n } else {\n return this.goto(this.parseNumberInteger)\n }\n }\n parseNumberIntegerExponentOrDecimal () {\n if (this.char === CHAR_PERIOD) {\n this.consume()\n return this.call(this.parseNoUnder, this.parseNumberFloat)\n } else if (this.char === CHAR_E || this.char === CHAR_e) {\n this.consume()\n return this.next(this.parseNumberExponentSign)\n } else {\n return this.returnNow(Integer(this.state.buf))\n }\n }\n parseNumberInteger () {\n if (isDigit(this.char)) {\n this.consume()\n } else if (this.char === CHAR_LOWBAR) {\n return this.call(this.parseNoUnder)\n } else if (this.char === CHAR_E || this.char === CHAR_e) {\n this.consume()\n return this.next(this.parseNumberExponentSign)\n } else if (this.char === CHAR_PERIOD) {\n this.consume()\n return this.call(this.parseNoUnder, this.parseNumberFloat)\n } else {\n const result = Integer(this.state.buf)\n /* istanbul ignore if */\n if (result.isNaN()) {\n throw this.error(new TomlError('Invalid number'))\n } else {\n return this.returnNow(result)\n }\n }\n }\n parseNoUnder () {\n if (this.char === CHAR_LOWBAR || this.char === CHAR_PERIOD || this.char === CHAR_E || this.char === CHAR_e) {\n throw this.error(new TomlError('Unexpected character, expected digit'))\n } else if (this.atEndOfWord()) {\n throw this.error(new TomlError('Incomplete number'))\n }\n return this.returnNow()\n }\n parseNoUnderHexOctBinLiteral () {\n if (this.char === CHAR_LOWBAR || this.char === CHAR_PERIOD) {\n throw this.error(new TomlError('Unexpected character, expected digit'))\n } else if (this.atEndOfWord()) {\n throw this.error(new TomlError('Incomplete number'))\n }\n return this.returnNow()\n }\n parseNumberFloat () {\n if (this.char === CHAR_LOWBAR) {\n return this.call(this.parseNoUnder, this.parseNumberFloat)\n } else if (isDigit(this.char)) {\n this.consume()\n } else if (this.char === CHAR_E || this.char === CHAR_e) {\n this.consume()\n return this.next(this.parseNumberExponentSign)\n } else {\n return this.returnNow(Float(this.state.buf))\n }\n }\n parseNumberExponentSign () {\n if (isDigit(this.char)) {\n return this.goto(this.parseNumberExponent)\n } else if (this.char === CHAR_HYPHEN || this.char === CHAR_PLUS) {\n this.consume()\n this.call(this.parseNoUnder, this.parseNumberExponent)\n } else {\n throw this.error(new TomlError('Unexpected character, expected -, + or digit'))\n }\n }\n parseNumberExponent () {\n if (isDigit(this.char)) {\n this.consume()\n } else if (this.char === CHAR_LOWBAR) {\n return this.call(this.parseNoUnder)\n } else {\n return this.returnNow(Float(this.state.buf))\n }\n }\n\n /* NUMBERS or DATETIMES */\n parseNumberOrDateTime () {\n if (this.char === CHAR_0) {\n this.consume()\n return this.next(this.parseNumberBaseOrDateTime)\n } else {\n return this.goto(this.parseNumberOrDateTimeOnly)\n }\n }\n parseNumberOrDateTimeOnly () {\n // note, if two zeros are in a row then it MUST be a date\n if (this.char === CHAR_LOWBAR) {\n return this.call(this.parseNoUnder, this.parseNumberInteger)\n } else if (isDigit(this.char)) {\n this.consume()\n if (this.state.buf.length > 4) this.next(this.parseNumberInteger)\n } else if (this.char === CHAR_E || this.char === CHAR_e) {\n this.consume()\n return this.next(this.parseNumberExponentSign)\n } else if (this.char === CHAR_PERIOD) {\n this.consume()\n return this.call(this.parseNoUnder, this.parseNumberFloat)\n } else if (this.char === CHAR_HYPHEN) {\n return this.goto(this.parseDateTime)\n } else if (this.char === CHAR_COLON) {\n return this.goto(this.parseOnlyTimeHour)\n } else {\n return this.returnNow(Integer(this.state.buf))\n }\n }\n parseDateTimeOnly () {\n if (this.state.buf.length < 4) {\n if (isDigit(this.char)) {\n return this.consume()\n } else if (this.char === CHAR_COLON) {\n return this.goto(this.parseOnlyTimeHour)\n } else {\n throw this.error(new TomlError('Expected digit while parsing year part of a date'))\n }\n } else {\n if (this.char === CHAR_HYPHEN) {\n return this.goto(this.parseDateTime)\n } else {\n throw this.error(new TomlError('Expected hyphen (-) while parsing year part of date'))\n }\n }\n }\n parseNumberBaseOrDateTime () {\n if (this.char === CHAR_b) {\n this.consume()\n return this.call(this.parseNoUnderHexOctBinLiteral, this.parseIntegerBin)\n } else if (this.char === CHAR_o) {\n this.consume()\n return this.call(this.parseNoUnderHexOctBinLiteral, this.parseIntegerOct)\n } else if (this.char === CHAR_x) {\n this.consume()\n return this.call(this.parseNoUnderHexOctBinLiteral, this.parseIntegerHex)\n } else if (this.char === CHAR_PERIOD) {\n return this.goto(this.parseNumberInteger)\n } else if (isDigit(this.char)) {\n return this.goto(this.parseDateTimeOnly)\n } else {\n return this.returnNow(Integer(this.state.buf))\n }\n }\n parseIntegerHex () {\n if (isHexit(this.char)) {\n this.consume()\n } else if (this.char === CHAR_LOWBAR) {\n return this.call(this.parseNoUnderHexOctBinLiteral)\n } else {\n const result = Integer(this.state.buf)\n /* istanbul ignore if */\n if (result.isNaN()) {\n throw this.error(new TomlError('Invalid number'))\n } else {\n return this.returnNow(result)\n }\n }\n }\n parseIntegerOct () {\n if (isOctit(this.char)) {\n this.consume()\n } else if (this.char === CHAR_LOWBAR) {\n return this.call(this.parseNoUnderHexOctBinLiteral)\n } else {\n const result = Integer(this.state.buf)\n /* istanbul ignore if */\n if (result.isNaN()) {\n throw this.error(new TomlError('Invalid number'))\n } else {\n return this.returnNow(result)\n }\n }\n }\n parseIntegerBin () {\n if (isBit(this.char)) {\n this.consume()\n } else if (this.char === CHAR_LOWBAR) {\n return this.call(this.parseNoUnderHexOctBinLiteral)\n } else {\n const result = Integer(this.state.buf)\n /* istanbul ignore if */\n if (result.isNaN()) {\n throw this.error(new TomlError('Invalid number'))\n } else {\n return this.returnNow(result)\n }\n }\n }\n\n /* DATETIME */\n parseDateTime () {\n // we enter here having just consumed the year and about to consume the hyphen\n if (this.state.buf.length < 4) {\n throw this.error(new TomlError('Years less than 1000 must be zero padded to four characters'))\n }\n this.state.result = this.state.buf\n this.state.buf = ''\n return this.next(this.parseDateMonth)\n }\n parseDateMonth () {\n if (this.char === CHAR_HYPHEN) {\n if (this.state.buf.length < 2) {\n throw this.error(new TomlError('Months less than 10 must be zero padded to two characters'))\n }\n this.state.result += '-' + this.state.buf\n this.state.buf = ''\n return this.next(this.parseDateDay)\n } else if (isDigit(this.char)) {\n this.consume()\n } else {\n throw this.error(new TomlError('Incomplete datetime'))\n }\n }\n parseDateDay () {\n if (this.char === CHAR_T || this.char === CHAR_SP) {\n if (this.state.buf.length < 2) {\n throw this.error(new TomlError('Days less than 10 must be zero padded to two characters'))\n }\n this.state.result += '-' + this.state.buf\n this.state.buf = ''\n return this.next(this.parseStartTimeHour)\n } else if (this.atEndOfWord()) {\n return this.returnNow(createDate(this.state.result + '-' + this.state.buf))\n } else if (isDigit(this.char)) {\n this.consume()\n } else {\n throw this.error(new TomlError('Incomplete datetime'))\n }\n }\n parseStartTimeHour () {\n if (this.atEndOfWord()) {\n return this.returnNow(createDate(this.state.result))\n } else {\n return this.goto(this.parseTimeHour)\n }\n }\n parseTimeHour () {\n if (this.char === CHAR_COLON) {\n if (this.state.buf.length < 2) {\n throw this.error(new TomlError('Hours less than 10 must be zero padded to two characters'))\n }\n this.state.result += 'T' + this.state.buf\n this.state.buf = ''\n return this.next(this.parseTimeMin)\n } else if (isDigit(this.char)) {\n this.consume()\n } else {\n throw this.error(new TomlError('Incomplete datetime'))\n }\n }\n parseTimeMin () {\n if (this.state.buf.length < 2 && isDigit(this.char)) {\n this.consume()\n } else if (this.state.buf.length === 2 && this.char === CHAR_COLON) {\n this.state.result += ':' + this.state.buf\n this.state.buf = ''\n return this.next(this.parseTimeSec)\n } else {\n throw this.error(new TomlError('Incomplete datetime'))\n }\n }\n parseTimeSec () {\n if (isDigit(this.char)) {\n this.consume()\n if (this.state.buf.length === 2) {\n this.state.result += ':' + this.state.buf\n this.state.buf = ''\n return this.next(this.parseTimeZoneOrFraction)\n }\n } else {\n throw this.error(new TomlError('Incomplete datetime'))\n }\n }\n\n parseOnlyTimeHour () {\n /* istanbul ignore else */\n if (this.char === CHAR_COLON) {\n if (this.state.buf.length < 2) {\n throw this.error(new TomlError('Hours less than 10 must be zero padded to two characters'))\n }\n this.state.result = this.state.buf\n this.state.buf = ''\n return this.next(this.parseOnlyTimeMin)\n } else {\n throw this.error(new TomlError('Incomplete time'))\n }\n }\n parseOnlyTimeMin () {\n if (this.state.buf.length < 2 && isDigit(this.char)) {\n this.consume()\n } else if (this.state.buf.length === 2 && this.char === CHAR_COLON) {\n this.state.result += ':' + this.state.buf\n this.state.buf = ''\n return this.next(this.parseOnlyTimeSec)\n } else {\n throw this.error(new TomlError('Incomplete time'))\n }\n }\n parseOnlyTimeSec () {\n if (isDigit(this.char)) {\n this.consume()\n if (this.state.buf.length === 2) {\n return this.next(this.parseOnlyTimeFractionMaybe)\n }\n } else {\n throw this.error(new TomlError('Incomplete time'))\n }\n }\n parseOnlyTimeFractionMaybe () {\n this.state.result += ':' + this.state.buf\n if (this.char === CHAR_PERIOD) {\n this.state.buf = ''\n this.next(this.parseOnlyTimeFraction)\n } else {\n return this.return(createTime(this.state.result))\n }\n }\n parseOnlyTimeFraction () {\n if (isDigit(this.char)) {\n this.consume()\n } else if (this.atEndOfWord()) {\n if (this.state.buf.length === 0) throw this.error(new TomlError('Expected digit in milliseconds'))\n return this.returnNow(createTime(this.state.result + '.' + this.state.buf))\n } else {\n throw this.error(new TomlError('Unexpected character in datetime, expected period (.), minus (-), plus (+) or Z'))\n }\n }\n\n parseTimeZoneOrFraction () {\n if (this.char === CHAR_PERIOD) {\n this.consume()\n this.next(this.parseDateTimeFraction)\n } else if (this.char === CHAR_HYPHEN || this.char === CHAR_PLUS) {\n this.consume()\n this.next(this.parseTimeZoneHour)\n } else if (this.char === CHAR_Z) {\n this.consume()\n return this.return(createDateTime(this.state.result + this.state.buf))\n } else if (this.atEndOfWord()) {\n return this.returnNow(createDateTimeFloat(this.state.result + this.state.buf))\n } else {\n throw this.error(new TomlError('Unexpected character in datetime, expected period (.), minus (-), plus (+) or Z'))\n }\n }\n parseDateTimeFraction () {\n if (isDigit(this.char)) {\n this.consume()\n } else if (this.state.buf.length === 1) {\n throw this.error(new TomlError('Expected digit in milliseconds'))\n } else if (this.char === CHAR_HYPHEN || this.char === CHAR_PLUS) {\n this.consume()\n this.next(this.parseTimeZoneHour)\n } else if (this.char === CHAR_Z) {\n this.consume()\n return this.return(createDateTime(this.state.result + this.state.buf))\n } else if (this.atEndOfWord()) {\n return this.returnNow(createDateTimeFloat(this.state.result + this.state.buf))\n } else {\n throw this.error(new TomlError('Unexpected character in datetime, expected period (.), minus (-), plus (+) or Z'))\n }\n }\n parseTimeZoneHour () {\n if (isDigit(this.char)) {\n this.consume()\n // FIXME: No more regexps\n if (/\\d\\d$/.test(this.state.buf)) return this.next(this.parseTimeZoneSep)\n } else {\n throw this.error(new TomlError('Unexpected character in datetime, expected digit'))\n }\n }\n parseTimeZoneSep () {\n if (this.char === CHAR_COLON) {\n this.consume()\n this.next(this.parseTimeZoneMin)\n } else {\n throw this.error(new TomlError('Unexpected character in datetime, expected colon'))\n }\n }\n parseTimeZoneMin () {\n if (isDigit(this.char)) {\n this.consume()\n if (/\\d\\d$/.test(this.state.buf)) return this.return(createDateTime(this.state.result + this.state.buf))\n } else {\n throw this.error(new TomlError('Unexpected character in datetime, expected digit'))\n }\n }\n\n /* BOOLEAN */\n parseBoolean () {\n /* istanbul ignore else */\n if (this.char === CHAR_t) {\n this.consume()\n return this.next(this.parseTrue_r)\n } else if (this.char === CHAR_f) {\n this.consume()\n return this.next(this.parseFalse_a)\n }\n }\n parseTrue_r () {\n if (this.char === CHAR_r) {\n this.consume()\n return this.next(this.parseTrue_u)\n } else {\n throw this.error(new TomlError('Invalid boolean, expected true or false'))\n }\n }\n parseTrue_u () {\n if (this.char === CHAR_u) {\n this.consume()\n return this.next(this.parseTrue_e)\n } else {\n throw this.error(new TomlError('Invalid boolean, expected true or false'))\n }\n }\n parseTrue_e () {\n if (this.char === CHAR_e) {\n return this.return(true)\n } else {\n throw this.error(new TomlError('Invalid boolean, expected true or false'))\n }\n }\n\n parseFalse_a () {\n if (this.char === CHAR_a) {\n this.consume()\n return this.next(this.parseFalse_l)\n } else {\n throw this.error(new TomlError('Invalid boolean, expected true or false'))\n }\n }\n\n parseFalse_l () {\n if (this.char === CHAR_l) {\n this.consume()\n return this.next(this.parseFalse_s)\n } else {\n throw this.error(new TomlError('Invalid boolean, expected true or false'))\n }\n }\n\n parseFalse_s () {\n if (this.char === CHAR_s) {\n this.consume()\n return this.next(this.parseFalse_e)\n } else {\n throw this.error(new TomlError('Invalid boolean, expected true or false'))\n }\n }\n\n parseFalse_e () {\n if (this.char === CHAR_e) {\n return this.return(false)\n } else {\n throw this.error(new TomlError('Invalid boolean, expected true or false'))\n }\n }\n\n /* INLINE LISTS */\n parseInlineList () {\n if (this.char === CHAR_SP || this.char === CTRL_I || this.char === CTRL_M || this.char === CTRL_J) {\n return null\n } else if (this.char === Parser.END) {\n throw this.error(new TomlError('Unterminated inline array'))\n } else if (this.char === CHAR_NUM) {\n return this.call(this.parseComment)\n } else if (this.char === CHAR_RSQB) {\n return this.return(this.state.resultArr || InlineList())\n } else {\n return this.callNow(this.parseValue, this.recordInlineListValue)\n }\n }\n recordInlineListValue (value) {\n if (this.state.resultArr) {\n const listType = this.state.resultArr[_contentType]\n const valueType = tomlType(value)\n if (listType !== valueType) {\n throw this.error(new TomlError(`Inline lists must be a single type, not a mix of ${listType} and ${valueType}`))\n }\n } else {\n this.state.resultArr = InlineList(tomlType(value))\n }\n if (isFloat(value) || isInteger(value)) {\n // unbox now that we've verified they're ok\n this.state.resultArr.push(value.valueOf())\n } else {\n this.state.resultArr.push(value)\n }\n return this.goto(this.parseInlineListNext)\n }\n parseInlineListNext () {\n if (this.char === CHAR_SP || this.char === CTRL_I || this.char === CTRL_M || this.char === CTRL_J) {\n return null\n } else if (this.char === CHAR_NUM) {\n return this.call(this.parseComment)\n } else if (this.char === CHAR_COMMA) {\n return this.next(this.parseInlineList)\n } else if (this.char === CHAR_RSQB) {\n return this.goto(this.parseInlineList)\n } else {\n throw this.error(new TomlError('Invalid character, expected whitespace, comma (,) or close bracket (])'))\n }\n }\n\n /* INLINE TABLE */\n parseInlineTable () {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else if (this.char === Parser.END || this.char === CHAR_NUM || this.char === CTRL_J || this.char === CTRL_M) {\n throw this.error(new TomlError('Unterminated inline array'))\n } else if (this.char === CHAR_RCUB) {\n return this.return(this.state.resultTable || InlineTable())\n } else {\n if (!this.state.resultTable) this.state.resultTable = InlineTable()\n return this.callNow(this.parseAssign, this.recordInlineTableValue)\n }\n }\n recordInlineTableValue (kv) {\n let target = this.state.resultTable\n let finalKey = kv.key.pop()\n for (let kw of kv.key) {\n if (hasKey(target, kw) && (!isTable(target[kw]) || target[kw][_declared])) {\n throw this.error(new TomlError(\"Can't redefine existing key\"))\n }\n target = target[kw] = target[kw] || Table()\n }\n if (hasKey(target, finalKey)) {\n throw this.error(new TomlError(\"Can't redefine existing key\"))\n }\n if (isInteger(kv.value) || isFloat(kv.value)) {\n target[finalKey] = kv.value.valueOf()\n } else {\n target[finalKey] = kv.value\n }\n return this.goto(this.parseInlineTableNext)\n }\n parseInlineTableNext () {\n if (this.char === CHAR_SP || this.char === CTRL_I) {\n return null\n } else if (this.char === Parser.END || this.char === CHAR_NUM || this.char === CTRL_J || this.char === CTRL_M) {\n throw this.error(new TomlError('Unterminated inline array'))\n } else if (this.char === CHAR_COMMA) {\n return this.next(this.parseInlineTable)\n } else if (this.char === CHAR_RCUB) {\n return this.goto(this.parseInlineTable)\n } else {\n throw this.error(new TomlError('Invalid character, expected whitespace, comma (,) or close bracket (])'))\n }\n }\n }\n return TOMLParser\n}\n","'use strict'\nmodule.exports = prettyError\n\nfunction prettyError (err, buf) {\n /* istanbul ignore if */\n if (err.pos == null || err.line == null) return err\n let msg = err.message\n msg += ` at row ${err.line + 1}, col ${err.col + 1}, pos ${err.pos}:\\n`\n\n /* istanbul ignore else */\n if (buf && buf.split) {\n const lines = buf.split(/\\n/)\n const lineNumWidth = String(Math.min(lines.length, err.line + 3)).length\n let linePadding = ' '\n while (linePadding.length < lineNumWidth) linePadding += ' '\n for (let ii = Math.max(0, err.line - 1); ii < Math.min(lines.length, err.line + 2); ++ii) {\n let lineNum = String(ii + 1)\n if (lineNum.length < lineNumWidth) lineNum = ' ' + lineNum\n if (err.line === ii) {\n msg += lineNum + '> ' + lines[ii] + '\\n'\n msg += linePadding + ' '\n for (let hh = 0; hh < err.col; ++hh) {\n msg += ' '\n }\n msg += '^\\n'\n } else {\n msg += lineNum + ': ' + lines[ii] + '\\n'\n }\n }\n }\n err.message = msg + '\\n'\n return err\n}\n","'use strict'\nmodule.exports = parseString\n\nconst TOMLParser = require('./lib/toml-parser.js')\nconst prettyError = require('./parse-pretty-error.js')\n\nfunction parseString (str) {\n if (global.Buffer && global.Buffer.isBuffer(str)) {\n str = str.toString('utf8')\n }\n const parser = new TOMLParser()\n try {\n parser.parse(str)\n return parser.finish()\n } catch (err) {\n throw prettyError(err, str)\n }\n}\n","'use strict'\nmodule.exports = parseAsync\n\nconst TOMLParser = require('./lib/toml-parser.js')\nconst prettyError = require('./parse-pretty-error.js')\n\nfunction parseAsync (str, opts) {\n if (!opts) opts = {}\n const index = 0\n const blocksize = opts.blocksize || 40960\n const parser = new TOMLParser()\n return new Promise((resolve, reject) => {\n setImmediate(parseAsyncNext, index, blocksize, resolve, reject)\n })\n function parseAsyncNext (index, blocksize, resolve, reject) {\n if (index >= str.length) {\n try {\n return resolve(parser.finish())\n } catch (err) {\n return reject(prettyError(err, str))\n }\n }\n try {\n parser.parse(str.slice(index, index + blocksize))\n setImmediate(parseAsyncNext, index + blocksize, blocksize, resolve, reject)\n } catch (err) {\n reject(prettyError(err, str))\n }\n }\n}\n","'use strict'\nmodule.exports = parseStream\n\nconst stream = require('stream')\nconst TOMLParser = require('./lib/toml-parser.js')\n\nfunction parseStream (stm) {\n if (stm) {\n return parseReadable(stm)\n } else {\n return parseTransform(stm)\n }\n}\n\nfunction parseReadable (stm) {\n const parser = new TOMLParser()\n stm.setEncoding('utf8')\n return new Promise((resolve, reject) => {\n let readable\n let ended = false\n let errored = false\n function finish () {\n ended = true\n if (readable) return\n try {\n resolve(parser.finish())\n } catch (err) {\n reject(err)\n }\n }\n function error (err) {\n errored = true\n reject(err)\n }\n stm.once('end', finish)\n stm.once('error', error)\n readNext()\n\n function readNext () {\n readable = true\n let data\n while ((data = stm.read()) !== null) {\n try {\n parser.parse(data)\n } catch (err) {\n return error(err)\n }\n }\n readable = false\n /* istanbul ignore if */\n if (ended) return finish()\n /* istanbul ignore if */\n if (errored) return\n stm.once('readable', readNext)\n }\n })\n}\n\nfunction parseTransform () {\n const parser = new TOMLParser()\n return new stream.Transform({\n objectMode: true,\n transform (chunk, encoding, cb) {\n try {\n parser.parse(chunk.toString(encoding))\n } catch (err) {\n this.emit('error', err)\n }\n cb()\n },\n flush (cb) {\n try {\n this.push(parser.finish())\n } catch (err) {\n this.emit('error', err)\n }\n cb()\n }\n })\n}\n","'use strict'\nmodule.exports = require('./parse-string.js')\nmodule.exports.async = require('./parse-async.js')\nmodule.exports.stream = require('./parse-stream.js')\nmodule.exports.prettyError = require('./parse-pretty-error.js')\n","'use strict'\nmodule.exports = stringify\nmodule.exports.value = stringifyInline\n\nfunction stringify (obj) {\n if (obj === null) throw typeError('null')\n if (obj === void (0)) throw typeError('undefined')\n if (typeof obj !== 'object') throw typeError(typeof obj)\n\n if (typeof obj.toJSON === 'function') obj = obj.toJSON()\n if (obj == null) return null\n const type = tomlType(obj)\n if (type !== 'table') throw typeError(type)\n return stringifyObject('', '', obj)\n}\n\nfunction typeError (type) {\n return new Error('Can only stringify objects, not ' + type)\n}\n\nfunction arrayOneTypeError () {\n return new Error(\"Array values can't have mixed types\")\n}\n\nfunction getInlineKeys (obj) {\n return Object.keys(obj).filter(key => isInline(obj[key]))\n}\nfunction getComplexKeys (obj) {\n return Object.keys(obj).filter(key => !isInline(obj[key]))\n}\n\nfunction toJSON (obj) {\n let nobj = Array.isArray(obj) ? [] : Object.prototype.hasOwnProperty.call(obj, '__proto__') ? {['__proto__']: undefined} : {}\n for (let prop of Object.keys(obj)) {\n if (obj[prop] && typeof obj[prop].toJSON === 'function' && !('toISOString' in obj[prop])) {\n nobj[prop] = obj[prop].toJSON()\n } else {\n nobj[prop] = obj[prop]\n }\n }\n return nobj\n}\n\nfunction stringifyObject (prefix, indent, obj) {\n obj = toJSON(obj)\n var inlineKeys\n var complexKeys\n inlineKeys = getInlineKeys(obj)\n complexKeys = getComplexKeys(obj)\n var result = []\n var inlineIndent = indent || ''\n inlineKeys.forEach(key => {\n var type = tomlType(obj[key])\n if (type !== 'undefined' && type !== 'null') {\n result.push(inlineIndent + stringifyKey(key) + ' = ' + stringifyAnyInline(obj[key], true))\n }\n })\n if (result.length > 0) result.push('')\n var complexIndent = prefix && inlineKeys.length > 0 ? indent + ' ' : ''\n complexKeys.forEach(key => {\n result.push(stringifyComplex(prefix, complexIndent, key, obj[key]))\n })\n return result.join('\\n')\n}\n\nfunction isInline (value) {\n switch (tomlType(value)) {\n case 'undefined':\n case 'null':\n case 'integer':\n case 'nan':\n case 'float':\n case 'boolean':\n case 'string':\n case 'datetime':\n return true\n case 'array':\n return value.length === 0 || tomlType(value[0]) !== 'table'\n case 'table':\n return Object.keys(value).length === 0\n /* istanbul ignore next */\n default:\n return false\n }\n}\n\nfunction tomlType (value) {\n if (value === undefined) {\n return 'undefined'\n } else if (value === null) {\n return 'null'\n /* eslint-disable valid-typeof */\n } else if (typeof value === 'bigint' || (Number.isInteger(value) && !Object.is(value, -0))) {\n return 'integer'\n } else if (typeof value === 'number') {\n return 'float'\n } else if (typeof value === 'boolean') {\n return 'boolean'\n } else if (typeof value === 'string') {\n return 'string'\n } else if ('toISOString' in value) {\n return isNaN(value) ? 'undefined' : 'datetime'\n } else if (Array.isArray(value)) {\n return 'array'\n } else {\n return 'table'\n }\n}\n\nfunction stringifyKey (key) {\n var keyStr = String(key)\n if (/^[-A-Za-z0-9_]+$/.test(keyStr)) {\n return keyStr\n } else {\n return stringifyBasicString(keyStr)\n }\n}\n\nfunction stringifyBasicString (str) {\n return '\"' + escapeString(str).replace(/\"/g, '\\\\\"') + '\"'\n}\n\nfunction stringifyLiteralString (str) {\n return \"'\" + str + \"'\"\n}\n\nfunction numpad (num, str) {\n while (str.length < num) str = '0' + str\n return str\n}\n\nfunction escapeString (str) {\n return str.replace(/\\\\/g, '\\\\\\\\')\n .replace(/[\\b]/g, '\\\\b')\n .replace(/\\t/g, '\\\\t')\n .replace(/\\n/g, '\\\\n')\n .replace(/\\f/g, '\\\\f')\n .replace(/\\r/g, '\\\\r')\n /* eslint-disable no-control-regex */\n .replace(/([\\u0000-\\u001f\\u007f])/, c => '\\\\u' + numpad(4, c.codePointAt(0).toString(16)))\n /* eslint-enable no-control-regex */\n}\n\nfunction stringifyMultilineString (str) {\n let escaped = str.split(/\\n/).map(str => {\n return escapeString(str).replace(/\"(?=\"\")/g, '\\\\\"')\n }).join('\\n')\n if (escaped.slice(-1) === '\"') escaped += '\\\\\\n'\n return '\"\"\"\\n' + escaped + '\"\"\"'\n}\n\nfunction stringifyAnyInline (value, multilineOk) {\n let type = tomlType(value)\n if (type === 'string') {\n if (multilineOk && /\\n/.test(value)) {\n type = 'string-multiline'\n } else if (!/[\\b\\t\\n\\f\\r']/.test(value) && /\"/.test(value)) {\n type = 'string-literal'\n }\n }\n return stringifyInline(value, type)\n}\n\nfunction stringifyInline (value, type) {\n /* istanbul ignore if */\n if (!type) type = tomlType(value)\n switch (type) {\n case 'string-multiline':\n return stringifyMultilineString(value)\n case 'string':\n return stringifyBasicString(value)\n case 'string-literal':\n return stringifyLiteralString(value)\n case 'integer':\n return stringifyInteger(value)\n case 'float':\n return stringifyFloat(value)\n case 'boolean':\n return stringifyBoolean(value)\n case 'datetime':\n return stringifyDatetime(value)\n case 'array':\n return stringifyInlineArray(value.filter(_ => tomlType(_) !== 'null' && tomlType(_) !== 'undefined' && tomlType(_) !== 'nan'))\n case 'table':\n return stringifyInlineTable(value)\n /* istanbul ignore next */\n default:\n throw typeError(type)\n }\n}\n\nfunction stringifyInteger (value) {\n /* eslint-disable security/detect-unsafe-regex */\n return String(value).replace(/\\B(?=(\\d{3})+(?!\\d))/g, '_')\n}\n\nfunction stringifyFloat (value) {\n if (value === Infinity) {\n return 'inf'\n } else if (value === -Infinity) {\n return '-inf'\n } else if (Object.is(value, NaN)) {\n return 'nan'\n } else if (Object.is(value, -0)) {\n return '-0.0'\n }\n var chunks = String(value).split('.')\n var int = chunks[0]\n var dec = chunks[1] || 0\n return stringifyInteger(int) + '.' + dec\n}\n\nfunction stringifyBoolean (value) {\n return String(value)\n}\n\nfunction stringifyDatetime (value) {\n return value.toISOString()\n}\n\nfunction isNumber (type) {\n return type === 'float' || type === 'integer'\n}\nfunction arrayType (values) {\n var contentType = tomlType(values[0])\n if (values.every(_ => tomlType(_) === contentType)) return contentType\n // mixed integer/float, emit as floats\n if (values.every(_ => isNumber(tomlType(_)))) return 'float'\n return 'mixed'\n}\nfunction validateArray (values) {\n const type = arrayType(values)\n if (type === 'mixed') {\n throw arrayOneTypeError()\n }\n return type\n}\n\nfunction stringifyInlineArray (values) {\n values = toJSON(values)\n const type = validateArray(values)\n var result = '['\n var stringified = values.map(_ => stringifyInline(_, type))\n if (stringified.join(', ').length > 60 || /\\n/.test(stringified)) {\n result += '\\n ' + stringified.join(',\\n ') + '\\n'\n } else {\n result += ' ' + stringified.join(', ') + (stringified.length > 0 ? ' ' : '')\n }\n return result + ']'\n}\n\nfunction stringifyInlineTable (value) {\n value = toJSON(value)\n var result = []\n Object.keys(value).forEach(key => {\n result.push(stringifyKey(key) + ' = ' + stringifyAnyInline(value[key], false))\n })\n return '{ ' + result.join(', ') + (result.length > 0 ? ' ' : '') + '}'\n}\n\nfunction stringifyComplex (prefix, indent, key, value) {\n var valueType = tomlType(value)\n /* istanbul ignore else */\n if (valueType === 'array') {\n return stringifyArrayOfTables(prefix, indent, key, value)\n } else if (valueType === 'table') {\n return stringifyComplexTable(prefix, indent, key, value)\n } else {\n throw typeError(valueType)\n }\n}\n\nfunction stringifyArrayOfTables (prefix, indent, key, values) {\n values = toJSON(values)\n validateArray(values)\n var firstValueType = tomlType(values[0])\n /* istanbul ignore if */\n if (firstValueType !== 'table') throw typeError(firstValueType)\n var fullKey = prefix + stringifyKey(key)\n var result = ''\n values.forEach(table => {\n if (result.length > 0) result += '\\n'\n result += indent + '[[' + fullKey + ']]\\n'\n result += stringifyObject(fullKey + '.', indent, table)\n })\n return result\n}\n\nfunction stringifyComplexTable (prefix, indent, key, value) {\n var fullKey = prefix + stringifyKey(key)\n var result = ''\n if (getInlineKeys(value).length > 0) {\n result += indent + '[' + fullKey + ']\\n'\n }\n return result + stringifyObject(fullKey + '.', indent, value)\n}\n","'use strict'\nexports.parse = require('./parse.js')\nexports.stringify = require('./stringify.js')\n","import { appendFileSync, existsSync, readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { PATHS, ensureRuntimeDirs } from './paths.js';\nimport { findRunningDaemon, removePidFile, writePidFile } from './pidfile.js';\nimport { IpcServer } from './ipc-server.js';\nimport { ModuleHost } from './module-host.js';\nimport { AlertDispatcher } from './alerts/index.js';\nimport { RunsWorker } from './workers/runs-worker.js';\nimport { RuleEngine } from './rules/engine.js';\nimport { loadAllRules } from './rules/loader.js';\nimport { detectFirewallAdapter } from './firewall/adapters.js';\nimport { RemediationManager } from './firewall/remediation.js';\nimport { bus } from './event-bus.js';\nimport { initStateDB, closeDB } from '../core/state.js';\nimport { loadConfig } from '../core/config.js';\nimport { captureException, flushTelemetry, initTelemetry } from '../core/telemetry.js';\nimport type { ThreatEvent } from '../types/events.js';\n\nfunction readVersion(): string {\n try {\n const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf-8'));\n return pkg.version || '0.0.0';\n } catch {\n return '0.0.0';\n }\n}\n\nfunction logLine(line: string): void {\n try {\n appendFileSync(PATHS.logFile, `${new Date().toISOString()} ${line}\\n`);\n } catch {\n // best-effort\n }\n}\n\nexport async function runDaemon(): Promise<void> {\n if (findRunningDaemon()) {\n console.error(`threatcrushd already running (pid file at ${PATHS.pidFile}).`);\n process.exit(1);\n }\n\n ensureRuntimeDirs();\n writePidFile();\n\n await initTelemetry('daemon');\n process.on('uncaughtException', (err) => {\n logLine(`[daemon] uncaughtException: ${err.message}`);\n captureException(err);\n });\n process.on('unhandledRejection', (reason) => {\n logLine(`[daemon] unhandledRejection: ${String(reason)}`);\n captureException(reason);\n });\n\n const version = readVersion();\n logLine(`[daemon] starting threatcrushd v${version} mode=${PATHS.mode}`);\n\n try {\n initStateDB(PATHS.stateDb);\n } catch (err) {\n logLine(`[daemon] state db unavailable: ${(err as Error).message}`);\n }\n\n const config = loadConfig(existsSync(PATHS.configFile) ? PATHS.configFile : undefined);\n\n bus.on('event', (event: ThreatEvent) => {\n logLine(`[event] ${event.severity} ${event.module} ${event.message}`);\n });\n\n const moduleHost = new ModuleHost(bus);\n await moduleHost.start();\n\n // Detection rule engine (PRD 01)\n const ruleEngine = new RuleEngine((detection) => {\n const event: ThreatEvent = {\n timestamp: new Date(),\n module: 'rule-engine',\n category: (detection.raw_metadata?.category as any) || 'system',\n severity: detection.severity,\n message: `[DETECTION] ${detection.title}`,\n source_ip: detection.source_ip,\n details: {\n rule_id: detection.rule_id,\n username: detection.username,\n ...detection.raw_metadata,\n },\n };\n bus.publish(event);\n });\n ruleEngine.loadRules(loadAllRules());\n bus.on('event', (event) => {\n if (event.module !== 'rule-engine') ruleEngine.evaluate(event);\n });\n logLine(`[daemon] rule engine loaded ${ruleEngine.getRules().length} rules`);\n setInterval(() => ruleEngine.cleanup(), 300_000);\n\n // Firewall auto-remediation (PRD 02)\n const firewallAdapter = detectFirewallAdapter();\n const remediation = new RemediationManager(firewallAdapter, bus, (config as any).remediation);\n bus.on('event', (event) => {\n if (event.module !== 'firewall-rules') {\n void remediation.handleDetection(event);\n }\n });\n logLine(`[daemon] firewall remediation active (backend=${firewallAdapter.name}, dry_run=${(config as any).remediation?.dry_run ?? true})`);\n\n new AlertDispatcher(bus, config);\n\n const runsWorker = new RunsWorker(bus);\n try {\n await runsWorker.start();\n } catch (err) {\n logLine(`[daemon] runs-worker failed to start: ${(err as Error).message}`);\n }\n\n const ipc = new IpcServer(version, moduleHost);\n await ipc.start();\n logLine(`[daemon] ipc listening on ${PATHS.socket}`);\n\n const shutdown = async (signal: string) => {\n logLine(`[daemon] received ${signal}, shutting down`);\n try { remediation.stop(); } catch {}\n try { runsWorker.stop(); } catch {}\n try { await moduleHost.stop(); } catch {}\n try { await ipc.stop(); } catch {}\n try { closeDB(); } catch {}\n try { await flushTelemetry(); } catch {}\n removePidFile();\n process.exit(0);\n };\n\n process.on('SIGINT', () => { void shutdown('SIGINT'); });\n process.on('SIGTERM', () => { void shutdown('SIGTERM'); });\n process.on('SIGHUP', () => { void shutdown('SIGHUP'); });\n\n // keep-alive\n setInterval(() => {}, 1 << 30);\n}\n\n// Note: auto-boot is handled by `src/daemon-entry.ts` so that importing this\n// module from the CLI bundle never accidentally starts a daemon.\n","import { existsSync, mkdirSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\n\nfunction isRoot(): boolean {\n return (\n process.platform === 'linux' &&\n typeof process.getuid === 'function' &&\n process.getuid() === 0\n );\n}\n\nconst userBase = join(homedir(), '.threatcrush');\n\nconst SYSTEM_PATHS = {\n mode: 'system' as const,\n configDir: '/etc/threatcrush',\n configFile: '/etc/threatcrush/threatcrushd.conf',\n confD: '/etc/threatcrush/threatcrushd.conf.d',\n moduleDir: '/etc/threatcrush/modules',\n logDir: '/var/log/threatcrush',\n logFile: '/var/log/threatcrush/threatcrushd.log',\n stateDir: '/var/lib/threatcrush',\n stateDb: '/var/lib/threatcrush/state.db',\n runDir: '/var/run/threatcrush',\n pidFile: '/var/run/threatcrush/threatcrushd.pid',\n socket: '/var/run/threatcrush/threatcrushd.sock',\n};\n\nconst USER_PATHS = {\n mode: 'user' as const,\n configDir: userBase,\n configFile: join(userBase, 'threatcrushd.conf'),\n confD: join(userBase, 'threatcrushd.conf.d'),\n moduleDir: join(userBase, 'modules'),\n logDir: join(userBase, 'logs'),\n logFile: join(userBase, 'logs', 'threatcrushd.log'),\n stateDir: join(userBase, 'state'),\n stateDb: join(userBase, 'state', 'state.db'),\n runDir: join(userBase, 'run'),\n pidFile: join(userBase, 'run', 'threatcrushd.pid'),\n socket: join(userBase, 'run', 'threatcrushd.sock'),\n};\n\n// System paths (config/log/state/run under /etc and /var) are root-owned, so we\n// only run in system mode when actually root. Choosing system mode because\n// /etc/threatcrush happened to be writable, or because a stale system socket\n// existed, made `threatcrush start` as a normal user crash with EACCES trying\n// to open /var/log/threatcrush/threatcrushd.log. A non-root user always runs a\n// self-contained daemon under ~/.threatcrush instead.\nexport const PATHS = isRoot() ? SYSTEM_PATHS : USER_PATHS;\n\n// A non-root client command (status/stop/logs/tail) should still be able to\n// reach a daemon that root started. Prefer this process's own socket, but fall\n// back to the other mode's socket when only that one is present.\nexport function resolveClientSocket(): string {\n if (existsSync(PATHS.socket)) return PATHS.socket;\n const other = PATHS.mode === 'system' ? USER_PATHS.socket : SYSTEM_PATHS.socket;\n if (existsSync(other)) return other;\n return PATHS.socket;\n}\n\nexport function ensureRuntimeDirs(): void {\n for (const dir of [PATHS.configDir, PATHS.confD, PATHS.moduleDir, PATHS.logDir, PATHS.stateDir, PATHS.runDir]) {\n try {\n mkdirSync(dir, { recursive: true });\n } catch {\n // best-effort\n }\n }\n}\n","import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';\nimport { PATHS, ensureRuntimeDirs } from './paths.js';\n\nexport function writePidFile(): void {\n ensureRuntimeDirs();\n writeFileSync(PATHS.pidFile, String(process.pid), 'utf-8');\n}\n\nexport function readPidFile(): number | null {\n if (!existsSync(PATHS.pidFile)) return null;\n const raw = readFileSync(PATHS.pidFile, 'utf-8').trim();\n const pid = parseInt(raw, 10);\n return Number.isFinite(pid) ? pid : null;\n}\n\nexport function removePidFile(): void {\n try {\n if (existsSync(PATHS.pidFile)) unlinkSync(PATHS.pidFile);\n } catch {\n // ignore\n }\n}\n\nexport function isProcessAlive(pid: number): boolean {\n try {\n process.kill(pid, 0);\n return true;\n } catch (err) {\n // EPERM means the process exists but the current user can't signal it\n // (common: a non-root client checking on a system-mode daemon running as\n // root). Only ESRCH means the process is actually gone.\n const code = (err as NodeJS.ErrnoException).code;\n return code === 'EPERM';\n }\n}\n\nexport function findRunningDaemon(): number | null {\n const pid = readPidFile();\n if (pid && isProcessAlive(pid)) return pid;\n if (pid) removePidFile();\n return null;\n}\n","import { createServer, Server, Socket } from 'node:net';\nimport { existsSync, unlinkSync } from 'node:fs';\nimport type { ThreatEvent } from '../types/events.js';\nimport { PATHS } from './paths.js';\nimport { issueControlToken, tokensMatch } from './control-token.js';\nimport { bus } from './event-bus.js';\nimport { getRecentEvents, getTopSources, getEventCount, getThreatCount, isStateDbAvailable } from '../core/state.js';\nimport type {\n IpcRequest,\n IpcResponse,\n IpcPush,\n DaemonStatusReply,\n} from './ipc-protocol.js';\nimport type { ModuleHost } from './module-host.js';\n\ninterface ClientState {\n id: number;\n socket: Socket;\n buffer: string;\n subscriptions: Set<'event' | 'module'>;\n}\n\nexport class IpcServer {\n private server: Server | null = null;\n private clients = new Map<number, ClientState>();\n private nextClientId = 1;\n private startedAt = new Date();\n private counters = { events: 0, threats: 0, alerts: 0 };\n private controlToken = '';\n\n constructor(\n private version: string,\n private moduleHost: ModuleHost,\n ) {\n bus.on('event', (event: ThreatEvent) => {\n this.counters.events++;\n if (event.severity === 'medium' || event.severity === 'high' || event.severity === 'critical') {\n this.counters.threats++;\n }\n this.broadcast({ push: 'event', payload: event }, 'event');\n });\n bus.on('alert', () => {\n this.counters.alerts++;\n });\n bus.on('module', (info) => {\n this.broadcast({ push: 'module', payload: info }, 'module');\n });\n }\n\n async start(): Promise<void> {\n // Rotated per start, so a token leaked from a previous run is useless.\n this.controlToken = issueControlToken();\n\n if (existsSync(PATHS.socket)) {\n try { unlinkSync(PATHS.socket); } catch {}\n }\n return new Promise((resolve, reject) => {\n this.server = createServer((sock) => this.handleClient(sock));\n this.server.on('error', reject);\n this.server.listen(PATHS.socket, () => {\n const nodeFs = require('node:fs') as typeof import('node:fs');\n try { nodeFs.chmodSync(PATHS.socket, 0o660); } catch {}\n // When the daemon runs as root (system mode under systemd), regroup\n // the socket to `adm` so users in that group can talk to the daemon\n // without sudo. We use this group because it's the same one that\n // already governs read access to /var/log/{auth,syslog,nginx} — the\n // intent is \"people who can already inspect logs can talk to the\n // agent that watches them.\"\n const isRoot = process.platform === 'linux'\n && typeof process.getuid === 'function'\n && process.getuid() === 0;\n if (isRoot) {\n try {\n const { gid } = nodeFs.statSync('/var/log/auth.log');\n nodeFs.chownSync(PATHS.socket, 0, gid);\n } catch {\n // adm group not present, or /var/log/auth.log missing — leave as root:root\n }\n }\n resolve();\n });\n });\n }\n\n async stop(): Promise<void> {\n for (const c of this.clients.values()) {\n try { c.socket.destroy(); } catch {}\n }\n this.clients.clear();\n return new Promise((resolve) => {\n if (!this.server) {\n try { if (existsSync(PATHS.socket)) unlinkSync(PATHS.socket); } catch {}\n return resolve();\n }\n this.server.close(() => {\n try { if (existsSync(PATHS.socket)) unlinkSync(PATHS.socket); } catch {}\n resolve();\n });\n });\n }\n\n private handleClient(socket: Socket): void {\n const id = this.nextClientId++;\n const state: ClientState = { id, socket, buffer: '', subscriptions: new Set() };\n this.clients.set(id, state);\n\n socket.setEncoding('utf-8');\n socket.on('data', (chunk) => {\n state.buffer += chunk.toString();\n let idx;\n while ((idx = state.buffer.indexOf('\\n')) >= 0) {\n const line = state.buffer.slice(0, idx);\n state.buffer = state.buffer.slice(idx + 1);\n if (!line.trim()) continue;\n this.handleLine(state, line).catch((err) => {\n this.send(state, { id: 0, ok: false, error: String(err?.message || err) });\n });\n }\n });\n\n socket.on('close', () => { this.clients.delete(id); });\n socket.on('error', () => { this.clients.delete(id); });\n }\n\n private async handleLine(client: ClientState, line: string): Promise<void> {\n let req: IpcRequest;\n try {\n req = JSON.parse(line) as IpcRequest;\n } catch {\n return this.send(client, { id: 0, ok: false, error: 'invalid json' });\n }\n\n switch (req.method) {\n case 'ping':\n return this.send(client, { id: req.id, ok: true, result: 'pong' });\n\n case 'status': {\n const status: DaemonStatusReply = {\n pid: process.pid,\n startedAt: this.startedAt.toISOString(),\n uptimeSeconds: Math.floor((Date.now() - this.startedAt.getTime()) / 1000),\n version: this.version,\n mode: PATHS.mode,\n paths: {\n config: PATHS.configFile,\n log: PATHS.logFile,\n state: PATHS.stateDb,\n socket: PATHS.socket,\n },\n modules: this.moduleHost.summary(),\n counters: { ...this.counters },\n stateDb: isStateDbAvailable(),\n };\n return this.send(client, { id: req.id, ok: true, result: status });\n }\n\n case 'recent_events': {\n const limit = req.params?.limit ?? 50;\n const events = getRecentEvents(limit);\n return this.send(client, { id: req.id, ok: true, result: events });\n }\n\n case 'top_sources': {\n const limit = req.params?.limit ?? 10;\n return this.send(client, { id: req.id, ok: true, result: getTopSources(limit) });\n }\n\n case 'counters': {\n return this.send(client, {\n id: req.id,\n ok: true,\n result: {\n total: getEventCount(),\n threats: getThreatCount(),\n last24h: getEventCount(new Date(Date.now() - 86400000)),\n threats24h: getThreatCount(new Date(Date.now() - 86400000)),\n },\n });\n }\n\n case 'module_list':\n return this.send(client, { id: req.id, ok: true, result: this.moduleHost.summary() });\n\n case 'subscribe':\n for (const ch of req.params.channels) client.subscriptions.add(ch);\n return this.send(client, { id: req.id, ok: true, result: { subscribed: [...client.subscriptions] } });\n\n case 'shutdown':\n // TC-33: reads are open to the adm group by design; stopping the\n // security daemon is not. Requires the root-only control token.\n if (!tokensMatch(this.controlToken, (req as { params?: { token?: unknown } }).params?.token)) {\n return this.send(client, {\n id: req.id,\n ok: false,\n error: 'shutdown requires the daemon control token (run as root, or use systemctl)',\n });\n }\n this.send(client, { id: req.id, ok: true, result: 'shutting down' });\n setTimeout(() => process.emit('SIGTERM' as NodeJS.Signals), 50);\n return;\n }\n }\n\n private send(client: ClientState, msg: IpcResponse | IpcPush): void {\n try {\n client.socket.write(JSON.stringify(msg) + '\\n');\n } catch {\n // client gone\n }\n }\n\n private broadcast(msg: IpcPush, channel: 'event' | 'module'): void {\n for (const client of this.clients.values()) {\n if (!client.subscriptions.has(channel)) continue;\n this.send(client, msg);\n }\n }\n}\n","import { randomBytes, timingSafeEqual } from 'node:crypto';\nimport { chmodSync, existsSync, readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { PATHS } from './paths.js';\n\n/**\n * TC-33: the IPC socket is 0660 root:adm so log-reading users can query the\n * daemon without sudo. That is the intended boundary for *reads* — but it also\n * let any adm member send {\"method\":\"shutdown\"} and kill the security daemon.\n *\n * Control methods now need a token the daemon writes at startup, 0600 and\n * root-owned, inside a runtime directory that is no longer group-writable. Read\n * methods are unchanged, so the convenience the group buys is preserved.\n *\n * In user mode everything under ~/.threatcrush already belongs to the user\n * running the daemon, so the token is theirs to read — which is correct.\n */\n\nexport const CONTROL_TOKEN_FILE = join(PATHS.runDir, 'control.token');\n\n/** Called by the daemon at startup. Rotates on every start. */\nexport function issueControlToken(): string {\n const token = randomBytes(32).toString('hex');\n writeFileSync(CONTROL_TOKEN_FILE, token, { mode: 0o600 });\n try {\n chmodSync(CONTROL_TOKEN_FILE, 0o600);\n } catch {\n // best-effort\n }\n return token;\n}\n\n/** Called by the CLI. Returns null when the caller cannot read the file. */\nexport function readControlToken(): string | null {\n if (!existsSync(CONTROL_TOKEN_FILE)) return null;\n try {\n const token = readFileSync(CONTROL_TOKEN_FILE, 'utf-8').trim();\n return token || null;\n } catch {\n // EACCES: the caller is not privileged enough to control the daemon.\n return null;\n }\n}\n\nexport function tokensMatch(expected: string, provided: unknown): boolean {\n if (typeof provided !== 'string' || !provided) return false;\n const a = Buffer.from(expected);\n const b = Buffer.from(provided);\n return a.length === b.length && timingSafeEqual(a, b);\n}\n","import { EventEmitter } from 'node:events';\nimport type { ThreatEvent } from '../types/events.js';\n\nexport interface DaemonEvents {\n event: (event: ThreatEvent) => void;\n alert: (event: ThreatEvent) => void;\n module: (info: { name: string; status: string; detail?: string }) => void;\n}\n\nexport class EventBus extends EventEmitter {\n publish(event: ThreatEvent): void {\n this.emit('event', event);\n if (event.severity === 'high' || event.severity === 'critical') {\n this.emit('alert', event);\n }\n }\n\n announceModule(name: string, status: string, detail?: string): void {\n this.emit('module', { name, status, detail });\n }\n}\n\nexport const bus = new EventBus();\nbus.setMaxListeners(50);\n","import Database from 'better-sqlite3';\nimport type { ThreatEvent } from '../types/events.js';\n\nlet db: Database.Database | null = null;\nlet dbUnavailable = false;\n\nexport function isStateDbAvailable(): boolean {\n return db !== null;\n}\n\nexport function initStateDB(dbPath: string = '/var/lib/threatcrush/state.db'): Database.Database {\n if (db) return db;\n if (dbUnavailable) {\n throw new Error('state db unavailable (previous init failed)');\n }\n\n try {\n try {\n db = new Database(dbPath);\n } catch {\n // Fall back to in-memory if we can't write to the path\n db = new Database(':memory:');\n }\n } catch (err) {\n // Native binding missing or unloadable — mark DB unavailable so callers\n // can degrade gracefully instead of throwing on every IPC request.\n dbUnavailable = true;\n throw err;\n }\n\n db.pragma('journal_mode = WAL');\n\n db.exec(`\n CREATE TABLE IF NOT EXISTS events (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n timestamp TEXT NOT NULL,\n module TEXT NOT NULL,\n category TEXT NOT NULL,\n severity TEXT NOT NULL,\n message TEXT NOT NULL,\n source_ip TEXT,\n details TEXT\n );\n\n CREATE TABLE IF NOT EXISTS module_state (\n module TEXT NOT NULL,\n key TEXT NOT NULL,\n value TEXT,\n PRIMARY KEY (module, key)\n );\n\n CREATE TABLE IF NOT EXISTS stats (\n key TEXT PRIMARY KEY,\n value TEXT NOT NULL,\n updated_at TEXT NOT NULL\n );\n\n CREATE INDEX IF NOT EXISTS idx_events_timestamp ON events(timestamp);\n CREATE INDEX IF NOT EXISTS idx_events_module ON events(module);\n CREATE INDEX IF NOT EXISTS idx_events_severity ON events(severity);\n CREATE INDEX IF NOT EXISTS idx_events_source_ip ON events(source_ip);\n `);\n\n return db;\n}\n\nexport function insertEvent(event: ThreatEvent): number {\n const database = tryDb();\n if (!database) return -1;\n const stmt = database.prepare(`\n INSERT INTO events (timestamp, module, category, severity, message, source_ip, details)\n VALUES (?, ?, ?, ?, ?, ?, ?)\n `);\n const result = stmt.run(\n event.timestamp.toISOString(),\n event.module,\n event.category,\n event.severity,\n event.message,\n event.source_ip || null,\n event.details ? JSON.stringify(event.details) : null,\n );\n return result.lastInsertRowid as number;\n}\n\nfunction tryDb(): Database.Database | null {\n if (db) return db;\n if (dbUnavailable) return null;\n try {\n return initStateDB();\n } catch {\n return null;\n }\n}\n\nexport function getRecentEvents(limit: number = 50): ThreatEvent[] {\n const database = tryDb();\n if (!database) return [];\n const rows = database.prepare(`\n SELECT * FROM events ORDER BY timestamp DESC LIMIT ?\n `).all(limit) as any[];\n return rows.map(rowToEvent);\n}\n\nexport function getEventCount(since?: Date): number {\n const database = tryDb();\n if (!database) return 0;\n if (since) {\n return (database.prepare(`SELECT COUNT(*) as count FROM events WHERE timestamp >= ?`)\n .get(since.toISOString()) as any).count;\n }\n return (database.prepare(`SELECT COUNT(*) as count FROM events`).get() as any).count;\n}\n\nexport function getThreatCount(since?: Date): number {\n const database = tryDb();\n if (!database) return 0;\n const severities = \"('medium','high','critical')\";\n if (since) {\n return (database.prepare(\n `SELECT COUNT(*) as count FROM events WHERE severity IN ${severities} AND timestamp >= ?`\n ).get(since.toISOString()) as any).count;\n }\n return (database.prepare(\n `SELECT COUNT(*) as count FROM events WHERE severity IN ${severities}`\n ).get() as any).count;\n}\n\nexport function getTopSources(limit: number = 10): Array<{ ip: string; count: number }> {\n const database = tryDb();\n if (!database) return [];\n return database.prepare(`\n SELECT source_ip as ip, COUNT(*) as count FROM events\n WHERE source_ip IS NOT NULL\n GROUP BY source_ip ORDER BY count DESC LIMIT ?\n `).all(limit) as any[];\n}\n\nexport function getModuleState(module: string, key: string): unknown {\n const database = db || initStateDB();\n const row = database.prepare(`SELECT value FROM module_state WHERE module = ? AND key = ?`)\n .get(module, key) as any;\n if (!row) return undefined;\n try {\n return JSON.parse(row.value);\n } catch {\n return row.value;\n }\n}\n\nexport function setModuleState(module: string, key: string, value: unknown): void {\n const database = db || initStateDB();\n database.prepare(`\n INSERT OR REPLACE INTO module_state (module, key, value) VALUES (?, ?, ?)\n `).run(module, key, JSON.stringify(value));\n}\n\nfunction rowToEvent(row: any): ThreatEvent {\n return {\n id: row.id,\n timestamp: new Date(row.timestamp),\n module: row.module,\n category: row.category,\n severity: row.severity,\n message: row.message,\n source_ip: row.source_ip,\n details: row.details ? JSON.parse(row.details) : undefined,\n };\n}\n\nexport function closeDB(): void {\n if (db) {\n db.close();\n db = null;\n }\n}\n","import { existsSync, readdirSync, readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport TOML from '@iarna/toml';\nimport type { EventBus } from './event-bus.js';\nimport { PATHS } from './paths.js';\nimport { verifyModuleTrust } from './module-trust.js';\nimport { LogWatcher } from './watchers/log-watcher.js';\nimport { JournalWatcher } from './watchers/journal-watcher.js';\nimport { NetworkMonitor } from '../modules/network-monitor/index.js';\nimport { DnsMonitor } from '../modules/dns-monitor/index.js';\nimport { loadModuleConfigs } from '../core/config.js';\nimport { getModuleState, setModuleState } from '../core/state.js';\nimport type { ModuleConfig, ModuleManifest } from '../types/config.js';\nimport type { ThreatEvent } from '../types/events.js';\nimport type { ModuleAlert, ThreatCrushModule } from '../types/module.js';\n\ninterface HostedModule {\n name: string;\n version: string;\n source: 'builtin' | 'installed';\n status: 'running' | 'loaded' | 'error' | 'disabled';\n events: number;\n detail?: string;\n path?: string;\n config?: ModuleConfig;\n instance?: ThreatCrushModule;\n}\n\nexport class ModuleHost {\n private modules = new Map<string, HostedModule>();\n private logWatcher: LogWatcher | null = null;\n private journalWatcher: JournalWatcher | null = null;\n private networkMonitor: NetworkMonitor | null = null;\n private dnsMonitor: DnsMonitor | null = null;\n\n constructor(private bus: EventBus) {\n bus.on('event', (event) => {\n const mod = this.modules.get(event.module);\n if (mod) mod.events++;\n for (const hosted of this.modules.values()) {\n if (hosted.status !== 'running' || !hosted.instance?.onEvent) continue;\n void hosted.instance.onEvent(event).catch((err) => {\n hosted.status = 'error';\n hosted.detail = `onEvent failed: ${String((err as Error).message || err)}`;\n this.bus.announceModule(hosted.name, 'error', hosted.detail);\n });\n }\n });\n }\n\n async start(): Promise<void> {\n this.registerBuiltins();\n await this.discoverAndStartInstalled();\n\n this.logWatcher = new LogWatcher(this.bus);\n const watched = this.logWatcher.start();\n\n for (const modName of this.logWatcher.activeModules()) {\n const mod = this.modules.get(modName);\n if (mod) {\n mod.status = 'running';\n mod.detail = `watching ${watched.length} log source(s)`;\n this.bus.announceModule(modName, 'running', mod.detail);\n }\n }\n\n this.journalWatcher = new JournalWatcher(this.bus);\n if (this.journalWatcher.start()) {\n const mod = this.modules.get('user-journal');\n if (mod) {\n mod.status = 'running';\n mod.detail = `tailing ${JournalWatcher.scopeArgs().includes('--user') ? 'user journal' : 'system journal'}`;\n this.bus.announceModule('user-journal', 'running', mod.detail);\n }\n }\n\n // Network monitor (PRD 04)\n this.networkMonitor = new NetworkMonitor(this.bus);\n if (this.networkMonitor.start()) {\n const nmod = this.modules.get('network-monitor');\n if (nmod) {\n nmod.status = 'running';\n nmod.detail = 'monitoring connections via conntrack/ss';\n this.bus.announceModule('network-monitor', 'running', nmod.detail);\n }\n }\n\n // DNS monitor (PRD 05)\n this.dnsMonitor = new DnsMonitor(this.bus);\n if (this.dnsMonitor.start()) {\n const dmod = this.modules.get('dns-monitor');\n if (dmod) {\n dmod.status = 'running';\n dmod.detail = 'monitoring DNS queries';\n this.bus.announceModule('dns-monitor', 'running', dmod.detail);\n }\n }\n }\n\n async stop(): Promise<void> {\n this.logWatcher?.stop();\n this.journalWatcher?.stop();\n this.networkMonitor?.stop();\n this.dnsMonitor?.stop();\n for (const mod of this.modules.values()) {\n try {\n if (mod.instance && mod.status === 'running') {\n await mod.instance.stop();\n }\n } catch (err) {\n mod.status = 'error';\n mod.detail = `stop failed: ${String((err as Error).message || err)}`;\n this.bus.announceModule(mod.name, 'error', mod.detail);\n continue;\n }\n mod.status = 'loaded';\n this.bus.announceModule(mod.name, 'stopped');\n }\n }\n\n summary(): Array<{ name: string; status: string; events: number; detail?: string }> {\n return [...this.modules.values()].map((m) => ({\n name: m.name,\n status: m.status,\n events: m.events,\n detail: m.detail,\n }));\n }\n\n private registerBuiltins(): void {\n const builtins: HostedModule[] = [\n { name: 'log-watcher', version: '0.1.0', source: 'builtin', status: 'loaded', events: 0 },\n { name: 'ssh-guard', version: '0.1.0', source: 'builtin', status: 'loaded', events: 0 },\n { name: 'user-journal', version: '0.1.0', source: 'builtin', status: 'loaded', events: 0 },\n { name: 'network-monitor', version: '0.1.0', source: 'builtin', status: 'loaded', events: 0 },\n { name: 'dns-monitor', version: '0.1.0', source: 'builtin', status: 'loaded', events: 0 },\n ];\n for (const m of builtins) this.modules.set(m.name, m);\n }\n\n private async discoverAndStartInstalled(): Promise<void> {\n if (!existsSync(PATHS.moduleDir)) return;\n const configs = loadModuleConfigs(PATHS.confD);\n const entries = readdirSync(PATHS.moduleDir, { withFileTypes: true });\n for (const entry of entries) {\n if (!entry.isDirectory()) continue;\n const manifestPath = join(PATHS.moduleDir, entry.name, 'mod.toml');\n if (!existsSync(manifestPath)) continue;\n try {\n const manifest = TOML.parse(readFileSync(manifestPath, 'utf-8')) as unknown as ModuleManifest;\n const name = manifest.module?.name || entry.name;\n const defaults = manifest.module?.config?.defaults || {};\n const config = {\n enabled: true,\n ...defaults,\n ...(configs.get(name) || {}),\n } as ModuleConfig;\n const hosted: HostedModule = {\n name,\n version: manifest.module?.version || '0.0.0',\n source: 'installed',\n status: config.enabled === false ? 'disabled' : 'loaded',\n events: 0,\n path: join(PATHS.moduleDir, entry.name),\n config,\n };\n this.modules.set(name, hosted);\n if (config.enabled === false) continue;\n await this.startInstalled(hosted);\n } catch (err) {\n const name = entry.name;\n this.modules.set(name, {\n name,\n version: '0.0.0',\n source: 'installed',\n status: 'error',\n events: 0,\n detail: `manifest load failed: ${String((err as Error).message || err)}`,\n path: join(PATHS.moduleDir, entry.name),\n });\n }\n }\n }\n\n private async startInstalled(hosted: HostedModule): Promise<void> {\n const entrypoint = this.installedEntrypoint(hosted.path!);\n if (!entrypoint) {\n hosted.status = 'loaded';\n hosted.detail = 'no built entrypoint found; run npm install && npm run build in the module directory';\n return;\n }\n\n // TC-32: this daemon runs as root, so importing a marketplace module is\n // handing it the machine. Nothing loads without an explicit local trust\n // decision and an unchanged content digest.\n const trust = verifyModuleTrust(hosted.name, hosted.path!);\n if (!trust.ok) {\n hosted.status = 'error';\n hosted.detail = `refusing to load: ${trust.reason}`;\n this.bus.announceModule(hosted.name, 'error', hosted.detail);\n return;\n }\n\n try {\n const imported = await import(pathToFileURL(entrypoint).href);\n const exported = imported.default || imported.module || imported;\n const instance = typeof exported === 'function' ? new exported() : exported;\n if (!this.isThreatCrushModule(instance)) {\n throw new Error('entrypoint does not export a ThreatCrush module');\n }\n\n hosted.instance = instance;\n await instance.init(this.contextFor(hosted));\n await instance.start();\n hosted.status = 'running';\n hosted.detail = `started from ${entrypoint}`;\n this.bus.announceModule(hosted.name, 'running', hosted.detail);\n } catch (err) {\n hosted.status = 'error';\n hosted.detail = String((err as Error).message || err);\n this.bus.announceModule(hosted.name, 'error', hosted.detail);\n }\n }\n\n private installedEntrypoint(modulePath: string): string | null {\n const packageJson = join(modulePath, 'package.json');\n const candidates: string[] = [];\n if (existsSync(packageJson)) {\n try {\n const pkg = JSON.parse(readFileSync(packageJson, 'utf-8')) as { main?: string };\n if (pkg.main) candidates.push(join(modulePath, pkg.main));\n } catch {\n // fall through to conventional paths\n }\n }\n candidates.push(join(modulePath, 'dist', 'index.js'), join(modulePath, 'index.js'));\n return candidates.find((candidate) => existsSync(candidate)) || null;\n }\n\n private isThreatCrushModule(value: unknown): value is ThreatCrushModule {\n return Boolean(\n value &&\n typeof value === 'object' &&\n typeof (value as ThreatCrushModule).init === 'function' &&\n typeof (value as ThreatCrushModule).start === 'function' &&\n typeof (value as ThreatCrushModule).stop === 'function',\n );\n }\n\n private contextFor(hosted: HostedModule) {\n return {\n config: hosted.config || { enabled: true },\n logger: this.loggerFor(hosted.name),\n emit: (event: ThreatEvent) => this.bus.publish(event),\n subscribe: (eventType: string, handler: (event: ThreatEvent) => void) => {\n this.bus.on('event', (event) => {\n if (event.category === eventType || event.module === eventType) handler(event);\n });\n },\n alert: (alert: ModuleAlert) => {\n this.bus.emit('alert', alert.event || {\n timestamp: new Date(),\n module: hosted.name,\n category: 'system',\n severity: alert.severity,\n message: alert.title,\n details: alert.body ? { body: alert.body } : undefined,\n });\n },\n getState: (key: string) => getModuleState(hosted.name, key),\n setState: (key: string, value: unknown) => setModuleState(hosted.name, key, value),\n };\n }\n\n private loggerFor(moduleName: string) {\n return {\n debug: (msg: string, ...args: unknown[]) => console.debug(`[${moduleName}] ${msg}`, ...args),\n info: (msg: string, ...args: unknown[]) => console.info(`[${moduleName}] ${msg}`, ...args),\n warn: (msg: string, ...args: unknown[]) => console.warn(`[${moduleName}] ${msg}`, ...args),\n error: (msg: string, ...args: unknown[]) => console.error(`[${moduleName}] ${msg}`, ...args),\n };\n }\n}\n","import { createHash, verify as verifySignature } from 'node:crypto';\nimport {\n chmodSync,\n existsSync,\n readFileSync,\n readdirSync,\n readlinkSync,\n writeFileSync,\n} from 'node:fs';\nimport { join, relative, sep } from 'node:path';\nimport { PATHS } from './paths.js';\n\n/**\n * TC-32: threatcrushd runs as root and used to `await import()` anything sitting\n * in its module directory. Modules arrive from the public marketplace or an\n * arbitrary Git URL, so publishing a module was equivalent to remote code\n * execution as root on every host that installed it.\n *\n * Loading is now gated on an explicit local decision. A module runs only if the\n * operator trusted it AND its contents still hash to what they trusted. That\n * turns a silent supply-chain compromise into something a human has to approve,\n * and makes post-install tampering fail closed.\n *\n * Ed25519 signatures are verified when a module ships one and publisher keys\n * are pinned; the marketplace does not emit signatures yet, so this is an\n * additional check rather than the primary gate.\n */\n\nconst TRUST_FILE = join(PATHS.configDir, 'trusted-modules.json');\nconst PUBLISHER_KEYS_FILE = join(PATHS.configDir, 'publisher-keys.json');\n\n/** Never contributes to identity: VCS metadata is not executed. */\nconst DIGEST_EXCLUDED_DIRS = new Set(['.git']);\n\nexport interface TrustRecord {\n digest: string;\n trustedAt: string;\n source: string;\n}\n\ninterface TrustFile {\n version: 1;\n modules: Record<string, TrustRecord>;\n}\n\nexport interface TrustVerdict {\n ok: boolean;\n reason?: string;\n}\n\ninterface DigestEntry {\n path: string;\n isSymlink: boolean;\n}\n\nfunction collectFiles(root: string, dir = root, out: DigestEntry[] = []): DigestEntry[] {\n for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) =>\n a.name < b.name ? -1 : a.name > b.name ? 1 : 0,\n )) {\n const full = join(dir, entry.name);\n if (entry.isSymbolicLink()) {\n // Recorded by link target, never followed — see computeModuleDigest.\n out.push({ path: full, isSymlink: true });\n } else if (entry.isDirectory()) {\n if (DIGEST_EXCLUDED_DIRS.has(entry.name)) continue;\n collectFiles(root, full, out);\n } else if (entry.isFile()) {\n out.push({ path: full, isSymlink: false });\n }\n }\n return out;\n}\n\n/**\n * SHA-256 over every file in the module, path included. node_modules is hashed\n * too — a dependency is exactly where hostile code would hide, and skipping it\n * would let an attacker swap a transitive package without breaking the digest.\n * Symlinks are hashed by their target string, not by following them, so a link\n * repointed at /etc/shadow changes the digest instead of reading the file.\n */\nexport function computeModuleDigest(modulePath: string): string {\n const hash = createHash('sha256');\n\n for (const entry of collectFiles(modulePath)) {\n // Normalize to POSIX separators so a digest taken on one platform matches.\n const relPath = relative(modulePath, entry.path).split(sep).join('/');\n hash.update(relPath);\n hash.update('\\0');\n\n if (entry.isSymlink) {\n hash.update('symlink:');\n hash.update(readlinkSync(entry.path));\n } else {\n hash.update('file:');\n hash.update(readFileSync(entry.path));\n }\n hash.update('\\0');\n }\n\n return hash.digest('hex');\n}\n\nfunction readTrustFile(): TrustFile {\n if (!existsSync(TRUST_FILE)) return { version: 1, modules: {} };\n try {\n const parsed = JSON.parse(readFileSync(TRUST_FILE, 'utf-8')) as Partial<TrustFile>;\n if (parsed.version !== 1 || typeof parsed.modules !== 'object' || !parsed.modules) {\n return { version: 1, modules: {} };\n }\n return { version: 1, modules: parsed.modules };\n } catch {\n // A corrupt ledger must not be read as \"everything is trusted\".\n return { version: 1, modules: {} };\n }\n}\n\nfunction writeTrustFile(file: TrustFile): void {\n writeFileSync(TRUST_FILE, JSON.stringify(file, null, 2) + '\\n', { mode: 0o600 });\n try {\n chmodSync(TRUST_FILE, 0o600);\n } catch {\n // best-effort\n }\n}\n\nexport function trustModule(name: string, modulePath: string, source: string): TrustRecord {\n const file = readTrustFile();\n const record: TrustRecord = {\n digest: computeModuleDigest(modulePath),\n trustedAt: new Date().toISOString(),\n source,\n };\n file.modules[name] = record;\n writeTrustFile(file);\n return record;\n}\n\nexport function untrustModule(name: string): boolean {\n const file = readTrustFile();\n if (!file.modules[name]) return false;\n delete file.modules[name];\n writeTrustFile(file);\n return true;\n}\n\nexport function listTrustedModules(): Record<string, TrustRecord> {\n return readTrustFile().modules;\n}\n\n/** Pinned publisher keys, as { keyId: \"<SPKI PEM>\" }. Absent file = none pinned. */\nfunction readPublisherKeys(): Record<string, string> {\n if (!existsSync(PUBLISHER_KEYS_FILE)) return {};\n try {\n const parsed = JSON.parse(readFileSync(PUBLISHER_KEYS_FILE, 'utf-8')) as Record<string, string>;\n return parsed && typeof parsed === 'object' ? parsed : {};\n } catch {\n return {};\n }\n}\n\n/**\n * A module may ship mod.sig: { keyId, signature } (base64) over its digest.\n * When publisher keys are pinned, an unsigned or badly-signed module is\n * rejected outright, whatever the local trust ledger says.\n */\nexport function verifyModuleSignature(modulePath: string, digest: string): TrustVerdict {\n const keys = readPublisherKeys();\n const pinnedKeyIds = Object.keys(keys);\n const sigPath = join(modulePath, 'mod.sig');\n\n if (pinnedKeyIds.length === 0) {\n return { ok: true };\n }\n\n if (!existsSync(sigPath)) {\n return { ok: false, reason: 'publisher keys are pinned but the module ships no mod.sig' };\n }\n\n let parsed: { keyId?: string; signature?: string };\n try {\n parsed = JSON.parse(readFileSync(sigPath, 'utf-8')) as { keyId?: string; signature?: string };\n } catch {\n return { ok: false, reason: 'mod.sig is not valid JSON' };\n }\n\n if (!parsed.keyId || !parsed.signature) {\n return { ok: false, reason: 'mod.sig is missing keyId or signature' };\n }\n\n const publicKey = keys[parsed.keyId];\n if (!publicKey) {\n return { ok: false, reason: `mod.sig references unpinned key \"${parsed.keyId}\"` };\n }\n\n try {\n // Ed25519 takes the message directly (algorithm is null).\n const valid = verifySignature(\n null,\n Buffer.from(digest, 'hex'),\n publicKey,\n Buffer.from(parsed.signature, 'base64'),\n );\n return valid ? { ok: true } : { ok: false, reason: 'mod.sig signature does not match' };\n } catch (err) {\n return { ok: false, reason: `signature check failed: ${String((err as Error).message || err)}` };\n }\n}\n\n/**\n * The gate the daemon calls immediately before importing a module.\n */\nexport function verifyModuleTrust(name: string, modulePath: string): TrustVerdict {\n let digest: string;\n try {\n digest = computeModuleDigest(modulePath);\n } catch (err) {\n return { ok: false, reason: `could not hash module: ${String((err as Error).message || err)}` };\n }\n\n const signature = verifyModuleSignature(modulePath, digest);\n if (!signature.ok) return signature;\n\n const record = readTrustFile().modules[name];\n if (!record) {\n return {\n ok: false,\n reason: `not trusted — review it, then run: threatcrush modules trust ${name}`,\n };\n }\n\n if (record.digest !== digest) {\n return {\n ok: false,\n reason:\n `contents changed since it was trusted on ${record.trustedAt} — ` +\n `re-review it, then run: threatcrush modules trust ${name}`,\n };\n }\n\n return { ok: true };\n}\n","import { existsSync, statSync, createReadStream, accessSync, constants } from 'node:fs';\nimport { createInterface } from 'node:readline';\nimport type { EventBus } from '../event-bus.js';\nimport { autoDetectParser, detectAttackPattern, parseAuthLog, parseNginxLog } from '../../core/log-parser.js';\nimport { insertEvent } from '../../core/state.js';\nimport type { ThreatEvent, EventCategory, EventSeverity } from '../../types/events.js';\n\nexport interface LogSource {\n path: string;\n module: string;\n category: EventCategory;\n}\n\nexport const DEFAULT_SOURCES: LogSource[] = [\n { path: '/var/log/auth.log', module: 'ssh-guard', category: 'auth' },\n { path: '/var/log/secure', module: 'ssh-guard', category: 'auth' },\n { path: '/var/log/nginx/access.log', module: 'log-watcher', category: 'web' },\n { path: '/var/log/syslog', module: 'log-watcher', category: 'system' },\n];\n\nexport class LogWatcher {\n private timers = new Map<string, NodeJS.Timeout>();\n private positions = new Map<string, number>();\n private active = new Set<string>();\n\n constructor(private bus: EventBus, private sources: LogSource[] = DEFAULT_SOURCES) {}\n\n start(): string[] {\n const started: string[] = [];\n for (const src of this.sources) {\n if (!existsSync(src.path)) continue;\n try { accessSync(src.path, constants.R_OK); }\n catch { continue; }\n this.tail(src);\n started.push(src.path);\n }\n return started;\n }\n\n stop(): void {\n for (const t of this.timers.values()) clearInterval(t);\n this.timers.clear();\n this.positions.clear();\n this.active.clear();\n }\n\n activeModules(): string[] {\n return [...this.active];\n }\n\n private tail(src: LogSource): void {\n try {\n this.positions.set(src.path, statSync(src.path).size);\n } catch {\n this.positions.set(src.path, 0);\n }\n\n const timer = setInterval(() => this.poll(src), 1000);\n this.timers.set(src.path, timer);\n this.active.add(src.module);\n }\n\n private poll(src: LogSource): void {\n let stat;\n try { stat = statSync(src.path); } catch { return; }\n const prev = this.positions.get(src.path) ?? 0;\n\n if (stat.size < prev) {\n this.positions.set(src.path, 0); // rotated\n return;\n }\n if (stat.size === prev) return;\n\n const stream = createReadStream(src.path, { start: prev, encoding: 'utf-8' });\n stream.on('error', () => this.positions.set(src.path, stat.size));\n const rl = createInterface({ input: stream });\n rl.on('error', () => {});\n rl.on('line', (line) => {\n if (!line.trim()) return;\n this.process(line, src);\n });\n rl.on('close', () => this.positions.set(src.path, stat.size));\n }\n\n private process(line: string, src: LogSource): void {\n const parsed = autoDetectParser(line);\n if (!parsed) return;\n\n let severity: EventSeverity = 'info';\n let message = line;\n let sourceIp: string | undefined;\n\n if (parsed.source === 'auth') {\n const entry = parseAuthLog(line);\n if (!entry) return;\n sourceIp = entry.fields.ip;\n const msg = entry.fields.message;\n if (/failed password/i.test(msg)) {\n severity = 'high';\n message = `Failed SSH login for ${entry.fields.user || 'unknown'} from ${entry.fields.ip || 'unknown'}`;\n } else if (/invalid user/i.test(msg)) {\n severity = 'high';\n message = `Invalid SSH user: ${entry.fields.user || 'unknown'} from ${entry.fields.ip || 'unknown'}`;\n } else if (/accepted/i.test(msg)) {\n severity = 'info';\n message = `SSH login accepted for ${entry.fields.user || 'unknown'}`;\n } else {\n return;\n }\n } else if (parsed.source === 'nginx') {\n const entry = parseNginxLog(line);\n if (!entry) return;\n sourceIp = entry.fields.ip;\n const status = parseInt(entry.fields.status, 10);\n const attack = detectAttackPattern(entry.fields.path);\n if (attack) {\n severity = 'critical';\n message = `Attack [${attack.toUpperCase()}]: ${entry.fields.method} ${entry.fields.path}`;\n } else if (status >= 500) {\n severity = 'medium';\n message = `Server error ${status}: ${entry.fields.method} ${entry.fields.path}`;\n } else if (status >= 400) {\n severity = 'low';\n message = `Client error ${status}: ${entry.fields.method} ${entry.fields.path}`;\n } else {\n return;\n }\n } else {\n return;\n }\n\n const event: ThreatEvent = {\n timestamp: new Date(),\n module: src.module,\n category: src.category,\n severity,\n message,\n source_ip: sourceIp,\n };\n\n try { insertEvent(event); } catch { /* db optional */ }\n this.bus.publish(event);\n }\n}\n","import type { ParsedLogLine, NginxLogEntry, AuthLogEntry, SyslogEntry } from '../types/events.js';\n\n// Nginx combined log format:\n// 127.0.0.1 - - [04/Apr/2026:12:00:00 +0000] \"GET /path HTTP/1.1\" 200 1234 \"-\" \"Mozilla/5.0\"\nconst NGINX_REGEX = /^(\\S+) \\S+ \\S+ \\[([^\\]]+)\\] \"(\\S+) (\\S+) \\S+\" (\\d{3}) (\\d+) \"[^\"]*\" \"([^\"]*)\"/;\n\n// Auth.log format:\n// Apr 4 12:00:00 hostname sshd[1234]: Failed password for user from 1.2.3.4 port 22 ssh2\nconst AUTH_REGEX = /^(\\w+\\s+\\d+\\s+[\\d:]+)\\s+\\S+\\s+(\\S+?)(?:\\[\\d+\\])?:\\s+(.*)/;\n\n// Syslog format:\n// Apr 4 12:00:00 hostname process[pid]: message\nconst SYSLOG_REGEX = /^(\\w+\\s+\\d+\\s+[\\d:]+)\\s+\\S+\\s+(\\S+?)(?:\\[\\d+\\])?:\\s+(.*)/;\n\n// Extract IP from auth messages\nconst IP_REGEX = /(?:from|FROM)\\s+(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})/;\nconst INVALID_USER_REGEX = /(?:for\\s+invalid\\s+user)\\s+(\\S+?)(?:\\s+from|\\s*$)/;\nconst USER_REGEX = /(?:for|user)\\s+(\\S+?)(?:\\s+from|\\s*$)/;\n\n// Attack pattern signatures\nexport const ATTACK_PATTERNS = {\n sqli: [\n /(?:union\\s+(?:all\\s+)?select)/i,\n /(?:select\\s+.*\\s+from\\s+)/i,\n /(?:insert\\s+into\\s+)/i,\n /(?:drop\\s+(?:table|database))/i,\n /(?:or\\s+1\\s*=\\s*1)/i,\n /(?:'\\s*(?:or|and)\\s+')/i,\n /(?:--\\s*$|;\\s*--)/,\n /(?:\\/\\*.*\\*\\/)/,\n ],\n xss: [\n /<script[^>]*>/i,\n /javascript\\s*:/i,\n /on(?:load|error|click|mouseover)\\s*=/i,\n /eval\\s*\\(/i,\n /document\\.(?:cookie|write|location)/i,\n ],\n path_traversal: [\n /\\.\\.\\//,\n /\\.\\.\\\\/, \n /etc\\/(?:passwd|shadow|hosts)/,\n /proc\\/self/,\n /windows\\/system32/i,\n ],\n rfi: [\n /(?:https?|ftp):\\/\\/.*\\?/i,\n /php:\\/\\/(?:input|filter)/i,\n /data:\\/\\//i,\n ],\n};\n\nexport function parseNginxLog(line: string): NginxLogEntry | null {\n const match = line.match(NGINX_REGEX);\n if (!match) return null;\n\n return {\n timestamp: parseNginxTimestamp(match[2]),\n raw: line,\n source: 'nginx',\n fields: {\n ip: match[1],\n method: match[3],\n path: match[4],\n status: match[5],\n size: match[6],\n user_agent: match[7],\n },\n };\n}\n\nexport function parseAuthLog(line: string): AuthLogEntry | null {\n const match = line.match(AUTH_REGEX);\n if (!match) return null;\n\n const ipMatch = match[3].match(IP_REGEX);\n const userMatch = match[3].match(INVALID_USER_REGEX) || match[3].match(USER_REGEX);\n\n return {\n timestamp: parseSyslogTimestamp(match[1]),\n raw: line,\n source: 'auth',\n fields: {\n process: match[2],\n message: match[3],\n ip: ipMatch?.[1],\n user: userMatch?.[1],\n },\n };\n}\n\nexport function parseSyslog(line: string): SyslogEntry | null {\n const match = line.match(SYSLOG_REGEX);\n if (!match) return null;\n\n return {\n timestamp: parseSyslogTimestamp(match[1]),\n raw: line,\n source: 'syslog',\n fields: {\n facility: 'syslog',\n process: match[2],\n message: match[3],\n },\n };\n}\n\nexport function detectAttackPattern(path: string): string | null {\n // nginx logs the request URI URL-encoded, so raw signatures like `<script`\n // or `or 1=1` never match an encoded payload (e.g. `%3Cscript%3E`,\n // `%27%20OR%201=1`). Test the raw value AND its URL-decoded forms so that\n // single- and double-encoded payloads are still caught. decodeURIComponent\n // throws on a malformed `%` sequence, so guard each decode.\n const candidates = new Set<string>([path]);\n let current = path;\n for (let i = 0; i < 2; i++) {\n let decoded: string | null = null;\n try {\n decoded = decodeURIComponent(current);\n } catch {\n decoded = null;\n }\n if (decoded === null || decoded === current) break;\n candidates.add(decoded);\n current = decoded;\n }\n\n for (const [type, patterns] of Object.entries(ATTACK_PATTERNS)) {\n for (const pattern of patterns) {\n for (const candidate of candidates) {\n if (pattern.test(candidate)) {\n return type;\n }\n }\n }\n }\n return null;\n}\n\nexport function autoDetectParser(line: string): ParsedLogLine | null {\n // Try nginx first (most specific format)\n const nginx = parseNginxLog(line);\n if (nginx) return nginx;\n\n // Try auth log\n const auth = parseAuthLog(line);\n if (auth) return auth;\n\n // Fall back to generic syslog\n return parseSyslog(line);\n}\n\nfunction parseNginxTimestamp(s: string): Date {\n // \"04/Apr/2026:12:00:00 +0000\"\n // new Date(<unparseable>) returns an Invalid Date instead of throwing, so the\n // old try/catch never triggered and an Invalid Date leaked into downstream\n // time-window logic. Check getTime() explicitly and fall back to now.\n const cleaned = s.replace(/(\\d{2})\\/(\\w{3})\\/(\\d{4}):/, '$2 $1, $3 ');\n const d = new Date(cleaned);\n return Number.isNaN(d.getTime()) ? new Date() : d;\n}\n\nfunction parseSyslogTimestamp(s: string): Date {\n // \"Apr 4 12:00:00\" — no year. Assume the most recent year that is not in the\n // future, so a December log parsed in early January is dated to the previous\n // year rather than the current one.\n const now = new Date();\n let d = new Date(`${s} ${now.getFullYear()}`);\n if (Number.isNaN(d.getTime())) return now;\n if (d.getTime() > now.getTime()) {\n const prev = new Date(`${s} ${now.getFullYear() - 1}`);\n if (!Number.isNaN(prev.getTime())) d = prev;\n }\n return d;\n}\n","import { spawn, type ChildProcess, spawnSync } from 'node:child_process';\nimport type { EventBus } from '../event-bus.js';\nimport { insertEvent } from '../../core/state.js';\nimport type { ThreatEvent, EventSeverity } from '../../types/events.js';\n\n// Wraps `journalctl --user -o json -f` so threatcrushd can pick up user-session\n// events without needing to belong to the `adm` or `systemd-journal` group.\n// On systems without journalctl this watcher is a no-op.\nexport class JournalWatcher {\n private proc: ChildProcess | null = null;\n private buffer = '';\n private moduleName = 'user-journal';\n private active = false;\n\n constructor(private bus: EventBus) {}\n\n // When the daemon runs as root (system mode), tail the SYSTEM journal so\n // we pick up sshd / sudo / kernel / UFW events. Falling back to --user\n // would give us root's mostly-empty per-user journal. Otherwise we use\n // --user so the daemon can run unprivileged on a workstation.\n static scopeArgs(): string[] {\n const isRoot = process.platform === 'linux'\n && typeof process.getuid === 'function'\n && process.getuid() === 0;\n return isRoot ? [] : ['--user'];\n }\n\n static isAvailable(): boolean {\n const probe = spawnSync('journalctl', [...this.scopeArgs(), '-n', '0', '--no-pager'], {\n stdio: ['ignore', 'ignore', 'ignore'],\n });\n return probe.status === 0;\n }\n\n start(): boolean {\n if (!JournalWatcher.isAvailable()) return false;\n\n const child = spawn(\n 'journalctl',\n [...JournalWatcher.scopeArgs(), '-o', 'json', '-f', '--since', 'now'],\n { stdio: ['ignore', 'pipe', 'pipe'] },\n );\n if (!child.stdout) return false;\n child.stdout.setEncoding('utf-8');\n child.stdout.on('data', (chunk: string) => this.onData(chunk));\n child.on('exit', () => {\n this.proc = null;\n this.active = false;\n });\n this.proc = child;\n\n this.active = true;\n return true;\n }\n\n stop(): void {\n if (this.proc) {\n try { this.proc.kill('SIGTERM'); } catch {}\n this.proc = null;\n }\n this.active = false;\n }\n\n isActive(): boolean {\n return this.active;\n }\n\n moduleNameValue(): string {\n return this.moduleName;\n }\n\n private onData(chunk: string): void {\n this.buffer += chunk;\n let idx;\n while ((idx = this.buffer.indexOf('\\n')) >= 0) {\n const line = this.buffer.slice(0, idx);\n this.buffer = this.buffer.slice(idx + 1);\n if (!line.trim()) continue;\n this.handleLine(line);\n }\n }\n\n private handleLine(line: string): void {\n let entry: Record<string, string>;\n try {\n entry = JSON.parse(line) as Record<string, string>;\n } catch {\n return;\n }\n\n const message = entry.MESSAGE;\n if (!message) return;\n\n const priority = parseInt(entry.PRIORITY ?? '6', 10);\n const severity = priorityToSeverity(priority);\n\n // Surface a couple of common suspicious-looking sources at a higher\n // severity even if the kernel disagrees with us.\n const ident = entry.SYSLOG_IDENTIFIER || entry._COMM || 'journal';\n const bumpedSeverity = bumpForIdent(ident, message, severity);\n\n const event: ThreatEvent = {\n timestamp: realtimeToDate(entry.__REALTIME_TIMESTAMP) || new Date(),\n module: this.moduleName,\n category: 'system',\n severity: bumpedSeverity,\n message: `[${ident}] ${message}`.slice(0, 500),\n };\n\n try { insertEvent(event); } catch { /* db optional */ }\n this.bus.publish(event);\n }\n}\n\nfunction priorityToSeverity(priority: number): EventSeverity {\n // syslog priorities: 0 emerg, 1 alert, 2 crit, 3 err, 4 warning, 5 notice, 6 info, 7 debug\n if (priority <= 2) return 'critical';\n if (priority === 3) return 'high';\n if (priority === 4) return 'medium';\n if (priority === 5) return 'low';\n return 'info';\n}\n\nfunction bumpForIdent(ident: string, message: string, base: EventSeverity): EventSeverity {\n if (/sudo/i.test(ident) && /authentication failure|incorrect password|FAILED/i.test(message)) {\n return 'high';\n }\n if (/sshd/i.test(ident) && /failed|invalid user|break-in/i.test(message)) {\n return 'high';\n }\n return base;\n}\n\nfunction realtimeToDate(rt: string | undefined): Date | null {\n if (!rt) return null;\n const us = parseInt(rt, 10);\n if (!Number.isFinite(us)) return null;\n return new Date(Math.floor(us / 1000));\n}\n","/**\n * Network Monitor Module (PRD 04)\n *\n * Observes TCP/UDP connections via conntrack / ss / /proc/net.\n * Detects port scans and SYN-flood-style patterns.\n * Emits detections through the event bus for the rule engine.\n */\n\nimport { spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport type { EventBus } from '../../daemon/event-bus.js';\nimport { insertEvent } from '../../core/state.js';\nimport type { ThreatEvent, EventSeverity } from '../../types/events.js';\n\ninterface ConnectionRecord {\n source_ip: string;\n dest_port: number;\n timestamp: number;\n}\n\ninterface ScanTracker {\n ports: Set<number>;\n firstSeen: number;\n lastSeen: number;\n count: number;\n}\n\nexport class NetworkMonitor {\n private active = false;\n private pollTimer: NodeJS.Timeout | null = null;\n private scanTrackers = new Map<string, ScanTracker>();\n private halfOpenTrackers = new Map<string, { count: number; firstSeen: number }>();\n private lastConnections = new Set<string>();\n\n // Config\n private pollIntervalMs = 5000;\n private portScanThreshold = 10; // unique ports in window\n private portScanWindowMs = 30_000;\n private synFloodThreshold = 50; // half-open connections\n private synFloodWindowMs = 10_000;\n\n constructor(private bus: EventBus) {}\n\n start(): boolean {\n if (!this.hasConntrackOrSs()) {\n return false;\n }\n this.active = true;\n this.pollTimer = setInterval(() => this.poll(), this.pollIntervalMs);\n return true;\n }\n\n stop(): void {\n if (this.pollTimer) clearInterval(this.pollTimer);\n this.pollTimer = null;\n this.active = false;\n }\n\n isActive(): boolean { return this.active; }\n\n private hasConntrackOrSs(): boolean {\n const ss = spawnSync('ss', ['--version'], { stdio: 'pipe' });\n if (ss.status === 0) return true;\n // Try /proc/net/tcp\n return existsSync('/proc/net/tcp');\n }\n\n private poll(): void {\n try {\n const connections = this.getConnections();\n this.analyzePortScans(connections);\n this.analyzeSynFlood(connections);\n this.cleanupTrackers();\n } catch {\n // Graceful degradation\n }\n }\n\n private getConnections(): ConnectionRecord[] {\n const records: ConnectionRecord[] = [];\n const now = Date.now();\n\n try {\n // Try conntrack first\n const ct = spawnSync('conntrack', ['-L', '-p', 'tcp', '-o', 'extended'], {\n encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 3000,\n });\n if (ct.status === 0 && ct.stdout) {\n for (const line of ct.stdout.split('\\n')) {\n const srcMatch = line.match(/src=(\\d+\\.\\d+\\.\\d+\\.\\d+)/);\n const dportMatch = line.match(/dport=(\\d+)/);\n if (srcMatch && dportMatch) {\n records.push({ source_ip: srcMatch[1], dest_port: parseInt(dportMatch[1]), timestamp: now });\n }\n }\n if (records.length > 0) return records;\n }\n } catch { /* fallthrough */ }\n\n try {\n // Fallback to ss\n const ss = spawnSync('ss', ['-tnp', '-H'], {\n encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 3000,\n });\n if (ss.status === 0 && ss.stdout) {\n for (const line of ss.stdout.split('\\n')) {\n // ss output: State Recv-Q Send-Q Local:Port Peer:Port Process\n const parts = line.trim().split(/\\s+/);\n if (parts.length < 5) continue;\n const peerParts = parts[4].split(':');\n const localParts = parts[3].split(':');\n if (peerParts.length >= 2 && localParts.length >= 2) {\n const sourceIp = peerParts.slice(0, -1).join(':');\n const destPort = parseInt(localParts[localParts.length - 1]);\n if (sourceIp && !isNaN(destPort) && !this.isLocalIp(sourceIp)) {\n records.push({ source_ip: sourceIp, dest_port: destPort, timestamp: now });\n }\n }\n }\n }\n } catch { /* fallthrough */ }\n\n return records;\n }\n\n private analyzePortScans(connections: ConnectionRecord[]): void {\n const now = Date.now();\n\n for (const conn of connections) {\n const key = conn.source_ip;\n let tracker = this.scanTrackers.get(key);\n\n if (!tracker) {\n tracker = { ports: new Set(), firstSeen: now, lastSeen: now, count: 0 };\n this.scanTrackers.set(key, tracker);\n }\n\n tracker.ports.add(conn.dest_port);\n tracker.lastSeen = now;\n tracker.count++;\n\n // Check threshold within window\n if (tracker.ports.size >= this.portScanThreshold &&\n (now - tracker.firstSeen) <= this.portScanWindowMs) {\n this.emitEvent(\n 'high',\n `Port scan detected: ${conn.source_ip} probed ${tracker.ports.size} ports in ${Math.round((now - tracker.firstSeen) / 1000)}s`,\n conn.source_ip,\n { ports_scanned: tracker.ports.size, window_seconds: Math.round((now - tracker.firstSeen) / 1000) },\n );\n // Reset tracker after alert\n this.scanTrackers.delete(key);\n }\n }\n }\n\n private analyzeSynFlood(connections: ConnectionRecord[]): void {\n // Count SYN_RECV (half-open) states via ss\n try {\n const ss = spawnSync('ss', ['-tn', 'state', 'syn-recv', '-H'], {\n encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 3000,\n });\n if (ss.status !== 0 || !ss.stdout) return;\n\n const perSource = new Map<string, number>();\n\n for (const line of ss.stdout.split('\\n')) {\n const parts = line.trim().split(/\\s+/);\n if (parts.length < 5) continue;\n const peer = parts[4].split(':');\n const ip = peer.slice(0, -1).join(':');\n if (ip) perSource.set(ip, (perSource.get(ip) || 0) + 1);\n }\n\n for (const [ip, count] of perSource) {\n if (count >= this.synFloodThreshold) {\n this.emitEvent(\n 'critical',\n `SYN flood indicators: ${count} half-open connections from ${ip}`,\n ip,\n { half_open_count: count },\n );\n }\n }\n } catch { /* graceful */ }\n }\n\n private emitEvent(severity: EventSeverity, message: string, sourceIp?: string, details?: Record<string, unknown>): void {\n const event: ThreatEvent = {\n timestamp: new Date(),\n module: 'network-monitor',\n category: 'network',\n severity,\n message,\n source_ip: sourceIp,\n details,\n };\n try { insertEvent(event); } catch { /* db optional */ }\n this.bus.publish(event);\n }\n\n private cleanupTrackers(): void {\n const now = Date.now();\n for (const [key, tracker] of this.scanTrackers) {\n if (now - tracker.lastSeen > this.portScanWindowMs * 2) {\n this.scanTrackers.delete(key);\n }\n }\n }\n\n private isLocalIp(ip: string): boolean {\n return ip === '127.0.0.1' || ip === '::1' || ip === '0.0.0.0' || ip.startsWith('::ffff:127.');\n }\n}\n","/**\n * DNS Monitor Module (PRD 05)\n *\n * Observes DNS query activity for tunneling and DGA indicators.\n * Sources: resolver logs, systemd-resolved, dnsmasq logs, passive :53 observation.\n */\n\nimport { existsSync, statSync, createReadStream, accessSync, constants } from 'node:fs';\nimport { createInterface } from 'node:readline';\nimport type { EventBus } from '../../daemon/event-bus.js';\nimport { insertEvent } from '../../core/state.js';\nimport type { ThreatEvent, EventSeverity } from '../../types/events.js';\n\ninterface DnsQuery {\n domain: string;\n type: string;\n source_ip?: string;\n timestamp: number;\n}\n\nconst DNS_LOG_SOURCES = [\n '/var/log/syslog', // systemd-resolved logs here\n '/var/log/dnsmasq.log', // dnsmasq\n '/var/log/named/queries.log', // bind9\n '/var/log/pihole.log', // Pi-hole\n];\n\nexport class DnsMonitor {\n private active = false;\n private timers = new Map<string, NodeJS.Timeout>();\n private positions = new Map<string, number>();\n\n // Tracking windows\n private txtQueryCounts = new Map<string, { count: number; firstSeen: number }>();\n private domainBuffer: DnsQuery[] = [];\n\n // Config\n private txtRateThreshold = 20; // TXT queries per source per window\n private txtWindowMs = 60_000;\n private dgaBurstThreshold = 15; // unique high-entropy domains per window\n private dgaWindowMs = 60_000;\n private entropyThreshold = 3.5; // Shannon entropy threshold for DGA\n\n constructor(private bus: EventBus) {}\n\n start(): boolean {\n const sources = DNS_LOG_SOURCES.filter(p => {\n if (!existsSync(p)) return false;\n try { accessSync(p, constants.R_OK); return true; }\n catch { return false; }\n });\n\n if (sources.length === 0) return false;\n\n this.active = true;\n for (const src of sources) {\n this.tailLog(src);\n }\n\n // Periodic analysis\n setInterval(() => this.analyzeBuffer(), 10_000);\n return true;\n }\n\n stop(): void {\n for (const t of this.timers.values()) clearInterval(t);\n this.timers.clear();\n this.active = false;\n }\n\n isActive(): boolean { return this.active; }\n\n private tailLog(path: string): void {\n try {\n this.positions.set(path, statSync(path).size);\n } catch {\n this.positions.set(path, 0);\n }\n\n const timer = setInterval(() => this.pollLog(path), 2000);\n this.timers.set(path, timer);\n }\n\n private pollLog(path: string): void {\n let stat;\n try { stat = statSync(path); } catch { return; }\n const prev = this.positions.get(path) ?? 0;\n\n if (stat.size < prev) { this.positions.set(path, 0); return; }\n if (stat.size === prev) return;\n\n const stream = createReadStream(path, { start: prev, encoding: 'utf-8' });\n stream.on('error', () => this.positions.set(path, stat.size));\n const rl = createInterface({ input: stream });\n rl.on('line', (line) => this.parseDnsLine(line));\n rl.on('close', () => this.positions.set(path, stat.size));\n }\n\n private parseDnsLine(line: string): void {\n // systemd-resolved pattern: \"query[TXT] suspicious.domain.com from 192.168.1.1\"\n const resolvedMatch = line.match(/query\\[(\\w+)\\]\\s+(\\S+)\\s+from\\s+(\\S+)/i);\n if (resolvedMatch) {\n this.domainBuffer.push({\n type: resolvedMatch[1],\n domain: resolvedMatch[2],\n source_ip: resolvedMatch[3],\n timestamp: Date.now(),\n });\n return;\n }\n\n // dnsmasq pattern: \"query[TXT] suspicious.domain.com from 192.168.1.1\"\n const dnsmasqMatch = line.match(/query\\[(\\w+)\\]\\s+(\\S+)\\s+from\\s+(\\S+)/i);\n if (dnsmasqMatch) {\n this.domainBuffer.push({\n type: dnsmasqMatch[1],\n domain: dnsmasqMatch[2],\n source_ip: dnsmasqMatch[3],\n timestamp: Date.now(),\n });\n return;\n }\n\n // Generic DNS query log pattern\n const genericMatch = line.match(/(?:query|lookup|resolve)[:\\s]+(\\S+)/i);\n if (genericMatch) {\n const typeMatch = line.match(/type[:\\s]+(\\w+)/i);\n this.domainBuffer.push({\n type: typeMatch?.[1] || 'A',\n domain: genericMatch[1],\n timestamp: Date.now(),\n });\n }\n }\n\n private analyzeBuffer(): void {\n const now = Date.now();\n const cutoff = now - this.txtWindowMs;\n\n // Prune old entries\n this.domainBuffer = this.domainBuffer.filter(q => q.timestamp > cutoff);\n\n this.detectTunneling();\n this.detectDga();\n }\n\n private detectTunneling(): void {\n // Check for high TXT query volume from single source\n const txtBySource = new Map<string, number>();\n const longLabelDomains: string[] = [];\n\n for (const q of this.domainBuffer) {\n if (q.type === 'TXT') {\n const key = q.source_ip || 'unknown';\n txtBySource.set(key, (txtBySource.get(key) || 0) + 1);\n }\n\n // DNS tunneling uses abnormally long subdomain labels\n const labels = q.domain.split('.');\n const maxLabel = Math.max(...labels.map(l => l.length));\n if (maxLabel > 50) {\n longLabelDomains.push(q.domain);\n }\n }\n\n for (const [source, count] of txtBySource) {\n if (count >= this.txtRateThreshold) {\n this.emitEvent(\n 'high',\n `DNS tunneling indicators: ${count} TXT queries from ${source} in ${this.txtWindowMs / 1000}s`,\n source !== 'unknown' ? source : undefined,\n { txt_query_count: count, type: 'tunneling' },\n );\n }\n }\n\n if (longLabelDomains.length >= 5) {\n this.emitEvent(\n 'high',\n `DNS tunneling: ${longLabelDomains.length} queries with abnormally long labels detected`,\n undefined,\n { domains: longLabelDomains.slice(0, 5), type: 'tunneling-labels' },\n );\n }\n }\n\n private detectDga(): void {\n // Find domains with high entropy (DGA-like)\n const highEntropyDomains: string[] = [];\n\n for (const q of this.domainBuffer) {\n const domain = q.domain.toLowerCase();\n // Extract the second-level domain\n const parts = domain.split('.');\n if (parts.length < 2) continue;\n const sld = parts[parts.length - 2];\n\n if (sld.length >= 8 && this.shannonEntropy(sld) >= this.entropyThreshold) {\n highEntropyDomains.push(domain);\n }\n }\n\n // Deduplicate\n const unique = [...new Set(highEntropyDomains)];\n if (unique.length >= this.dgaBurstThreshold) {\n this.emitEvent(\n 'critical',\n `DGA-like domain burst: ${unique.length} unique high-entropy domains detected`,\n undefined,\n { sample_domains: unique.slice(0, 10), type: 'dga', unique_count: unique.length },\n );\n }\n }\n\n private shannonEntropy(str: string): number {\n const freq = new Map<string, number>();\n for (const ch of str) {\n freq.set(ch, (freq.get(ch) || 0) + 1);\n }\n let entropy = 0;\n for (const count of freq.values()) {\n const p = count / str.length;\n if (p > 0) entropy -= p * Math.log2(p);\n }\n return entropy;\n }\n\n private emitEvent(severity: EventSeverity, message: string, sourceIp?: string, details?: Record<string, unknown>): void {\n const event: ThreatEvent = {\n timestamp: new Date(),\n module: 'dns-monitor',\n category: 'network',\n severity,\n message,\n source_ip: sourceIp,\n details,\n };\n try { insertEvent(event); } catch { /* db optional */ }\n this.bus.publish(event);\n }\n}\n","import { readFileSync, existsSync, readdirSync } from 'node:fs';\nimport { join } from 'node:path';\nimport TOML from '@iarna/toml';\nimport type { ThreatCrushConfig, ModuleConfig } from '../types/config.js';\n\nconst DEFAULT_CONFIG_PATH = '/etc/threatcrush/threatcrushd.conf';\nconst DEFAULT_CONFDIR = '/etc/threatcrush/threatcrushd.conf.d';\n\nconst DEFAULT_CONFIG: ThreatCrushConfig = {\n daemon: {\n pid_file: '/var/run/threatcrush/threatcrushd.pid',\n log_level: 'info',\n log_file: '/var/log/threatcrush/threatcrushd.log',\n state_db: '/var/lib/threatcrush/state.db',\n },\n api: {\n enabled: true,\n bind: '127.0.0.1:9393',\n tls: false,\n },\n alerts: {},\n modules: {\n auto_update: true,\n update_interval: '24h',\n module_dir: '/etc/threatcrush/modules',\n config_dir: DEFAULT_CONFDIR,\n },\n};\n\nexport function loadConfig(configPath?: string): ThreatCrushConfig {\n const path = configPath || DEFAULT_CONFIG_PATH;\n if (!existsSync(path)) {\n return { ...DEFAULT_CONFIG };\n }\n\n try {\n const raw = readFileSync(path, 'utf-8');\n const parsed = TOML.parse(raw) as unknown as Partial<ThreatCrushConfig>;\n return {\n daemon: { ...DEFAULT_CONFIG.daemon, ...parsed.daemon },\n api: { ...DEFAULT_CONFIG.api, ...parsed.api },\n alerts: parsed.alerts || {},\n modules: { ...DEFAULT_CONFIG.modules, ...parsed.modules },\n license: parsed.license,\n };\n } catch {\n return { ...DEFAULT_CONFIG };\n }\n}\n\nexport function loadModuleConfigs(confDir?: string): Map<string, ModuleConfig> {\n const dir = confDir || DEFAULT_CONFDIR;\n const configs = new Map<string, ModuleConfig>();\n\n if (!existsSync(dir)) {\n return configs;\n }\n\n const files = readdirSync(dir).filter((f) => f.endsWith('.conf'));\n for (const file of files) {\n try {\n const raw = readFileSync(join(dir, file), 'utf-8');\n const parsed = TOML.parse(raw) as Record<string, unknown>;\n for (const [name, config] of Object.entries(parsed)) {\n configs.set(name, config as ModuleConfig);\n }\n } catch {\n // skip bad configs\n }\n }\n\n return configs;\n}\n\nexport function generateDefaultConfig(detectedServices: string[]): string {\n const config: Record<string, unknown> = {\n daemon: DEFAULT_CONFIG.daemon,\n api: DEFAULT_CONFIG.api,\n modules: DEFAULT_CONFIG.modules,\n };\n\n return TOML.stringify(config as any);\n}\n\nexport function generateModuleConfig(\n moduleName: string,\n defaults: Record<string, unknown> = {},\n): string {\n const config: Record<string, unknown> = {\n [moduleName]: {\n enabled: true,\n ...defaults,\n },\n };\n return TOML.stringify(config as any);\n}\n","import type { ThreatEvent } from '../../types/events.js';\n\ntype Mailer = {\n sendMail: (opts: Record<string, unknown>) => Promise<unknown>;\n};\n\nlet transporter: Mailer | null = null;\n// Lazy-load nodemailer so the CLI build doesn't pull it in when alerts are off.\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nlet nodemailer: any = null;\n\nexport interface SmtpConfig {\n host?: string;\n port?: number;\n secure?: boolean;\n user?: string;\n pass?: string;\n from?: string;\n to?: string[] | string;\n min_severity?: 'low' | 'medium' | 'high' | 'critical';\n}\n\nconst SEVERITY_RANK: Record<string, number> = {\n info: 0,\n low: 1,\n medium: 2,\n high: 3,\n critical: 4,\n};\n\nasync function ensureTransporter(config: SmtpConfig): Promise<Mailer | null> {\n if (!config.host || !config.from) return null;\n if (transporter) return transporter;\n\n if (!nodemailer) {\n try {\n nodemailer = await import('nodemailer');\n } catch {\n return null;\n }\n }\n\n transporter = nodemailer.createTransport({\n host: config.host,\n port: config.port ?? 587,\n secure: config.secure ?? false,\n auth: config.user && config.pass ? { user: config.user, pass: config.pass } : undefined,\n });\n return transporter;\n}\n\nfunction meetsSeverity(event: ThreatEvent, min?: SmtpConfig['min_severity']): boolean {\n if (!min) return true;\n return (SEVERITY_RANK[event.severity] ?? 0) >= (SEVERITY_RANK[min] ?? 0);\n}\n\nfunction renderBody(event: ThreatEvent): { text: string; html: string } {\n const ts = event.timestamp.toISOString();\n const ip = event.source_ip ? `\\nSource IP: ${event.source_ip}` : '';\n const text =\n `[${event.severity.toUpperCase()}] ${event.module}\\n\\n` +\n `${event.message}${ip}\\n\\n` +\n `When: ${ts}\\nCategory: ${event.category}`;\n const html =\n `<div style=\"font-family:system-ui,sans-serif;line-height:1.5\">` +\n `<h2 style=\"margin:0 0 8px\">⚠ ${event.severity.toUpperCase()} — ${event.module}</h2>` +\n `<p>${event.message}</p>` +\n (event.source_ip ? `<p><strong>Source IP:</strong> <code>${event.source_ip}</code></p>` : '') +\n `<p style=\"color:#888;margin-top:16px\"><small>${ts} · ${event.category}</small></p>` +\n `</div>`;\n return { text, html };\n}\n\nexport function smtpChannel(config: SmtpConfig): (event: ThreatEvent) => Promise<void> {\n return async (event) => {\n if (!meetsSeverity(event, config.min_severity)) return;\n const t = await ensureTransporter(config);\n if (!t) return;\n\n const to = Array.isArray(config.to) ? config.to.join(', ') : config.to;\n if (!to) return;\n\n const { text, html } = renderBody(event);\n await t.sendMail({\n from: config.from,\n to,\n subject: `[ThreatCrush ${event.severity}] ${event.module} — ${event.message.slice(0, 60)}`,\n text,\n html,\n });\n };\n}\n","import type { ThreatEvent } from '../../types/events.js';\n\nexport interface DiscordConfig {\n webhook_url: string;\n min_severity?: 'low' | 'medium' | 'high' | 'critical';\n}\n\nconst SEVERITY_RANK: Record<string, number> = {\n info: 0, low: 1, medium: 2, high: 3, critical: 4,\n};\n\nconst SEVERITY_COLORS: Record<string, number> = {\n info: 0x2ecc71, // green\n low: 0x3498db, // blue\n medium: 0xf39c12, // orange\n high: 0xe74c3c, // red\n critical: 0x9b59b6, // purple\n};\n\nexport function discordChannel(config: DiscordConfig): (event: ThreatEvent) => Promise<void> {\n return async (event) => {\n if (config.min_severity) {\n const eventRank = SEVERITY_RANK[event.severity] ?? 0;\n const minRank = SEVERITY_RANK[config.min_severity] ?? 0;\n if (eventRank < minRank) return;\n }\n\n const embed = {\n title: `${event.severity === 'critical' ? '🚨' : '⚠️'} [${event.severity.toUpperCase()}] ${event.module}`,\n description: event.message,\n color: SEVERITY_COLORS[event.severity] ?? 0xffffff,\n fields: [\n ...(event.source_ip ? [{ name: 'Source IP', value: `\\`${event.source_ip}\\``, inline: true }] : []),\n { name: 'Category', value: event.category, inline: true },\n { name: 'Time', value: event.timestamp.toISOString(), inline: true },\n ],\n footer: { text: 'ThreatCrush Security Alert' },\n };\n\n await fetch(config.webhook_url, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ embeds: [embed] }),\n });\n };\n}\n","import type { ThreatEvent } from '../../types/events.js';\n\nexport interface PagerDutyConfig {\n routing_key: string;\n min_severity?: 'low' | 'medium' | 'high' | 'critical';\n}\n\nconst SEVERITY_RANK: Record<string, number> = {\n info: 0, low: 1, medium: 2, high: 3, critical: 4,\n};\n\n// Map ThreatCrush severity to PagerDuty severity\nconst PD_SEVERITY: Record<string, string> = {\n info: 'info',\n low: 'info',\n medium: 'warning',\n high: 'error',\n critical: 'critical',\n};\n\nexport function pagerdutyChannel(config: PagerDutyConfig): (event: ThreatEvent) => Promise<void> {\n return async (event) => {\n if (config.min_severity) {\n const eventRank = SEVERITY_RANK[event.severity] ?? 0;\n const minRank = SEVERITY_RANK[config.min_severity] ?? 0;\n if (eventRank < minRank) return;\n }\n\n const payload = {\n routing_key: config.routing_key,\n event_action: 'trigger',\n payload: {\n summary: `[${event.severity.toUpperCase()}] ${event.module}: ${event.message}`,\n source: 'threatcrush',\n severity: PD_SEVERITY[event.severity] || 'warning',\n timestamp: event.timestamp.toISOString(),\n custom_details: {\n module: event.module,\n category: event.category,\n source_ip: event.source_ip,\n details: event.details,\n },\n },\n };\n\n await fetch('https://events.pagerduty.com/v2/enqueue', {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify(payload),\n });\n };\n}\n","import type { ThreatCrushConfig, AlertChannelConfig } from '../../types/config.js';\nimport type { ThreatEvent } from '../../types/events.js';\nimport type { EventBus } from '../event-bus.js';\nimport { smtpChannel, type SmtpConfig } from './smtp.js';\nimport { discordChannel, type DiscordConfig } from './discord.js';\nimport { pagerdutyChannel, type PagerDutyConfig } from './pagerduty.js';\n\ntype Channel = (event: ThreatEvent) => Promise<void>;\n\nexport class AlertDispatcher {\n private channels: Channel[] = [];\n private rateLimits = new Map<string, number[]>();\n\n constructor(private bus: EventBus, private config: ThreatCrushConfig) {\n this.bindChannels();\n bus.on('alert', (event) => { void this.dispatch(event); });\n }\n\n private bindChannels(): void {\n const alerts = this.config.alerts || {};\n for (const [name, raw] of Object.entries(alerts)) {\n const cfg = raw as AlertChannelConfig;\n if (!cfg.enabled) continue;\n if (name === 'webhook' && typeof cfg.url === 'string') {\n this.channels.push(webhookChannel(cfg.url, cfg.secret as string | undefined));\n }\n if (name === 'slack' && typeof cfg.webhook_url === 'string') {\n this.channels.push(slackChannel(cfg.webhook_url));\n }\n if (name === 'email' && typeof cfg.host === 'string' && typeof cfg.from === 'string') {\n this.channels.push(smtpChannel(cfg as unknown as SmtpConfig));\n }\n if (name === 'discord' && typeof cfg.webhook_url === 'string') {\n this.channels.push(discordChannel(cfg as unknown as DiscordConfig));\n }\n if (name === 'pagerduty' && typeof cfg.routing_key === 'string') {\n this.channels.push(pagerdutyChannel(cfg as unknown as PagerDutyConfig));\n }\n }\n }\n\n private checkRateLimit(channelIdx: number, maxPerHour: number = 60): boolean {\n const key = String(channelIdx);\n const now = Date.now();\n const hour = 3600_000;\n let timestamps = this.rateLimits.get(key) || [];\n timestamps = timestamps.filter(t => t > now - hour);\n if (timestamps.length >= maxPerHour) return false;\n timestamps.push(now);\n this.rateLimits.set(key, timestamps);\n return true;\n }\n\n private async dispatch(event: ThreatEvent): Promise<void> {\n await Promise.all(this.channels.map((ch, idx) => {\n if (!this.checkRateLimit(idx)) return Promise.resolve();\n return ch(event).catch(() => {});\n }));\n }\n}\n\nfunction webhookChannel(url: string, secret?: string): Channel {\n return async (event) => {\n const body = JSON.stringify({ event });\n const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n if (secret) headers['X-Threatcrush-Signature'] = secret;\n await fetch(url, { method: 'POST', headers, body });\n };\n}\n\nfunction slackChannel(webhookUrl: string): Channel {\n return async (event) => {\n const emoji = event.severity === 'critical' ? ':rotating_light:' : ':warning:';\n const text = `${emoji} *[${event.severity.toUpperCase()}]* \\`${event.module}\\` — ${event.message}${event.source_ip ? ` (from ${event.source_ip})` : ''}`;\n await fetch(webhookUrl, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ text }),\n });\n };\n}\n","import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\n\nexport const CLI_CONFIG_DIR = join(homedir(), '.threatcrush');\nexport const CLI_CONFIG_PATH = join(CLI_CONFIG_DIR, 'config.json');\n\nexport interface CliConfig {\n email?: string;\n user_id?: string;\n token?: string;\n refresh_token?: string;\n expires_at?: number;\n display_name?: string;\n current_org_id?: string;\n current_org_slug?: string;\n}\n\nexport function readCliConfig(): CliConfig {\n try {\n return JSON.parse(readFileSync(CLI_CONFIG_PATH, 'utf-8')) as CliConfig;\n } catch {\n return {};\n }\n}\n\nexport function writeCliConfig(config: CliConfig): void {\n if (!existsSync(CLI_CONFIG_DIR)) mkdirSync(CLI_CONFIG_DIR, { recursive: true });\n writeFileSync(CLI_CONFIG_PATH, JSON.stringify(config, null, 2), 'utf-8');\n try { chmodSync(CLI_CONFIG_PATH, 0o600); } catch { /* non-posix */ }\n}\n\nexport function updateCliConfig(patch: Partial<CliConfig>): CliConfig {\n const current = readCliConfig();\n const next = { ...current, ...patch };\n writeCliConfig(next);\n return next;\n}\n\nexport function clearCliConfig(keys?: Array<keyof CliConfig>): void {\n const current = readCliConfig();\n if (!keys) {\n writeCliConfig({});\n return;\n }\n for (const key of keys) delete current[key];\n writeCliConfig(current);\n}\n\nexport function isLoggedIn(): boolean {\n const cfg = readCliConfig();\n if (!cfg.token) return false;\n if (cfg.expires_at && cfg.expires_at * 1000 < Date.now()) return false;\n return true;\n}\n\nexport function authHeaders(): Record<string, string> {\n const cfg = readCliConfig();\n const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n if (cfg.token) headers['Authorization'] = `Bearer ${cfg.token}`;\n return headers;\n}\n","import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { dirname, join, resolve } from 'node:path';\nimport chalk from 'chalk';\nimport ora from 'ora';\nimport { banner, logger } from '../core/logger.js';\nimport type { RunResult, StructuredFinding } from '../core/run-result.js';\nimport { summarize } from '../core/run-result.js';\nimport { meetsFailThreshold, SEVERITY_ORDER } from '@threatcrush/scan';\nimport type { ScanFinding, Severity } from '@threatcrush/scan';\nimport { buildSarif, scanDependencies, scanPath } from '@threatcrush/scan/node';\n\nexport type ScanFormat = 'text' | 'json' | 'sarif';\n\nexport interface ScanCommandOptions {\n /**\n * `text` for humans, `sarif` for the Security tab and coverage validators,\n * `json` for anything else. Non-text formats put the payload on stdout (or\n * `--output`) and every human line on stderr, so\n * `threatcrush scan --format sarif > out.sarif` produces a valid file.\n */\n format?: ScanFormat;\n /** Write the machine-readable payload here instead of stdout. */\n output?: string;\n /** Exit non-zero when a finding at or above one of these severities exists. */\n failOn?: readonly Severity[];\n /** Prefix prepended to SARIF URIs when the scan root is not the repo root. */\n pathPrefix?: string;\n /** Print the paths that could not be read, not just the count. */\n verbose?: boolean;\n /**\n * Query OSV.dev for advisories against the resolved lockfile versions.\n * Off by default in the CLI because it is the only part of a scan that\n * needs the network — a CI job should opt in deliberately rather than\n * discover the dependency mid-run.\n */\n dependencies?: boolean;\n /** Globs to skip, merged with any `.threatcrushignore` at the scan root. */\n exclude?: readonly string[];\n /**\n * Also report security controls the tree shows no evidence of — headers,\n * CSRF, rate limiting, body size limits.\n *\n * Off by default, and deliberately so. Every other finding points at a line;\n * these point at an absence, which a reverse proxy or a gateway may already\n * be covering from outside the repository. Opt-in keeps a normal scan made\n * only of things that are actually there.\n */\n missingControls?: boolean;\n}\n\ninterface ScanOutcome {\n result: RunResult;\n findings: ScanFinding[];\n filesScanned: number;\n unreadable: string[];\n suppressed: number;\n excluded: number;\n root: string;\n}\n\nfunction readVersion(): string {\n for (const candidate of [\n join(__dirname, '..', 'package.json'),\n join(__dirname, '..', '..', 'package.json'),\n ]) {\n try {\n return (\n (JSON.parse(readFileSync(candidate, 'utf-8')) as { version?: string }).version ?? '0.0.0'\n );\n } catch {\n /* try the next candidate */\n }\n }\n return '0.0.0';\n}\n\nconst PKG_VERSION = readVersion();\n\n/** Parse `--fail-on critical,high` into severities, rejecting unknown names. */\nexport function parseFailOn(raw: string | undefined): Severity[] {\n if (!raw) return [];\n const requested = raw\n .split(',')\n .map((part) => part.trim().toLowerCase())\n .filter(Boolean);\n\n const unknown = requested.filter((name) => !SEVERITY_ORDER.includes(name as Severity));\n if (unknown.length > 0) {\n throw new Error(\n `unknown severity in --fail-on: ${unknown.join(', ')} (expected ${SEVERITY_ORDER.join(', ')})`,\n );\n }\n return requested as Severity[];\n}\n\nfunction toRunResult(\n targetPath: string,\n findings: readonly ScanFinding[],\n filesScanned: number,\n): RunResult {\n const structured: StructuredFinding[] = findings.map((finding) => ({\n type: finding.title,\n severity: finding.severity,\n message: finding.message,\n location: `${finding.file}:${finding.line}`,\n details: {\n file: finding.file,\n line: finding.line,\n snippet: finding.excerpt,\n ruleId: finding.ruleId,\n confidence: finding.confidence,\n ...(finding.cwe ? { cwe: finding.cwe } : {}),\n },\n }));\n const counts = summarize(structured);\n\n return {\n type: 'scan',\n target: targetPath,\n findings: structured,\n severity_summary: counts,\n summary:\n findings.length === 0\n ? `No issues found across ${filesScanned} files`\n : `${findings.length} issue(s): ${counts.critical}C ${counts.high}H ${counts.medium}M ${counts.low}L`,\n };\n}\n\nfunction failedResult(targetPath: string, message: string): RunResult {\n return {\n type: 'scan',\n target: targetPath,\n findings: [],\n severity_summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },\n summary: `Scan failed: ${message}`,\n error: message,\n };\n}\n\n/**\n * Non-interactive scan used by the daemon and the runs worker.\n *\n * Includes dependency advisories, as it always has — the daemon runs on a\n * schedule against a server it can reach the network from, and an advisory\n * published since the last run is the main thing that changed.\n */\nexport async function runScan(targetPath: string): Promise<RunResult> {\n try {\n const report = scanPath(targetPath);\n const findings = [...report.findings, ...(await scanDependencies(targetPath))];\n return toRunResult(targetPath, findings, report.filesScanned);\n } catch (err) {\n return failedResult(targetPath, (err as Error).message);\n }\n}\n\nexport async function scanCommand(\n targetPath: string,\n options: ScanCommandOptions = {},\n): Promise<RunResult> {\n const format = options.format ?? 'text';\n const machineReadable = format !== 'text';\n // Human output goes to stderr whenever stdout is carrying a payload. A\n // banner in the middle of a SARIF document is exactly how \"the scan worked\n // but the pipeline reports zero findings\" happens.\n const say = machineReadable\n ? (line: string) => process.stderr.write(`${line}\\n`)\n : (line: string) => process.stdout.write(`${line}\\n`);\n\n if (!existsSync(targetPath)) {\n say(chalk.red(`Scan target does not exist: ${targetPath}`));\n process.exitCode = 2;\n return failedResult(targetPath, `no such path: ${targetPath}`);\n }\n\n if (!machineReadable) {\n banner();\n logger.info(`Scanning ${chalk.white(targetPath)} for security issues...\\n`);\n }\n\n const spinner = machineReadable ? null : ora({ text: 'Scanning files...', color: 'green' }).start();\n\n let outcome: ScanOutcome;\n try {\n let seen = 0;\n const report = scanPath(targetPath, {\n exclude: options.exclude,\n missingControls: options.missingControls,\n onFile: () => {\n seen += 1;\n if (spinner) spinner.text = `Scanning files... (${seen} files)`;\n },\n });\n if (options.dependencies) {\n if (spinner) spinner.text = 'Querying OSV.dev for dependency advisories...';\n report.findings.push(...(await scanDependencies(targetPath)));\n }\n outcome = {\n result: toRunResult(targetPath, report.findings, report.filesScanned),\n findings: report.findings,\n filesScanned: report.filesScanned,\n unreadable: report.unreadable,\n suppressed: report.suppressed,\n excluded: report.excluded,\n root: report.root,\n };\n } catch (err) {\n spinner?.fail(`Scan failed: ${(err as Error).message}`);\n process.exitCode = 2;\n return failedResult(targetPath, (err as Error).message);\n }\n\n spinner?.succeed(`Scanned ${outcome.filesScanned} files\\n`);\n\n if (outcome.unreadable.length > 0) {\n // Surfaced, never swallowed. An unexamined file is not a clean one, and a\n // scanner that hides read failures reports silence as safety.\n say(\n chalk.yellow(\n ` ! ${outcome.unreadable.length} path(s) could not be read and were NOT scanned`,\n ),\n );\n if (options.verbose) {\n for (const path of outcome.unreadable) say(chalk.gray(` ${path}`));\n }\n }\n\n if (outcome.excluded > 0) {\n say(\n chalk.gray(\n ` · ${outcome.excluded} path(s) excluded by --exclude or .threatcrushignore`,\n ),\n );\n }\n\n if (outcome.suppressed > 0) {\n say(\n chalk.gray(\n ` · ${outcome.suppressed} finding(s) suppressed by inline threatcrush-disable comments`,\n ),\n );\n }\n\n if (machineReadable) {\n emitMachineReadable(format, outcome, targetPath, options, say);\n } else {\n printHuman(outcome);\n }\n\n const failOn = options.failOn ?? [];\n if (meetsFailThreshold(outcome.findings, failOn)) {\n say(\n chalk.red(\n `\\n ✗ findings at or above ${[...failOn].join('/')} — failing as requested by --fail-on`,\n ),\n );\n process.exitCode = 1;\n }\n\n return outcome.result;\n}\n\nfunction emitMachineReadable(\n format: ScanFormat,\n outcome: ScanOutcome,\n targetPath: string,\n options: ScanCommandOptions,\n say: (line: string) => void,\n): void {\n const payload =\n format === 'sarif'\n ? buildSarif(outcome.findings, {\n toolVersion: PKG_VERSION,\n pathPrefix: options.pathPrefix,\n // Relative to the working directory, NOT the scan root. `threatcrush\n // scan vulns` from a repo root must emit `vulns/secrets/x.env`, not\n // `secrets/x.env` — the second form matches nothing in the\n // consumer's view of the repository, so every finding lands\n // \"outside\" whatever it scoped to and a working scan reads as 0%.\n // This is the single most expensive mistake in the whole pipeline\n // and it fails silently. `--path-prefix` covers the remaining case:\n // a scan run from inside the subdirectory it is scanning.\n base: process.cwd(),\n root: resolve(outcome.root),\n })\n : {\n tool: 'threatcrush',\n version: PKG_VERSION,\n target: targetPath,\n filesScanned: outcome.filesScanned,\n unreadable: outcome.unreadable,\n suppressed: outcome.suppressed,\n summary: outcome.result.severity_summary,\n findings: outcome.findings,\n };\n\n const serialized = `${JSON.stringify(payload, null, 2)}\\n`;\n\n if (options.output) {\n mkdirSync(dirname(resolve(options.output)), { recursive: true });\n writeFileSync(options.output, serialized, 'utf-8');\n say(\n chalk.gray(\n ` ${format.toUpperCase()} written to ${options.output} (${outcome.findings.length} finding(s))`,\n ),\n );\n return;\n }\n process.stdout.write(serialized);\n}\n\nfunction printHuman(outcome: ScanOutcome): void {\n const { findings, filesScanned } = outcome;\n\n if (findings.length === 0) {\n console.log(chalk.green.bold(' ✓ No security issues found!'));\n console.log();\n return;\n }\n\n const counts = outcome.result.severity_summary;\n console.log(chalk.white.bold(' Scan Results'));\n console.log(chalk.gray(' ' + '─'.repeat(70)));\n console.log(\n ` ${chalk.red.bold(counts.critical + ' critical')} ` +\n `${chalk.red(counts.high + ' high')} ` +\n `${chalk.yellow(counts.medium + ' medium')} ` +\n `${chalk.gray(counts.low + ' low')}`,\n );\n console.log(chalk.gray(' ' + '─'.repeat(70)));\n console.log();\n\n for (const finding of findings) {\n const label = finding.severity.toUpperCase();\n const badge =\n finding.severity === 'critical'\n ? chalk.bgRed.white.bold(` ${label} `)\n : finding.severity === 'high'\n ? chalk.red(`[${label}]`)\n : finding.severity === 'medium'\n ? chalk.yellow(`[${label}]`)\n : chalk.gray(`[${label}]`);\n\n console.log(` ${badge} ${chalk.white.bold(finding.title)}`);\n console.log(\n ` ${chalk.gray('File:')} ${chalk.cyan(finding.file)}:${chalk.yellow(String(finding.line))}`,\n );\n console.log(` ${chalk.gray('Info:')} ${finding.message}`);\n if (finding.consequence) {\n console.log(` ${chalk.gray('Risk:')} ${chalk.dim(finding.consequence)}`);\n }\n if (finding.excerpt) {\n console.log(` ${chalk.gray('Code:')} ${finding.excerpt}`);\n }\n console.log(\n ` ${chalk.gray('Rule:')} ${chalk.dim(finding.ruleId)}` +\n (finding.cwe ? chalk.dim(` · ${finding.cwe}`) : '') +\n chalk.dim(` · confidence: ${finding.confidence}`),\n );\n console.log();\n }\n\n console.log(chalk.gray(' ' + '─'.repeat(70)));\n console.log(\n ` ${chalk.white.bold(`${findings.length} issue(s) found`)} across ${filesScanned} files`,\n );\n console.log();\n}\n","const ANSI_BACKGROUND_OFFSET = 10;\n\nconst wrapAnsi16 = (offset = 0) => code => `\\u001B[${code + offset}m`;\n\nconst wrapAnsi256 = (offset = 0) => code => `\\u001B[${38 + offset};5;${code}m`;\n\nconst wrapAnsi16m = (offset = 0) => (red, green, blue) => `\\u001B[${38 + offset};2;${red};${green};${blue}m`;\n\nconst styles = {\n\tmodifier: {\n\t\treset: [0, 0],\n\t\t// 21 isn't widely supported and 22 does the same thing\n\t\tbold: [1, 22],\n\t\tdim: [2, 22],\n\t\titalic: [3, 23],\n\t\tunderline: [4, 24],\n\t\toverline: [53, 55],\n\t\tinverse: [7, 27],\n\t\thidden: [8, 28],\n\t\tstrikethrough: [9, 29],\n\t},\n\tcolor: {\n\t\tblack: [30, 39],\n\t\tred: [31, 39],\n\t\tgreen: [32, 39],\n\t\tyellow: [33, 39],\n\t\tblue: [34, 39],\n\t\tmagenta: [35, 39],\n\t\tcyan: [36, 39],\n\t\twhite: [37, 39],\n\n\t\t// Bright color\n\t\tblackBright: [90, 39],\n\t\tgray: [90, 39], // Alias of `blackBright`\n\t\tgrey: [90, 39], // Alias of `blackBright`\n\t\tredBright: [91, 39],\n\t\tgreenBright: [92, 39],\n\t\tyellowBright: [93, 39],\n\t\tblueBright: [94, 39],\n\t\tmagentaBright: [95, 39],\n\t\tcyanBright: [96, 39],\n\t\twhiteBright: [97, 39],\n\t},\n\tbgColor: {\n\t\tbgBlack: [40, 49],\n\t\tbgRed: [41, 49],\n\t\tbgGreen: [42, 49],\n\t\tbgYellow: [43, 49],\n\t\tbgBlue: [44, 49],\n\t\tbgMagenta: [45, 49],\n\t\tbgCyan: [46, 49],\n\t\tbgWhite: [47, 49],\n\n\t\t// Bright color\n\t\tbgBlackBright: [100, 49],\n\t\tbgGray: [100, 49], // Alias of `bgBlackBright`\n\t\tbgGrey: [100, 49], // Alias of `bgBlackBright`\n\t\tbgRedBright: [101, 49],\n\t\tbgGreenBright: [102, 49],\n\t\tbgYellowBright: [103, 49],\n\t\tbgBlueBright: [104, 49],\n\t\tbgMagentaBright: [105, 49],\n\t\tbgCyanBright: [106, 49],\n\t\tbgWhiteBright: [107, 49],\n\t},\n};\n\nexport const modifierNames = Object.keys(styles.modifier);\nexport const foregroundColorNames = Object.keys(styles.color);\nexport const backgroundColorNames = Object.keys(styles.bgColor);\nexport const colorNames = [...foregroundColorNames, ...backgroundColorNames];\n\nfunction assembleStyles() {\n\tconst codes = new Map();\n\n\tfor (const [groupName, group] of Object.entries(styles)) {\n\t\tfor (const [styleName, style] of Object.entries(group)) {\n\t\t\tstyles[styleName] = {\n\t\t\t\topen: `\\u001B[${style[0]}m`,\n\t\t\t\tclose: `\\u001B[${style[1]}m`,\n\t\t\t};\n\n\t\t\tgroup[styleName] = styles[styleName];\n\n\t\t\tcodes.set(style[0], style[1]);\n\t\t}\n\n\t\tObject.defineProperty(styles, groupName, {\n\t\t\tvalue: group,\n\t\t\tenumerable: false,\n\t\t});\n\t}\n\n\tObject.defineProperty(styles, 'codes', {\n\t\tvalue: codes,\n\t\tenumerable: false,\n\t});\n\n\tstyles.color.close = '\\u001B[39m';\n\tstyles.bgColor.close = '\\u001B[49m';\n\n\tstyles.color.ansi = wrapAnsi16();\n\tstyles.color.ansi256 = wrapAnsi256();\n\tstyles.color.ansi16m = wrapAnsi16m();\n\tstyles.bgColor.ansi = wrapAnsi16(ANSI_BACKGROUND_OFFSET);\n\tstyles.bgColor.ansi256 = wrapAnsi256(ANSI_BACKGROUND_OFFSET);\n\tstyles.bgColor.ansi16m = wrapAnsi16m(ANSI_BACKGROUND_OFFSET);\n\n\t// From https://github.com/Qix-/color-convert/blob/3f0e0d4e92e235796ccb17f6e85c72094a651f49/conversions.js\n\tObject.defineProperties(styles, {\n\t\trgbToAnsi256: {\n\t\t\tvalue(red, green, blue) {\n\t\t\t\t// We use the extended greyscale palette here, with the exception of\n\t\t\t\t// black and white. normal palette only has 4 greyscale shades.\n\t\t\t\tif (red === green && green === blue) {\n\t\t\t\t\tif (red < 8) {\n\t\t\t\t\t\treturn 16;\n\t\t\t\t\t}\n\n\t\t\t\t\tif (red > 248) {\n\t\t\t\t\t\treturn 231;\n\t\t\t\t\t}\n\n\t\t\t\t\treturn Math.round(((red - 8) / 247) * 24) + 232;\n\t\t\t\t}\n\n\t\t\t\treturn 16\n\t\t\t\t\t+ (36 * Math.round(red / 255 * 5))\n\t\t\t\t\t+ (6 * Math.round(green / 255 * 5))\n\t\t\t\t\t+ Math.round(blue / 255 * 5);\n\t\t\t},\n\t\t\tenumerable: false,\n\t\t},\n\t\thexToRgb: {\n\t\t\tvalue(hex) {\n\t\t\t\tconst matches = /[a-f\\d]{6}|[a-f\\d]{3}/i.exec(hex.toString(16));\n\t\t\t\tif (!matches) {\n\t\t\t\t\treturn [0, 0, 0];\n\t\t\t\t}\n\n\t\t\t\tlet [colorString] = matches;\n\n\t\t\t\tif (colorString.length === 3) {\n\t\t\t\t\tcolorString = [...colorString].map(character => character + character).join('');\n\t\t\t\t}\n\n\t\t\t\tconst integer = Number.parseInt(colorString, 16);\n\n\t\t\t\treturn [\n\t\t\t\t\t/* eslint-disable no-bitwise */\n\t\t\t\t\t(integer >> 16) & 0xFF,\n\t\t\t\t\t(integer >> 8) & 0xFF,\n\t\t\t\t\tinteger & 0xFF,\n\t\t\t\t\t/* eslint-enable no-bitwise */\n\t\t\t\t];\n\t\t\t},\n\t\t\tenumerable: false,\n\t\t},\n\t\thexToAnsi256: {\n\t\t\tvalue: hex => styles.rgbToAnsi256(...styles.hexToRgb(hex)),\n\t\t\tenumerable: false,\n\t\t},\n\t\tansi256ToAnsi: {\n\t\t\tvalue(code) {\n\t\t\t\tif (code < 8) {\n\t\t\t\t\treturn 30 + code;\n\t\t\t\t}\n\n\t\t\t\tif (code < 16) {\n\t\t\t\t\treturn 90 + (code - 8);\n\t\t\t\t}\n\n\t\t\t\tlet red;\n\t\t\t\tlet green;\n\t\t\t\tlet blue;\n\n\t\t\t\tif (code >= 232) {\n\t\t\t\t\tred = (((code - 232) * 10) + 8) / 255;\n\t\t\t\t\tgreen = red;\n\t\t\t\t\tblue = red;\n\t\t\t\t} else {\n\t\t\t\t\tcode -= 16;\n\n\t\t\t\t\tconst remainder = code % 36;\n\n\t\t\t\t\tred = Math.floor(code / 36) / 5;\n\t\t\t\t\tgreen = Math.floor(remainder / 6) / 5;\n\t\t\t\t\tblue = (remainder % 6) / 5;\n\t\t\t\t}\n\n\t\t\t\tconst value = Math.max(red, green, blue) * 2;\n\n\t\t\t\tif (value === 0) {\n\t\t\t\t\treturn 30;\n\t\t\t\t}\n\n\t\t\t\t// eslint-disable-next-line no-bitwise\n\t\t\t\tlet result = 30 + ((Math.round(blue) << 2) | (Math.round(green) << 1) | Math.round(red));\n\n\t\t\t\tif (value === 2) {\n\t\t\t\t\tresult += 60;\n\t\t\t\t}\n\n\t\t\t\treturn result;\n\t\t\t},\n\t\t\tenumerable: false,\n\t\t},\n\t\trgbToAnsi: {\n\t\t\tvalue: (red, green, blue) => styles.ansi256ToAnsi(styles.rgbToAnsi256(red, green, blue)),\n\t\t\tenumerable: false,\n\t\t},\n\t\thexToAnsi: {\n\t\t\tvalue: hex => styles.ansi256ToAnsi(styles.hexToAnsi256(hex)),\n\t\t\tenumerable: false,\n\t\t},\n\t});\n\n\treturn styles;\n}\n\nconst ansiStyles = assembleStyles();\n\nexport default ansiStyles;\n","import process from 'node:process';\nimport os from 'node:os';\nimport tty from 'node:tty';\n\n// From: https://github.com/sindresorhus/has-flag/blob/main/index.js\n/// function hasFlag(flag, argv = globalThis.Deno?.args ?? process.argv) {\nfunction hasFlag(flag, argv = globalThis.Deno ? globalThis.Deno.args : process.argv) {\n\tconst prefix = flag.startsWith('-') ? '' : (flag.length === 1 ? '-' : '--');\n\tconst position = argv.indexOf(prefix + flag);\n\tconst terminatorPosition = argv.indexOf('--');\n\treturn position !== -1 && (terminatorPosition === -1 || position < terminatorPosition);\n}\n\nconst {env} = process;\n\nlet flagForceColor;\nif (\n\thasFlag('no-color')\n\t|| hasFlag('no-colors')\n\t|| hasFlag('color=false')\n\t|| hasFlag('color=never')\n) {\n\tflagForceColor = 0;\n} else if (\n\thasFlag('color')\n\t|| hasFlag('colors')\n\t|| hasFlag('color=true')\n\t|| hasFlag('color=always')\n) {\n\tflagForceColor = 1;\n}\n\nfunction envForceColor() {\n\tif ('FORCE_COLOR' in env) {\n\t\tif (env.FORCE_COLOR === 'true') {\n\t\t\treturn 1;\n\t\t}\n\n\t\tif (env.FORCE_COLOR === 'false') {\n\t\t\treturn 0;\n\t\t}\n\n\t\treturn env.FORCE_COLOR.length === 0 ? 1 : Math.min(Number.parseInt(env.FORCE_COLOR, 10), 3);\n\t}\n}\n\nfunction translateLevel(level) {\n\tif (level === 0) {\n\t\treturn false;\n\t}\n\n\treturn {\n\t\tlevel,\n\t\thasBasic: true,\n\t\thas256: level >= 2,\n\t\thas16m: level >= 3,\n\t};\n}\n\nfunction _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {\n\tconst noFlagForceColor = envForceColor();\n\tif (noFlagForceColor !== undefined) {\n\t\tflagForceColor = noFlagForceColor;\n\t}\n\n\tconst forceColor = sniffFlags ? flagForceColor : noFlagForceColor;\n\n\tif (forceColor === 0) {\n\t\treturn 0;\n\t}\n\n\tif (sniffFlags) {\n\t\tif (hasFlag('color=16m')\n\t\t\t|| hasFlag('color=full')\n\t\t\t|| hasFlag('color=truecolor')) {\n\t\t\treturn 3;\n\t\t}\n\n\t\tif (hasFlag('color=256')) {\n\t\t\treturn 2;\n\t\t}\n\t}\n\n\t// Check for Azure DevOps pipelines.\n\t// Has to be above the `!streamIsTTY` check.\n\tif ('TF_BUILD' in env && 'AGENT_NAME' in env) {\n\t\treturn 1;\n\t}\n\n\tif (haveStream && !streamIsTTY && forceColor === undefined) {\n\t\treturn 0;\n\t}\n\n\tconst min = forceColor || 0;\n\n\tif (env.TERM === 'dumb') {\n\t\treturn min;\n\t}\n\n\tif (process.platform === 'win32') {\n\t\t// Windows 10 build 10586 is the first Windows release that supports 256 colors.\n\t\t// Windows 10 build 14931 is the first release that supports 16m/TrueColor.\n\t\tconst osRelease = os.release().split('.');\n\t\tif (\n\t\t\tNumber(osRelease[0]) >= 10\n\t\t\t&& Number(osRelease[2]) >= 10_586\n\t\t) {\n\t\t\treturn Number(osRelease[2]) >= 14_931 ? 3 : 2;\n\t\t}\n\n\t\treturn 1;\n\t}\n\n\tif ('CI' in env) {\n\t\tif (['GITHUB_ACTIONS', 'GITEA_ACTIONS', 'CIRCLECI'].some(key => key in env)) {\n\t\t\treturn 3;\n\t\t}\n\n\t\tif (['TRAVIS', 'APPVEYOR', 'GITLAB_CI', 'BUILDKITE', 'DRONE'].some(sign => sign in env) || env.CI_NAME === 'codeship') {\n\t\t\treturn 1;\n\t\t}\n\n\t\treturn min;\n\t}\n\n\tif ('TEAMCITY_VERSION' in env) {\n\t\treturn /^(9\\.(0*[1-9]\\d*)\\.|\\d{2,}\\.)/.test(env.TEAMCITY_VERSION) ? 1 : 0;\n\t}\n\n\tif (env.COLORTERM === 'truecolor') {\n\t\treturn 3;\n\t}\n\n\tif (env.TERM === 'xterm-kitty') {\n\t\treturn 3;\n\t}\n\n\tif (env.TERM === 'xterm-ghostty') {\n\t\treturn 3;\n\t}\n\n\tif (env.TERM === 'wezterm') {\n\t\treturn 3;\n\t}\n\n\tif ('TERM_PROGRAM' in env) {\n\t\tconst version = Number.parseInt((env.TERM_PROGRAM_VERSION || '').split('.')[0], 10);\n\n\t\tswitch (env.TERM_PROGRAM) {\n\t\t\tcase 'iTerm.app': {\n\t\t\t\treturn version >= 3 ? 3 : 2;\n\t\t\t}\n\n\t\t\tcase 'Apple_Terminal': {\n\t\t\t\treturn 2;\n\t\t\t}\n\t\t\t// No default\n\t\t}\n\t}\n\n\tif (/-256(color)?$/i.test(env.TERM)) {\n\t\treturn 2;\n\t}\n\n\tif (/^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux/i.test(env.TERM)) {\n\t\treturn 1;\n\t}\n\n\tif ('COLORTERM' in env) {\n\t\treturn 1;\n\t}\n\n\treturn min;\n}\n\nexport function createSupportsColor(stream, options = {}) {\n\tconst level = _supportsColor(stream, {\n\t\tstreamIsTTY: stream && stream.isTTY,\n\t\t...options,\n\t});\n\n\treturn translateLevel(level);\n}\n\nconst supportsColor = {\n\tstdout: createSupportsColor({isTTY: tty.isatty(1)}),\n\tstderr: createSupportsColor({isTTY: tty.isatty(2)}),\n};\n\nexport default supportsColor;\n","// TODO: When targeting Node.js 16, use `String.prototype.replaceAll`.\nexport function stringReplaceAll(string, substring, replacer) {\n\tlet index = string.indexOf(substring);\n\tif (index === -1) {\n\t\treturn string;\n\t}\n\n\tconst substringLength = substring.length;\n\tlet endIndex = 0;\n\tlet returnValue = '';\n\tdo {\n\t\treturnValue += string.slice(endIndex, index) + substring + replacer;\n\t\tendIndex = index + substringLength;\n\t\tindex = string.indexOf(substring, endIndex);\n\t} while (index !== -1);\n\n\treturnValue += string.slice(endIndex);\n\treturn returnValue;\n}\n\nexport function stringEncaseCRLFWithFirstIndex(string, prefix, postfix, index) {\n\tlet endIndex = 0;\n\tlet returnValue = '';\n\tdo {\n\t\tconst gotCR = string[index - 1] === '\\r';\n\t\treturnValue += string.slice(endIndex, (gotCR ? index - 1 : index)) + prefix + (gotCR ? '\\r\\n' : '\\n') + postfix;\n\t\tendIndex = index + 1;\n\t\tindex = string.indexOf('\\n', endIndex);\n\t} while (index !== -1);\n\n\treturnValue += string.slice(endIndex);\n\treturn returnValue;\n}\n","import ansiStyles from '#ansi-styles';\nimport supportsColor from '#supports-color';\nimport { // eslint-disable-line import/order\n\tstringReplaceAll,\n\tstringEncaseCRLFWithFirstIndex,\n} from './utilities.js';\n\nconst {stdout: stdoutColor, stderr: stderrColor} = supportsColor;\n\nconst GENERATOR = Symbol('GENERATOR');\nconst STYLER = Symbol('STYLER');\nconst IS_EMPTY = Symbol('IS_EMPTY');\n\n// `supportsColor.level` → `ansiStyles.color[name]` mapping\nconst levelMapping = [\n\t'ansi',\n\t'ansi',\n\t'ansi256',\n\t'ansi16m',\n];\n\nconst styles = Object.create(null);\n\nconst applyOptions = (object, options = {}) => {\n\tif (options.level && !(Number.isInteger(options.level) && options.level >= 0 && options.level <= 3)) {\n\t\tthrow new Error('The `level` option should be an integer from 0 to 3');\n\t}\n\n\t// Detect level if not set manually\n\tconst colorLevel = stdoutColor ? stdoutColor.level : 0;\n\tobject.level = options.level === undefined ? colorLevel : options.level;\n};\n\nexport class Chalk {\n\tconstructor(options) {\n\t\t// eslint-disable-next-line no-constructor-return\n\t\treturn chalkFactory(options);\n\t}\n}\n\nconst chalkFactory = options => {\n\tconst chalk = (...strings) => strings.join(' ');\n\tapplyOptions(chalk, options);\n\n\tObject.setPrototypeOf(chalk, createChalk.prototype);\n\n\treturn chalk;\n};\n\nfunction createChalk(options) {\n\treturn chalkFactory(options);\n}\n\nObject.setPrototypeOf(createChalk.prototype, Function.prototype);\n\nfor (const [styleName, style] of Object.entries(ansiStyles)) {\n\tstyles[styleName] = {\n\t\tget() {\n\t\t\tconst builder = createBuilder(this, createStyler(style.open, style.close, this[STYLER]), this[IS_EMPTY]);\n\t\t\tObject.defineProperty(this, styleName, {value: builder});\n\t\t\treturn builder;\n\t\t},\n\t};\n}\n\nstyles.visible = {\n\tget() {\n\t\tconst builder = createBuilder(this, this[STYLER], true);\n\t\tObject.defineProperty(this, 'visible', {value: builder});\n\t\treturn builder;\n\t},\n};\n\nconst getModelAnsi = (model, level, type, ...arguments_) => {\n\tif (model === 'rgb') {\n\t\tif (level === 'ansi16m') {\n\t\t\treturn ansiStyles[type].ansi16m(...arguments_);\n\t\t}\n\n\t\tif (level === 'ansi256') {\n\t\t\treturn ansiStyles[type].ansi256(ansiStyles.rgbToAnsi256(...arguments_));\n\t\t}\n\n\t\treturn ansiStyles[type].ansi(ansiStyles.rgbToAnsi(...arguments_));\n\t}\n\n\tif (model === 'hex') {\n\t\treturn getModelAnsi('rgb', level, type, ...ansiStyles.hexToRgb(...arguments_));\n\t}\n\n\treturn ansiStyles[type][model](...arguments_);\n};\n\nconst usedModels = ['rgb', 'hex', 'ansi256'];\n\nfor (const model of usedModels) {\n\tstyles[model] = {\n\t\tget() {\n\t\t\tconst {level} = this;\n\t\t\treturn function (...arguments_) {\n\t\t\t\tconst styler = createStyler(getModelAnsi(model, levelMapping[level], 'color', ...arguments_), ansiStyles.color.close, this[STYLER]);\n\t\t\t\treturn createBuilder(this, styler, this[IS_EMPTY]);\n\t\t\t};\n\t\t},\n\t};\n\n\tconst bgModel = 'bg' + model[0].toUpperCase() + model.slice(1);\n\tstyles[bgModel] = {\n\t\tget() {\n\t\t\tconst {level} = this;\n\t\t\treturn function (...arguments_) {\n\t\t\t\tconst styler = createStyler(getModelAnsi(model, levelMapping[level], 'bgColor', ...arguments_), ansiStyles.bgColor.close, this[STYLER]);\n\t\t\t\treturn createBuilder(this, styler, this[IS_EMPTY]);\n\t\t\t};\n\t\t},\n\t};\n}\n\nconst proto = Object.defineProperties(() => {}, {\n\t...styles,\n\tlevel: {\n\t\tenumerable: true,\n\t\tget() {\n\t\t\treturn this[GENERATOR].level;\n\t\t},\n\t\tset(level) {\n\t\t\tthis[GENERATOR].level = level;\n\t\t},\n\t},\n});\n\nconst createStyler = (open, close, parent) => {\n\tlet openAll;\n\tlet closeAll;\n\tif (parent === undefined) {\n\t\topenAll = open;\n\t\tcloseAll = close;\n\t} else {\n\t\topenAll = parent.openAll + open;\n\t\tcloseAll = close + parent.closeAll;\n\t}\n\n\treturn {\n\t\topen,\n\t\tclose,\n\t\topenAll,\n\t\tcloseAll,\n\t\tparent,\n\t};\n};\n\nconst createBuilder = (self, _styler, _isEmpty) => {\n\t// Single argument is hot path, implicit coercion is faster than anything\n\t// eslint-disable-next-line no-implicit-coercion\n\tconst builder = (...arguments_) => applyStyle(builder, (arguments_.length === 1) ? ('' + arguments_[0]) : arguments_.join(' '));\n\n\t// We alter the prototype because we must return a function, but there is\n\t// no way to create a function with a different prototype\n\tObject.setPrototypeOf(builder, proto);\n\n\tbuilder[GENERATOR] = self;\n\tbuilder[STYLER] = _styler;\n\tbuilder[IS_EMPTY] = _isEmpty;\n\n\treturn builder;\n};\n\nconst applyStyle = (self, string) => {\n\tif (self.level <= 0 || !string) {\n\t\treturn self[IS_EMPTY] ? '' : string;\n\t}\n\n\tlet styler = self[STYLER];\n\n\tif (styler === undefined) {\n\t\treturn string;\n\t}\n\n\tconst {openAll, closeAll} = styler;\n\tif (string.includes('\\u001B')) {\n\t\twhile (styler !== undefined) {\n\t\t\t// Replace any instances already present with a re-opening code\n\t\t\t// otherwise only the part of the string until said closing code\n\t\t\t// will be colored, and the rest will simply be 'plain'.\n\t\t\tstring = stringReplaceAll(string, styler.close, styler.open);\n\n\t\t\tstyler = styler.parent;\n\t\t}\n\t}\n\n\t// We can move both next actions out of loop, because remaining actions in loop won't have\n\t// any/visible effect on parts we add here. Close the styling before a linebreak and reopen\n\t// after next line to fix a bleed issue on macOS: https://github.com/chalk/chalk/pull/92\n\tconst lfIndex = string.indexOf('\\n');\n\tif (lfIndex !== -1) {\n\t\tstring = stringEncaseCRLFWithFirstIndex(string, closeAll, openAll, lfIndex);\n\t}\n\n\treturn openAll + string + closeAll;\n};\n\nObject.defineProperties(createChalk.prototype, styles);\n\nconst chalk = createChalk();\nexport const chalkStderr = createChalk({level: stderrColor ? stderrColor.level : 0});\n\nexport {\n\tmodifierNames,\n\tforegroundColorNames,\n\tbackgroundColorNames,\n\tcolorNames,\n\n\t// TODO: Remove these aliases in the next major version\n\tmodifierNames as modifiers,\n\tforegroundColorNames as foregroundColors,\n\tbackgroundColorNames as backgroundColors,\n\tcolorNames as colors,\n} from './vendor/ansi-styles/index.js';\n\nexport {\n\tstdoutColor as supportsColor,\n\tstderrColor as supportsColorStderr,\n};\n\nexport default chalk;\n","import chalk from 'chalk';\nimport type { EventSeverity } from '../types/events.js';\n\nconst SEVERITY_COLORS: Record<EventSeverity, (s: string) => string> = {\n info: chalk.green,\n low: chalk.cyan,\n medium: chalk.yellow,\n high: chalk.red,\n critical: chalk.bgRed.white.bold,\n};\n\nconst LEVEL_COLORS: Record<string, (s: string) => string> = {\n debug: chalk.gray,\n info: chalk.green,\n warn: chalk.yellow,\n error: chalk.red,\n};\n\nexport function severityColor(severity: EventSeverity, text: string): string {\n return (SEVERITY_COLORS[severity] || chalk.white)(text);\n}\n\nexport function formatTimestamp(date: Date = new Date()): string {\n return chalk.gray(date.toISOString().replace('T', ' ').slice(0, 19));\n}\n\nexport function formatEvent(\n module: string,\n severity: EventSeverity,\n message: string,\n ip?: string,\n): string {\n const ts = formatTimestamp();\n const sev = severityColor(severity, `[${severity.toUpperCase()}]`.padEnd(10));\n const mod = chalk.cyan(`[${module}]`.padEnd(14));\n const src = ip ? chalk.magenta(` (${ip})`) : '';\n return `${ts} ${sev} ${mod} ${message}${src}`;\n}\n\nexport const logger = {\n debug: (msg: string) => console.log(`${formatTimestamp()} ${LEVEL_COLORS.debug('[DEBUG]')} ${msg}`),\n info: (msg: string) => console.log(`${formatTimestamp()} ${LEVEL_COLORS.info('[INFO]')} ${msg}`),\n warn: (msg: string) => console.log(`${formatTimestamp()} ${LEVEL_COLORS.warn('[WARN]')} ${msg}`),\n error: (msg: string) => console.error(`${formatTimestamp()} ${LEVEL_COLORS.error('[ERROR]')} ${msg}`),\n success: (msg: string) => console.log(`${formatTimestamp()} ${chalk.green('[OK]')} ${msg}`),\n threat: (msg: string, ip?: string) => {\n const src = ip ? chalk.magenta(` from ${ip}`) : '';\n console.log(`${formatTimestamp()} ${chalk.red.bold('[THREAT]')} ${chalk.red(msg)}${src}`);\n },\n};\n\nexport function banner(): void {\n console.log(chalk.green.bold(`\n ████████╗██╗ ██╗██████╗ ███████╗ █████╗ ████████╗ ██████╗██████╗ ██╗ ██╗███████╗██╗ ██╗\n ╚══██╔══╝██║ ██║██╔══██╗██╔════╝██╔══██╗╚══██╔══╝██╔════╝██╔══██╗██║ ██║██╔════╝██║ ██║\n ██║ ███████║██████╔╝█████╗ ███████║ ██║ ██║ ██████╔╝██║ ██║███████╗███████║\n ██║ ██╔══██║██╔══██╗██╔══╝ ██╔══██║ ██║ ██║ ██╔══██╗██║ ██║╚════██║██╔══██║\n ██║ ██║ ██║██║ ██║███████╗██║ ██║ ██║ ╚██████╗██║ ██║╚██████╔╝███████║██║ ██║\n ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝ ╚═════╝ ╚══════╝╚═╝ ╚═╝\n `));\n console.log(chalk.gray(' All-in-one security agent daemon — v0.1.0\\n'));\n}\n","import os from 'node:os';\n\nexport type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';\n\nexport interface StructuredFinding {\n type: string;\n severity: Severity;\n message: string;\n location?: string;\n details?: Record<string, unknown>;\n}\n\nexport interface RunResult {\n type: 'scan' | 'pentest';\n target: string;\n findings: StructuredFinding[];\n severity_summary: Record<Severity, number>;\n summary: string;\n error?: string;\n}\n\nexport function emptyCounts(): Record<Severity, number> {\n return { critical: 0, high: 0, medium: 0, low: 0, info: 0 };\n}\n\nexport function summarize(findings: StructuredFinding[]): Record<Severity, number> {\n const counts = emptyCounts();\n for (const f of findings) counts[f.severity] = (counts[f.severity] || 0) + 1;\n return counts;\n}\n\nexport function workerId(): string {\n return `${os.hostname()}/${process.pid}`;\n}\n","/**\n * Node.js-specific vulnerability rules.\n *\n * Why this file exists\n * --------------------\n * `code-rules.ts` is deliberately cross-language: SQL injection, path\n * traversal and weak hashing look much the same in six languages, so one rule\n * covers all of them. That breadth is also its limit. A whole set of classes\n * only exist inside the Node ecosystem — `vm2` sandbox escapes, Electron's\n * renderer settings, `node-serialize`'s function-executing deserialiser, JWT's\n * `none` algorithm, headless-browser navigation — and each one needs to know\n * which package it is looking at before it can say anything useful.\n *\n * Those live here, evaluated by the same engine and obeying the same\n * confidence model. Splitting them out keeps the cross-language table readable\n * and gives the ecosystem-specific rules one place to document their\n * preconditions.\n *\n * Provenance and licence\n * ----------------------\n * The *list of classes* covered here was drawn up by reading what njsscan\n * (github.com/ajinabraham/njsscan) reports on, to close a coverage gap against\n * an established Node scanner. Nothing was copied. njsscan is LGPL-3.0 and\n * this package is MIT, so its rule definitions could not be reused even in\n * translation; a set of vulnerability class names is a fact about the\n * ecosystem, not an expression of it. Every pattern, guard, title and\n * consequence below was written from scratch against this engine's semantics,\n * which are not njsscan's — it delegates to semgrep for AST matching, while\n * these are line-oriented regexes with guard windows and a severity cap.\n *\n * That difference shapes the rules. Where njsscan can write \"this call, inside\n * a file that imported this module, not wrapped in an escaper\", the closest\n * honest equivalent here is `fileRequires` for the import plus a narrow\n * pattern. Classes that genuinely need AST scope — entity-expansion limits,\n * taint through a router — are absent rather than approximated. See KNOWN_GAPS\n * at the foot of this file.\n */\n\nimport type { CodeRule } from './code-rules';\n\n/**\n * A path is being assembled with containment already checked.\n *\n * Zip-slip is the one class in this file where the safe and unsafe forms are\n * the *same call* — `join(dest, entry.fileName)` — distinguished only by\n * whether the result is verified to stay under `dest`. So the guard has to\n * recognise containment checks specifically, which the generic guard does not:\n * a bare `startsWith` is too weak a signal to exonerate arbitrary rules, but\n * next to a path join it is exactly the check that matters.\n */\nconst PATH_CONTAINMENT_GUARD =\n /\\bstartsWith\\s*\\(|\\brelative\\s*\\(|\\bnormalize\\s*\\(|\\brealpath\\b|\\bisInside\\b|\\bwithin\\s*\\(|\\bsanitiz\\w*\\b/i;\n\n/** Packages whose archive entries carry an attacker-chosen path. */\nconst ARCHIVE_LIBRARY =\n /\\b(?:adm-zip|unzipper|yauzl|node-stream-zip|extract-zip|decompress|tar-stream|tar-fs)\\b|require\\s*\\(\\s*['\"]tar['\"]|from\\s+['\"]tar['\"]/;\n\n/** Packages that drive a real browser, where a URL becomes a request from the server. */\nconst HEADLESS_BROWSER =\n /\\b(?:puppeteer|playwright|phantom|phantomjs|wkhtmltopdf|wkhtmltoimage|chrome-aws-lambda|html-pdf)\\b/;\n\n/**\n * Evidence that a reflected origin was checked before being echoed.\n *\n * This rule cannot use the generic guard, and the reason is worth recording.\n * `Access-Control-Allow-Origin` contains the word \"Allow\"; the generic guard's\n * allow-list heuristic is case-insensitive and accepts a following `-`, so the\n * *header name itself* matched it. The rule was silently unable to ever fire —\n * it did not report fewer findings, it reported none, and only a failing test\n * distinguished that from \"no vulnerable code here\".\n *\n * What genuinely exonerates a reflected origin is a membership test on the\n * value, which is also the shape of the one correct implementation.\n */\nconst ORIGIN_ALLOWLIST_GUARD = /\\b(?:includes|indexOf|has|test|find|some)\\s*\\(/;\n\n/** Deserialisers that reconstruct functions, not just data. */\nconst FUNCTION_DESERIALIZER = /\\b(?:node-serialize|serialize-to-js|funcster|cryo)\\b/;\n\n/**\n * A string literal being concatenated onto — either quote style, separately.\n *\n * One character class cannot do this. The interesting strings are the ones\n * containing the *other* quote:\n *\n * \"this.name === '\" + name + \"'\"\n * \"//user[@id='\" + id + \"']\"\n *\n * A combined `['\"][^'\"]*['\"]` class stops dead at that inner quote and matches\n * nothing, which silently drops the most common injection shape. `code-rules.ts`\n * hit this with SQL and split the class per quote character; the same split is\n * needed everywhere a rule looks for assembled strings, so it lives here once.\n */\nconst CONCATENATED_STRING = String.raw`(?:\"[^\"\\n]*\"|'[^'\\n]*')\\s*\\+`;\n\n// A template literal with at least one interpolation. Written as a quoted\n// string rather than with `String.raw`, because the pattern has to contain a\n// backtick and a raw template literal cannot hold one unescaped.\nconst INTERPOLATED_TEMPLATE = '`[^`\\\\n]*\\\\$\\\\{';\n\nexport const NODE_RULES: readonly CodeRule[] = [\n // ── Code execution ───────────────────────────────────────────────────────\n {\n id: 'js-vm-untrusted-execution',\n title: 'script compiled and run by the `vm` module',\n consequence:\n 'Node’s `vm` is not a security boundary — it isolates globals, not the process. Code reaching it can walk back out through any object it is handed and runs with the server’s full privileges.',\n cwe: 'CWE-94',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\bvm\\s*\\.\\s*(?:runInNewContext|runInThisContext|runInContext|compileFunction)\\s*\\(|\\bnew\\s+vm\\s*\\.\\s*Script\\s*\\(/,\n // A `vm` call whose source is a build-time constant is a plugin loader, not\n // a vulnerability. The class only becomes real once the script text can be\n // influenced, so require that evidence before reporting at full severity.\n needsContext: true,\n },\n {\n id: 'js-vm2-sandbox',\n title: '`vm2` used as a sandbox',\n consequence:\n 'vm2 was discontinued after a series of escapes that its maintainer judged unfixable by design. Any code it runs should be assumed to run on the host.',\n cwe: 'CWE-1104',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\bnew\\s+(?:NodeVM|VMScript)\\s*\\(|\\bfrom\\s+['\"]vm2['\"]|require\\s*\\(\\s*['\"]vm2['\"]\\s*\\)/,\n // Nothing on the surrounding lines changes the answer: the package itself\n // is the finding, the same way a broken cipher is.\n inherent: true,\n },\n {\n id: 'js-function-deserialization',\n title: 'deserialiser that reconstructs functions',\n consequence:\n 'These formats encode functions alongside data and invoke them on load, so parsing an attacker’s payload is executing it. No amount of validation after the parse call helps — the code has already run.',\n cwe: 'CWE-502',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern: /\\b(?:unserialize|deepDeserialize|deserialize)\\s*\\(/,\n // Without this the rule fires on every project that happens to own a\n // function called `deserialize`, which is most of them. The import is what\n // makes the call the dangerous one.\n fileRequires: FUNCTION_DESERIALIZER,\n // The parse *is* the execution, so nearby input cannot make it worse and\n // its absence cannot make it safe. Nobody round-trips a constant through\n // these libraries.\n inherent: true,\n },\n {\n id: 'js-template-injection',\n title: 'template compiled from a non-constant source',\n consequence:\n 'Template languages are programming languages. A user-supplied template body is remote code execution, not cross-site scripting — the expression runs on the server before any output is escaped.',\n cwe: 'CWE-1336',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\b(?:handlebars|Handlebars|hbs|ejs|pug|jade|nunjucks|eta|twig|dot|doT|liquid|mustache)\\s*\\.\\s*(?:compile|compileFile|render|renderString)\\s*\\(\\s*(?:`[^`\\n]*\\$\\{|[a-zA-Z_$][\\w$.]*\\s*[,)]|[a-zA-Z_$][\\w$.]*\\s*\\+)/,\n // Rendering a template held in a variable is the normal case — it was read\n // from a file at boot. Only the version where request data reaches the\n // template *body* is this class.\n needsContext: true,\n },\n {\n id: 'js-shelljs-command-execution',\n title: 'shelljs command assembled from a string',\n consequence:\n '`shell.exec` runs its argument through a shell, so a `;` or backtick in an interpolated value runs as the server user.',\n cwe: 'CWE-78',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern: new RegExp(\n `\\\\b(?:shell|shelljs|sh)\\\\s*\\\\.\\\\s*exec\\\\s*\\\\(\\\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING}|[a-zA-Z_$][\\\\w$]*\\\\s*\\\\+)`,\n ),\n fileRequires: /\\bshelljs\\b/,\n },\n\n // ── Injection ────────────────────────────────────────────────────────────\n {\n id: 'js-nosql-where-expression',\n title: 'MongoDB `$where` built by string assembly',\n consequence:\n '`$where` is evaluated as JavaScript by the database server, once per document. An interpolated value can rewrite the predicate to `true` or run a denial-of-service loop inside the database.',\n cwe: 'CWE-943',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern: new RegExp(\n `\\\\$where\\\\s*['\"]?\\\\s*:\\\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING})` +\n `|\\\\.\\\\s*\\\\$where\\\\s*=\\\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING})`,\n ),\n },\n {\n id: 'js-xpath-injection',\n title: 'XPath expression built by concatenation',\n consequence:\n 'A quote in the interpolated value closes the predicate early, so the query selects nodes the caller was never meant to read — the XML equivalent of `OR 1=1`.',\n cwe: 'CWE-643',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n // An XPath expression is recognisable by its own syntax — a descendant\n // axis or an attribute predicate. Matching on the *call* name alone would\n // flag every `select(` in the ecosystem. The quoted forms are split per\n // quote character for the reason given at CONCATENATED_STRING: the\n // predicate that makes it XPath usually contains the other quote.\n pattern: new RegExp(\n '\\\\b(?:xpath|xpathSelect|select|selectNodes|selectSingleNode|evaluate|find)\\\\s*\\\\(\\\\s*(?:' +\n '`[^`\\\\n]*(?:\\\\/\\\\/|\\\\[@)[^`\\\\n]*\\\\$\\\\{' +\n '|\"[^\"\\\\n]*(?:\\\\/\\\\/|\\\\[@)[^\"\\\\n]*\"\\\\s*\\\\+' +\n \"|'[^'\\\\n]*(?:\\\\/\\\\/|\\\\[@)[^'\\\\n]*'\\\\s*\\\\+\" +\n ')',\n ),\n fileRequires: /\\bxpath\\b|\\bxmldom\\b|\\blibxmljs\\b|\\bxpath\\.js\\b/,\n },\n {\n id: 'js-regex-from-input',\n title: 'regular expression compiled from a variable',\n consequence:\n 'A caller who controls the pattern controls the matcher: they can supply catastrophic backtracking to hang the event loop, or a permissive pattern that defeats whatever the regex was validating.',\n cwe: 'CWE-1333',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n pattern: new RegExp(\n `\\\\bnew\\\\s+RegExp\\\\s*\\\\(\\\\s*(?:${INTERPOLATED_TEMPLATE}|${CONCATENATED_STRING}|(?!['\"\\`/])[a-zA-Z_$][\\\\w$.]*\\\\s*[,)])`,\n ),\n needsContext: true,\n },\n\n // ── XML ──────────────────────────────────────────────────────────────────\n {\n id: 'js-xml-external-entities',\n title: 'XML parser configured to resolve entities',\n consequence:\n 'An entity declaration in the document body makes the parser fetch a local file or an internal URL and paste the result into the parsed output — file disclosure and server-side request forgery from a document upload.',\n cwe: 'CWE-611',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n // The option name is the finding. Every parser in the ecosystem defaults\n // these off, so an explicit `true` is a deliberate re-enable.\n pattern: /\\b(?:noent|resolveEntities|expandEntities|externalEntities|resolveExternals)\\s*:\\s*(?:true|1)\\b/,\n inherent: true,\n },\n\n // ── Authentication and tokens ────────────────────────────────────────────\n {\n id: 'js-jwt-none-algorithm',\n title: 'JWT algorithm set to `none`',\n consequence:\n 'The `none` algorithm means the signature is not checked. Anyone can mint a token with any claims — including another user’s id or an admin role — by base64-encoding a header and a body.',\n cwe: 'CWE-347',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern: /\\balgorithms?\\s*:\\s*\\[?\\s*['\"]none['\"]/i,\n inherent: true,\n },\n\n // ── Cryptography ─────────────────────────────────────────────────────────\n {\n id: 'js-broken-cipher-algorithm',\n title: 'broken cipher selected',\n consequence:\n 'DES, 3DES, RC2, RC4, Blowfish and IDEA are all breakable with commodity hardware or have practical plaintext-recovery attacks. Data encrypted with them should be treated as encoded, not encrypted.',\n cwe: 'CWE-327',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\bcreate(?:Cipher|Decipher)(?:iv)?\\s*\\(\\s*['\"](?:des|des3|des-ede\\w*|3des|rc2|rc4|bf|blowfish|cast5?|idea|seed)\\b/i,\n inherent: true,\n },\n {\n id: 'js-ecb-mode-cipher',\n title: 'block cipher in ECB mode',\n consequence:\n 'ECB encrypts every block independently, so identical plaintext blocks produce identical ciphertext. Structure in the data survives encryption and blocks can be reordered or replayed without detection.',\n cwe: 'CWE-327',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\bcreate(?:Cipher|Decipher)(?:iv)?\\s*\\(\\s*['\"][^'\"\\n]*-ecb\\b/i,\n inherent: true,\n },\n {\n id: 'js-legacy-cipher-api',\n title: 'deprecated `createCipher` used',\n consequence:\n '`createCipher` derives the key from a passphrase with a single unsalted MD5 pass and uses a fixed all-zero IV, so the same passphrase always produces the same keystream. It was removed in Node 22.',\n cwe: 'CWE-327',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n // `createCipheriv` is the correct API and shares the prefix, so the\n // negative look-ahead is what separates the finding from the fix.\n pattern: /\\bcrypto\\s*\\.\\s*create(?:Cipher|Decipher)\\s*\\(/,\n lineGuard: /create(?:Cipher|Decipher)iv\\s*\\(/,\n inherent: true,\n },\n\n // ── Cross-site scripting ─────────────────────────────────────────────────\n {\n id: 'js-template-autoescape-disabled',\n title: 'template auto-escaping turned off',\n consequence:\n 'Auto-escaping is the control that makes a template engine safe by default. Disabling it globally means every interpolation in every template becomes an injection point, including ones written later by someone who assumed the default.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\bautoescape\\s*:\\s*false\\b|\\bescape\\s*:\\s*false\\b|\\bnoEscape\\s*:\\s*true\\b/,\n inherent: true,\n },\n {\n id: 'js-serialize-javascript-unsafe',\n title: '`serialize-javascript` in unsafe mode',\n consequence:\n 'The `unsafe` flag turns off escaping of HTML-significant characters in the output. Embedding the result in a `<script>` block lets a string value close the tag and start a new one.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\bunsafe\\s*:\\s*true\\b/,\n fileRequires: /\\bserialize-javascript\\b/,\n inherent: true,\n },\n {\n id: 'js-cors-origin-reflected',\n title: 'CORS origin reflected from the request',\n consequence:\n 'Echoing the caller’s `Origin` header back as `Access-Control-Allow-Origin` allows every site, while looking like an allow-list. Combined with credentials, any page the victim visits can read their authenticated responses.',\n cwe: 'CWE-942',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n // Both spellings of the same mistake: writing the header directly, and\n // handing the request's origin to a CORS middleware's `origin` option.\n //\n // An earlier draft also matched a bare variable — `setHeader('…', origin)`\n // — which is wrong. A variable holding a *validated* origin is exactly\n // what the correct implementation looks like, and the rule cannot tell the\n // two apart. Only the visible read from the request qualifies.\n pattern:\n /\\bAccess-Control-Allow-Origin['\"]\\s*,\\s*(?:req|request|ctx)\\s*\\.|\\borigin\\s*:\\s*(?:req|request|ctx)\\s*\\./,\n // Reflecting the header is the defect whatever surrounds it; there is no\n // arrangement of nearby lines that makes an echoed origin safe — except a\n // membership test on the value, which is what the guard looks for.\n inherent: true,\n guard: ORIGIN_ALLOWLIST_GUARD,\n /**\n * Logging the origin is not reflecting it.\n *\n * `origin: request.headers.origin` is the CORS mistake *and* the ordinary\n * way to record who called — the two are character-for-character\n * identical, and only what encloses them differs. A response header goes\n * out to the browser; a log line goes to stdout, where it grants nobody\n * anything.\n */\n enclosingCallGuard: /(?:^|\\.)(?:log|debug|info|warn|error|trace|verbose|fatal)$/,\n },\n\n // ── Server-side request forgery ──────────────────────────────────────────\n {\n id: 'js-headless-browser-navigation',\n title: 'headless browser sent to a non-constant URL',\n consequence:\n 'The browser runs on the server, inside the private network. A controlled URL reaches the cloud metadata endpoint, localhost admin panels and internal services — and `file://` reads the disk.',\n cwe: 'CWE-918',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\.\\s*(?:goto|setContent|navigate)\\s*\\(\\s*(?:`[^`\\n]*\\$\\{|(?!['\"`])[a-zA-Z_$][\\w$.]*\\s*[,)])/,\n fileRequires: HEADLESS_BROWSER,\n needsContext: true,\n },\n\n // ── Path handling ────────────────────────────────────────────────────────\n {\n id: 'js-archive-entry-path',\n title: 'archive entry written to a path built from its own name',\n consequence:\n 'An entry named `../../etc/cron.d/x` escapes the extraction directory when its name is joined to the destination. Overwriting a file outside the target — a systemd unit, an SSH key, a deployed script — is code execution on the next run.',\n cwe: 'CWE-22',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\b(?:join|resolve)\\s*\\(\\s*[^,\\n)]+,\\s*[a-zA-Z_$][\\w$]*\\s*\\.\\s*(?:entryName|fileName|filename|name|path)\\b/,\n fileRequires: ARCHIVE_LIBRARY,\n guard: PATH_CONTAINMENT_GUARD,\n // The containment check comes *after* the join — you build the path, then\n // verify it stayed inside. A backwards-only window would miss every\n // correct implementation and report the safe code alongside the unsafe.\n guardForward: 3,\n },\n\n // ── Electron ─────────────────────────────────────────────────────────────\n {\n id: 'js-electron-node-integration',\n title: 'Electron renderer given Node access',\n consequence:\n 'With node integration on — or context isolation off — any script that reaches the page reaches `require`. A single XSS in rendered content becomes `child_process.exec` on the user’s machine.',\n cwe: 'CWE-1188',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\bnodeIntegration(?:InWorker|InSubFrames)?\\s*:\\s*true\\b|\\bcontextIsolation\\s*:\\s*false\\b|\\benableRemoteModule\\s*:\\s*true\\b|\\bsandbox\\s*:\\s*false\\b/,\n inherent: true,\n },\n {\n id: 'js-electron-web-security-disabled',\n title: 'Electron web security disabled',\n consequence:\n 'Turning off `webSecurity` drops the same-origin policy for the window, so remote content can read local files and every other origin the app has loaded.',\n cwe: 'CWE-1173',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\bwebSecurity\\s*:\\s*false\\b|\\ballowRunningInsecureContent\\s*:\\s*true\\b|\\bwebviewTag\\s*:\\s*true\\b/,\n inherent: true,\n },\n {\n id: 'js-electron-open-external',\n title: 'Electron `openExternal` with a non-constant URL',\n consequence:\n '`shell.openExternal` hands the string to the operating system’s handler. A `file://` path executes a local binary and, on Windows, an SMB path executes a remote one.',\n cwe: 'CWE-749',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\bshell\\s*\\.\\s*openExternal\\s*\\(\\s*(?:`[^`\\n]*\\$\\{|(?!['\"`])[a-zA-Z_$][\\w$.]*\\s*[,)])/,\n needsContext: true,\n },\n\n // ── Hardening and resource limits ────────────────────────────────────────\n {\n id: 'js-helmet-protection-disabled',\n title: 'security header explicitly disabled',\n consequence:\n 'Each of these switches off a browser-side protection that was already on. The header stops being sent, so the defence it enables — framing, sniffing, referrer leakage, transport downgrade — is available to an attacker again.',\n cwe: 'CWE-693',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\b(?:contentSecurityPolicy|frameguard|hsts|noSniff|xssFilter|hidePoweredBy|referrerPolicy|dnsPrefetchControl|ieNoOpen|permittedCrossDomainPolicies|crossOriginEmbedderPolicy|crossOriginOpenerPolicy|crossOriginResourcePolicy|originAgentCluster)\\s*:\\s*false\\b/,\n inherent: true,\n },\n {\n id: 'js-buffer-bounds-check-disabled',\n title: 'buffer bounds checking turned off',\n consequence:\n 'With `noAssert` the read or write is not range-checked, so an offset past the end of the buffer returns adjacent heap memory or corrupts it instead of throwing.',\n cwe: 'CWE-125',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n // The trailing `true` on a Buffer numeric accessor *is* `noAssert` — it is\n // the last positional parameter of every one of these methods. Anchoring\n // on the accessor name is what keeps this from matching `, true)` on any\n // call in the codebase.\n pattern:\n /\\b(?:read|write)(?:U?Int(?:8|16|32)(?:[BL]E)?|U?Int[BL]E|Float[BL]E|Double[BL]E)\\s*\\([^)\\n]*,\\s*true\\s*\\)|\\bnoAssert\\s*:\\s*true\\b/,\n inherent: true,\n },\n {\n id: 'js-uninitialized-buffer',\n title: 'buffer allocated without zeroing',\n consequence:\n '`allocUnsafe` and the old `new Buffer(size)` hand back whatever was previously in that heap memory — keys, session tokens, other users’ request bodies. Anything not overwritten before the buffer is sent leaks it.',\n cwe: 'CWE-908',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n pattern: /\\bBuffer\\s*\\.\\s*allocUnsafe(?:Slow)?\\s*\\(|\\bnew\\s+Buffer\\s*\\(\\s*(?![`'\"])[a-zA-Z_$0-9]/,\n inherent: true,\n // Filling the buffer yourself is the whole reason to call `allocUnsafe`,\n // so reporting every call reports correct code. What is left reported is\n // an allocation whose bytes are never written before it escapes.\n filledBeforeUseGuard: true,\n },\n {\n id: 'js-oversized-request-body-limit',\n title: 'request body limit raised to a very large value',\n consequence:\n 'A body limit in the tens of megabytes lets a handful of concurrent requests exhaust memory, and the parse happens before any authentication check the route performs.',\n cwe: 'CWE-400',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n // Two or more digits before `mb` — 50mb and up. A limit is a *good* thing;\n // only an ineffective one is the finding.\n pattern: /\\blimit\\s*:\\s*['\"]\\s*(?:[5-9]\\d|\\d{3,})\\s*mb\\s*['\"]|\\blimit\\s*:\\s*['\"]\\s*\\d+\\s*gb\\s*['\"]/i,\n inherent: true,\n },\n\n // ── Information disclosure ───────────────────────────────────────────────\n {\n id: 'js-error-detail-returned',\n title: 'error object or stack trace sent to the client',\n consequence:\n 'A stack trace names absolute paths, package versions and internal function names, and framework errors often carry the failing query or connection string with them. It is a map of the server, handed out on request.',\n cwe: 'CWE-209',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n // `res.status(500).send(…)` is the overwhelmingly common spelling, so the\n // optional `.status(…)` hop is not a nicety — without it the rule misses\n // nearly every real occurrence.\n pattern:\n /\\bres\\s*\\.\\s*(?:status\\s*\\([^)\\n]*\\)\\s*\\.\\s*)?(?:send|json|end|write)\\s*\\(\\s*(?:[a-zA-Z_$][\\w$]*\\s*\\.\\s*stack\\b|(?:error|err|e)\\s*[,)])|\\.\\s*(?:send|json)\\s*\\(\\s*\\{[^}\\n]*\\b(?:stack|err|error)\\s*:\\s*(?:error|err|e)\\s*[,}]/,\n inherent: true,\n },\n];\n\n/**\n * KNOWN_GAPS — Node classes deliberately not implemented here.\n *\n * Each of these needs analysis this engine does not do, and the regex that\n * would approximate it fires on ordinary code often enough to make the whole\n * rule set less useful. They are listed rather than silently omitted so the\n * next person does not have to rediscover why.\n *\n * XML entity-expansion DoS (CWE-776)\n * The defect is the *absence* of an expansion limit, which is a property\n * of parser configuration spread across a file, not a line.\n *\n * Missing anti-CSRF, rate limiting, security headers (CWE-352, CWE-770)\n * Also absence-of-evidence, and genuinely whole-project. Handled instead\n * by `controls.ts`, which accumulates across the walk and reports once —\n * and only when asked, because a missing control is a weaker claim than a\n * present defect.\n *\n * JWT tokens not revocable, sensitive claims in the payload\n * Requires knowing what a claim means. `{ ssn: user.ssn }` and\n * `{ sub: user.id }` are the same shape.\n *\n * Prototype-pollution gadget chains\n * The direct assignment forms are covered by `js-prototype-pollution` in\n * the cross-language table. Reaching a gadget through a merge helper needs\n * interprocedural reasoning.\n *\n * Sequelize / driver TLS options\n * `rejectUnauthorized: false` is already reported by\n * `tls-verification-disabled`, which is language-agnostic and catches it\n * wherever it appears. A driver-specific duplicate would double-report.\n */\n","/**\n * Shared vocabulary for `threatcrush scan`.\n *\n * The scan pipeline is deliberately three separable pieces — rules produce\n * findings, the engine walks the tree, the reporters serialise. Keeping the\n * types here means a reporter never has to import a rule table to know what a\n * finding looks like.\n */\n\nexport type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';\n\n/**\n * How much the scanner is claiming.\n *\n * `pattern` the dangerous construct is present on the line. Nothing more.\n * `contextual` the construct sits alongside something that looks like\n * attacker-controlled input. Still not proof of exploitability,\n * but a materially stronger claim — and the only one allowed to\n * present at the rule's full severity.\n * `evidence` the match *is* the finding, not a proxy for it. A hardcoded\n * AWS key is a committed credential whether or not any request\n * ever reaches it, so the severity cap below does not apply.\n *\n * This mirrors the confidence model in `modules/code-scanner` (PRD 0004), for\n * the same reason: a regex is not data-flow analysis, and a scanner that blurs\n * the two produces confident-sounding findings that waste triage time.\n */\nexport type Confidence = 'pattern' | 'contextual' | 'evidence';\n\nexport type ScanLanguage =\n | 'javascript'\n | 'typescript'\n | 'python'\n | 'ruby'\n | 'go'\n | 'java'\n | 'php'\n | 'shell'\n | 'config'\n | 'other';\n\nexport interface ScanFinding {\n /** Stable rule identifier, e.g. `js-sql-string-building`. Used as the SARIF ruleId. */\n ruleId: string;\n /** Short human title for the construct, e.g. \"SQL assembled by concatenation\". */\n title: string;\n /** Path relative to the scan root, POSIX-separated. */\n file: string;\n /** 1-based. Whole-file findings report 1, never 0 — SARIF forbids 0. */\n line: number;\n severity: Severity;\n confidence: Confidence;\n /** What was found, in a sentence. Shown to the operator. */\n message: string;\n /** What happens if it is real. An operator triages on consequence. */\n consequence?: string;\n /** `CWE-89`. Absent for findings with no clean CWE mapping. */\n cwe?: string;\n /**\n * The matched source line, trimmed. Redacted by the reporters for secret\n * findings — see `redactSecret`.\n */\n excerpt: string;\n /** True when `excerpt` may contain credential material. */\n sensitive?: boolean;\n category: 'secret' | 'code' | 'manifest' | 'dependency' | 'file';\n}\n\nexport const SEVERITY_ORDER: readonly Severity[] = ['info', 'low', 'medium', 'high', 'critical'];\n\nexport function severityRank(severity: Severity): number {\n const index = SEVERITY_ORDER.indexOf(severity);\n return index === -1 ? 0 : index;\n}\n\n/**\n * Cap for a bare pattern match.\n *\n * A construct that merely *exists* never presents as high or critical. Enforced\n * centrally rather than per-rule so no future rule can opt out of it by\n * accident.\n */\nexport function severityFor(declared: Severity, confidence: Confidence): Severity {\n if (confidence !== 'pattern') return declared;\n return severityRank(declared) > severityRank('medium') ? 'medium' : declared;\n}\n","/**\n * Code-level vulnerability rules for `threatcrush scan`.\n *\n * Why this file exists\n * --------------------\n * Measured against the public testbed at `profullstack/malware-test-prs`, the\n * CLI scored 15.6% true-positive rate with a 0.0% false-positive rate: it found\n * every hardcoded credential and none of the code-level classes — no SQL\n * injection, XSS, SSRF, command injection, deserialisation or template\n * injection. ThreatCrush was a secrets scanner wearing a code scanner's name.\n *\n * These rules close that gap without giving up the number that was actually\n * worth having. The false-positive denominator in that testbed is a control\n * group of `SAFE:` lines — each one a *correct* implementation of the same\n * pattern the neighbouring vulnerable code gets wrong. A scanner that flags one\n * is pattern-matching on syntax instead of following the data. So every rule\n * here is built against both halves: it must fire on the vulnerable shape and\n * stay silent on the corrected shape standing next to it.\n *\n * Three mechanisms do that work:\n *\n * 1. **Shape, not keyword.** `db.query(\"SELECT … $1\", [id])` and\n * `db.query(\"SELECT … '\" + id + \"'\")` both contain `SELECT`. Only the\n * second concatenates, and only the second matches.\n * 2. **Guard windows.** A construct is exonerated by the code around it —\n * an allow-list two lines up, a `realpath` on the same line, an\n * `ObjectInputFilter` installed before the `readObject()`. Comment lines\n * are excluded from the window, because a comment saying \"no allow-list\n * here\" is not an allow-list.\n * 3. **Confidence.** A construct that merely exists is capped at medium.\n * Escalation requires visible untrusted input. See `types.ts`.\n *\n * What this is not: data-flow analysis. It is line-oriented matching with a\n * small amount of local context, and it says so. Classes that genuinely need\n * whole-function reasoning — missing CSRF tokens, check-then-use races,\n * integer overflow — are deliberately absent rather than approximated by a\n * rule that would flag every session read in the codebase. See KNOWN_GAPS.\n */\n\nimport { NODE_RULES } from './node-rules';\nimport type { Confidence, ScanLanguage, Severity } from './types';\nimport { severityFor } from './types';\n\nexport interface CodeRule {\n id: string;\n title: string;\n /** What happens if it is real. An operator triages on consequence. */\n consequence: string;\n cwe: string;\n severity: Severity;\n /** Languages the rule applies to. `undefined` means every language. */\n languages?: readonly ScanLanguage[];\n pattern: RegExp;\n /**\n * The rule describes a construct that is ordinary on its own — reading a\n * file from a computed path is just software. Only report it when untrusted\n * input is visible nearby.\n */\n needsContext?: boolean;\n /**\n * The construct *is* the defect, so its severity does not depend on context.\n *\n * The default model caps a finding at medium unless untrusted input is\n * visible nearby, which is right for injection: `exec(cmd)` is only a\n * vulnerability once `cmd` can be influenced. It is wrong for a whole class\n * of rules where nothing nearby changes the answer. `curl -k` against HTTPS\n * is a machine-in-the-middle hole whether or not a positional parameter\n * appears six lines above it; DES is broken in every file that uses it.\n *\n * Marking those rules `inherent` reports them at confidence `evidence` and\n * at their declared severity, the same treatment the credential rules get\n * for the same reason — a committed AWS key is a committed AWS key.\n *\n * Do not reach for this to make a rule look important. It is for rules whose\n * finding text would be identical no matter what surrounds the line.\n */\n inherent?: boolean;\n /**\n * Extra evidence that must appear in the guard window for the rule to fire.\n * Used where the dangerous part is the *combination* — a base64 blob is\n * harmless until something executes it.\n */\n requires?: RegExp;\n /**\n * Evidence that must appear somewhere in the file, not merely in the guard\n * window.\n *\n * For rules whose *applicability* is settled far from the match. Whether a\n * `.parse()` call is XML parsing is decided by an import at the top of the\n * file, which in a 1,600-line source is nowhere near the line that matched;\n * widening `guardBack` far enough to reach it would drag in unrelated\n * evidence for every other rule. Distinct from `requires`, which asks\n * whether the surrounding lines complete a dangerous combination.\n */\n fileRequires?: RegExp;\n /**\n * Evidence that the construct is already handled. `false` opts the rule out\n * of the generic guard entirely — the CWE-532 rules are *about* reading\n * `process.env`, so the generic guard would veto every true positive.\n */\n guard?: RegExp | false;\n /**\n * Evidence — on the matched line ONLY — that this occurrence is safe.\n *\n * Distinct from `guard`, which also searches the surrounding window. That\n * breadth is right for \"the value was sanitised three lines up\" but wrong\n * for properties of the line itself: a static `innerHTML` assignment says\n * nothing about a dynamic one two lines below it, and a context-scoped\n * guard would silently veto the dynamic one too.\n */\n lineGuard?: RegExp;\n /**\n * Evidence that the match sits inside a call that cannot be a sink —\n * matched against the callee of each unclosed call enclosing the line.\n *\n * Distinct from `guard` and `lineGuard`, both of which ask what is *near*\n * the match. Neither can answer \"is this an argument to something\", and that\n * is the question that separates a CORS header from a log line:\n *\n * console.log('connection', {\n * headers: { origin: request.headers.origin },\n * });\n *\n * The reflected-origin rule matched the inner line, four lines below the\n * `console.log(` that makes it inert. A window guard wide enough to see the\n * logger would also exonerate a genuine reflection written four lines under\n * an unrelated log statement; nesting is the only thing that distinguishes\n * them, so nesting is what this reads.\n */\n enclosingCallGuard?: RegExp;\n /**\n * Exonerate a template literal whose every `${…}` names a file-local `const`\n * bound to a string literal.\n *\n * const SRC = '/srv/app/routes';\n * execSync(`find ${SRC} -name '*.js'`);\n *\n * The command is a compile-time constant written in two pieces. Nothing\n * reaches it, so nothing can be injected into it — the shape is a build\n * script naming its own directories, and it is most of what the\n * interpolated-exec rules find in practice.\n *\n * `const` only, and a plain string literal only. `let` can be reassigned\n * from a request between the binding and the call, and a binding built by\n * interpolation just moves the question somewhere this cannot follow.\n */\n constantInterpolationGuard?: boolean;\n /**\n * Exonerate an uninitialised buffer that is written into before it escapes.\n *\n * const out = Buffer.allocUnsafe(length);\n * src.copy(out, 0, start, start + firstLen);\n * return out;\n *\n * `allocUnsafe` hands back unzeroed heap and the leak it enables is real, but\n * \"I will fill this myself\" is the entire reason the API exists. A rule that\n * fires on every call reports correct code as a vulnerability, and both hits\n * on the repository this was found against were a PTY ring that writes every\n * byte it later hands out. Neither could be silenced without silencing the\n * rule everywhere.\n *\n * Bound to the *name* the allocation is assigned to, not to a write merely\n * appearing nearby: an unrelated `.copy(` below an escaping `allocUnsafe`\n * must not exonerate it.\n *\n * The trade is deliberate and worth stating plainly. This cannot prove the\n * write covers the whole buffer, so a partial fill — `src.copy(out, 0, 0, 5)`\n * into a hundred-byte buffer — is exonerated and still leaks the rest.\n * Proving coverage needs range analysis this engine does not do. The\n * alternative is the status quo, where the rule fires on every correct use,\n * is read as noise and gets switched off — which catches that partial write\n * in exactly the same number of cases, namely none.\n *\n * An allocation with no binding to follow is never exonerated:\n * `return Buffer.allocUnsafe(n)` and `send(Buffer.allocUnsafe(n))` hand the\n * unzeroed memory straight out, which is the shape of the actual defect.\n */\n filledBeforeUseGuard?: boolean;\n /**\n * Exonerate an HTML sink when its value was produced by an explicit HTML\n * sanitiser or escaper, including a `const` previously assigned from one.\n * This is opt-in: generic names such as `html` or `content` are never proof\n * that a value is safe.\n */\n sanitizedHtmlGuard?: boolean;\n /** Exonerate a redirect destination derived by a named redirect validator. */\n safeRedirectGuard?: boolean;\n /** Lines of context searched backwards for guards and required evidence. */\n guardBack?: number;\n /**\n * Lines searched *forwards*. Zero for almost everything: code that fixes a\n * problem generally runs before the problem. XML parser hardening is the\n * exception — the factory is constructed, then configured, so the evidence\n * is below the match.\n */\n guardForward?: number;\n}\n\n/**\n * Things that look like attacker-controlled input, per language family.\n *\n * Deliberately shallow. It is a heuristic for *ranking*, not a taint-source\n * model. A real source list would be framework-aware and interprocedural,\n * which is exactly what this subsystem promises not to pretend to be.\n */\n/**\n * `searchParams` is a read *and* a write API. `params.get('q')` is inbound\n * data; `url.searchParams.set('limit', 50)` is an outbound URL being built,\n * and treating the two alike marked every client of every third-party API as\n * taking untrusted input — which is what made the SSRF rule fire on requests\n * whose host is a compile-time constant. Only the reading half is evidence.\n */\nconst UNTRUSTED_JS =\n /\\b(?:req|request|ctx|context)\\s*\\.\\s*(?:body|query|params|param|headers|cookies|url|files)\\b|\\bprocess\\.argv\\b|\\bwindow\\.location\\b|\\bdocument\\.location\\b|\\blocation\\.(?:search|hash|href)\\b|\\bsearchParams\\s*\\.\\s*(?:get|getAll|has|entries|keys|values|forEach)\\b|\\bgetParameter\\s*\\(|\\bgetQueryString\\s*\\(|\\bgetInputStream\\s*\\(/;\n\nconst UNTRUSTED_PY = /\\brequest\\b|\\bparams\\b|\\bflask\\b|\\bsys\\.argv\\b|\\bos\\.environ\\b\\s*\\[/;\n\nconst UNTRUSTED_RB = /\\bparams\\s*\\[|\\brequest\\b|\\bcookies\\s*\\[/;\n\nconst UNTRUSTED_GO =\n /\\br\\s*\\.\\s*(?:URL|Form|Body|Header|PostForm)\\b|\\bFormValue\\s*\\(|\\bQuery\\s*\\(\\s*\\)\\s*\\.\\s*Get\\s*\\(|\\bmux\\.Vars\\s*\\(/;\n\nconst UNTRUSTED_JAVA =\n /\\bgetParameter\\s*\\(|\\bgetQueryString\\s*\\(|\\bgetHeader\\s*\\(|\\bgetInputStream\\s*\\(|\\bgetCookies\\s*\\(|\\b@RequestParam\\b|\\b@PathVariable\\b/;\n\n/**\n * Untrusted input to a shell script: what the caller controls.\n *\n * Positional parameters and `read` are the whole surface. Environment\n * variables are deliberately absent — a script's own configuration arrives\n * that way, so treating `$PREFIX` as attacker-controlled would mark every\n * line of every installer.\n */\nconst UNTRUSTED_SH =\n /\\$\\{?[1-9]\\d*\\b|\\$[@*]|\\$\\{@\\}|\\bread\\s+(?:-\\S+\\s+)*[A-Za-z_]\\w*|\\$\\{?REPLY\\b|\\$\\{?QUERY_STRING\\b/;\n\n/** PHP's superglobals are the request, verbatim. */\nconst UNTRUSTED_PHP =\n /\\$_(?:GET|POST|REQUEST|COOKIE|FILES|SERVER)\\b|\\bphp:\\/\\/input\\b|\\bgetallheaders\\s*\\(/;\n\nexport function untrustedPatternFor(language: ScanLanguage): RegExp {\n switch (language) {\n case 'php':\n return UNTRUSTED_PHP;\n case 'shell':\n return UNTRUSTED_SH;\n case 'python':\n return UNTRUSTED_PY;\n case 'ruby':\n return UNTRUSTED_RB;\n case 'go':\n return UNTRUSTED_GO;\n case 'java':\n return UNTRUSTED_JAVA;\n default:\n return UNTRUSTED_JS;\n }\n}\n\n/**\n * Evidence that the dangerous construct on this line is already handled.\n *\n * Every entry here was added because a *correct* implementation in the testbed\n * corpus was otherwise flagged. They are named after what the safe code does,\n * not after what the finding is:\n *\n * allow/whitelist an allow-list decides what reaches the sink\n * escape/sanitize the value is encoded for its output context\n * realpath/… the path is resolved and re-checked before use\n * process.env/… the value comes from the environment, not the request\n * ObjectInputFilter a class allow-list is installed on the stream\n *\n * A guard match suppresses the finding rather than downgrading it. Reporting\n * \"we saw an allow-list but flagged it anyway\" is the behaviour that makes\n * operators stop reading scanner output.\n */\nexport const GENERIC_GUARD =\n // `esc(`, `aEsc(`, `htmlEscape(`, `escapeHtml(` — the escaper is almost\n // never *named* `escapeHtml` in real code. It gets aliased to something\n // short because it is called on nearly every interpolation, so matching only\n // the long spellings reported the codebases that escape most rigorously.\n //\n // The identifier must END at the escaper (with at most a known output-context\n // suffix). An earlier, looser form also matched `describe(`, which would have\n // silenced findings across every test file in every repository.\n // The `Access-Control-` lookbehind is not a nicety. This regex is\n // case-insensitive, and `Access-Control-Allow-Origin` contains the word\n // \"Allow\" followed by a non-word character — so the CORS header name matched\n // the allow-list heuristic. Because the guard is tested against an 8-line\n // *window*, one header line silently disabled every guardable rule near it:\n // in a four-line Express error handler, the header on one line suppressed\n // both the `none`-algorithm JWT finding and the returned stack trace below\n // it. The failure mode is the dangerous kind — not fewer findings, none, and\n // indistinguishable from clean code.\n //\n // Scoped to the header prefix rather than to a bare `allow(?!-)`, because\n // this guard also runs over `.yml` and `.conf` files, where `allow-list:`\n // and `allowed-hosts:` are ordinary keys that should still guard.\n /(?<!Access-Control-)\\ballow(?:ed|list|_list|ed_hosts)?\\b|\\bwhitelist\\b|\\b\\w{0,6}[Ee]sc(?:ape)?(?:[Hh]tml|HTML|[Xx]ml|XML|[Ss]ql|[Aa]ttr|[Jj]s|[Uu]ri|[Uu]rl)?\\s*\\(|\\bhtml_escape\\b|\\bhtmlspecialchars\\s*\\(|\\bsanitiz\\w*\\b|\\bencoded\\b|\\brealpath\\b|\\bcommonpath\\b|\\bresolve\\(\\)\\.startsWith\\b|\\bprocess\\.env\\b|\\bos\\.environ\\b|\\bgetenv\\b|\\bENV\\s*\\[|setObjectInputFilter|ObjectInputFilter/i;\n\n/** Evidence that an XML parser factory has been hardened against XXE. */\nconst XXE_GUARD =\n /FEATURE_SECURE_PROCESSING|setExpandEntityReferences|disallow-doctype-decl|external-general-entities|external-parameter-entities|setXIncludeAware\\s*\\(\\s*false/;\n\n/**\n * Evidence that a Java source parses XML at all.\n *\n * The package names are the reliable half: a file that reaches for\n * `javax.xml.parsers` or `org.xml.sax` has declared its intent at the top,\n * whatever the local variable ends up being called. The bare type names cover\n * sources that import by wildcard or sit in the same package.\n */\nconst XML_PARSING_FILE =\n /\\b(?:javax\\.xml|org\\.xml\\.sax|org\\.w3c\\.dom|org\\.jdom2?|org\\.dom4j|XmlPullParser|DocumentBuilderFactory|DocumentBuilder|SAXParserFactory|SAXParser|XMLInputFactory|XMLReaderFactory|XMLReader|SAXBuilder|SAXReader)\\b/;\n\n/** A sink that executes whatever string reaches it. */\nconst CODE_SINK =\n /\\bglobalThis\\s*\\[|\\bconstructor\\b|\\beval\\b|\\bFunction\\b|\\brun\\s*\\(|\\bvm\\s*\\.\\s*run/;\n\n/** A sink whose output is retained: a log, a console, an outbound request. */\nconst EXFIL_SINK = /\\bconsole\\s*\\.\\s*(?:log|debug|info|warn|error)\\s*\\(|\\bfetch\\s*\\(|\\baxios\\b|\\brequest\\s*\\(|\\.\\s*send\\s*\\(/;\n\n/**\n * SQL text that is being *assembled* rather than parameterised.\n *\n * The four tails are the four ways to build a string in the languages this\n * covers: `+` concatenation, `${}` template interpolation, `%`/`.format()`\n * substitution, and Ruby's `#{}`. A bound placeholder (`$1`, `?`, `%s` passed\n * as an argument) leaves a comma after the closing quote and matches none of\n * them — which is exactly how the safe counterparts stay unflagged.\n */\n// Each verb requires the clause that makes it SQL rather than an English word.\n//\n// The bare forms — `INSERT`, `UPDATE`, `DELETE`, `DROP`, a lone `SELECT` — were\n// the source of this rule's false positives: `\\bINSERT\\b` matches the `insert`\n// in a React key `` `insert-${i}` ``, and `\\bUPDATE\\b` matches `Update` in a\n// log line `` `Update finished in ${ms}ms` ``. Both read as SQL injection.\n//\n// Real SQL pairs the verb with structure — `SELECT … FROM`, `INSERT INTO`,\n// `UPDATE … SET`, `DELETE FROM`, `DROP TABLE`. Requiring it keeps every\n// injection shape the corpus and the unit tests exercise (all of which are\n// `SELECT … FROM` or `DELETE FROM`) while a verb standing alone as prose no\n// longer qualifies. The `SELECT`/`UPDATE` look-aheads stay inside one string\n// literal — the character class excludes quotes and backticks — so the clause\n// must live in the same statement, not merely somewhere later on the line.\nconst SQL_KEYWORDS =\n \"SELECT\\\\b(?=[^`'\\\"\\\\n]*\\\\bFROM\\\\b)\" +\n \"|INSERT\\\\s+INTO\" +\n \"|UPDATE\\\\b(?=[^`'\\\"\\\\n]*\\\\bSET\\\\b)\" +\n \"|DELETE\\\\s+FROM\" +\n \"|DROP\\\\s+(?:TABLE|DATABASE|INDEX|VIEW|SCHEMA)\" +\n \"|TRUNCATE\\\\s+TABLE\" +\n \"|UNION\\\\s+SELECT\";\n\n/**\n * A quoted string containing a SQL verb.\n *\n * Two variants, one per quote character, because the interesting strings\n * contain the *other* quote:\n *\n * \"SELECT id FROM users WHERE id = '\" + id + \"'\"\n *\n * A single `[\"'][^\"'\\n]*` class stops dead at that inner `'` and matches\n * nothing — which silently drops the most common SQL-injection shape in every\n * language at once. Match a double-quoted string with a class that excludes\n * only `\"`, and vice versa.\n */\nconst SQL_IN_DOUBLE = `\"[^\"\\\\n]*(?:${SQL_KEYWORDS})\\\\b[^\"\\\\n]*\"`;\nconst SQL_IN_SINGLE = `'[^'\\\\n]*(?:${SQL_KEYWORDS})\\\\b[^'\\\\n]*'`;\nconst SQL_STRING = `(?:${SQL_IN_DOUBLE}|${SQL_IN_SINGLE})`;\n\nexport const CODE_RULES: readonly CodeRule[] = [\n // ── Injection: SQL ───────────────────────────────────────────────────────\n {\n id: 'sql-string-concatenation',\n title: 'SQL assembled by concatenation or interpolation',\n consequence:\n 'A quote in the interpolated value changes the query’s meaning — the query runs as the attacker wrote it, not as you wrote it.',\n cwe: 'CWE-89',\n severity: 'critical',\n // The tail is what distinguishes assembly from parameterisation. A bound\n // query leaves a comma after the closing quote (`\"… = $1\", [id]`) and\n // matches none of these.\n //\n // The clause alternative anchors the keyword to the *start* of the\n // concatenated fragment, because that is where a clause being appended\n // actually sits: `sql + \"WHERE id = \" + id`, `sql + \" ORDER BY \" + col`.\n //\n // Allowing it anywhere in the fragment made the rule read English. `WHERE`\n // and `SET` are ordinary words, and without a leading `\\b` they were not\n // even required to be whole ones — \"any`where`\" and \"sub`set`\" both\n // matched. A help string reading \"lists them anywhere\" was reported as\n // critical SQL injection, which is the kind of finding that teaches a team\n // the scanner is not worth reading.\n pattern: new RegExp(\n `${SQL_STRING}\\\\s*\\\\+|` +\n `${SQL_STRING}\\\\s*%\\\\s*[\\\\w(]|` +\n `${SQL_STRING}\\\\s*\\\\.\\\\s*format\\\\s*\\\\(|` +\n '\\\\+\\\\s*(?:\"|\\')\\\\s*\\\\b(?:WHERE|ORDER\\\\s+BY|VALUES|SET)\\\\b',\n 'i',\n ),\n },\n {\n id: 'sql-template-interpolation',\n title: 'SQL built from a template literal or f-string',\n consequence:\n 'Template interpolation is string concatenation with nicer syntax — it binds nothing and escapes nothing.',\n cwe: 'CWE-89',\n severity: 'critical',\n pattern: new RegExp(\n `\\`[^\\`\\\\n]*(?:${SQL_KEYWORDS})\\\\b[^\\`\\\\n]*\\\\$\\\\{|` +\n `\\\\bf\"[^\"\\\\n]*(?:${SQL_KEYWORDS})\\\\b[^\"\\\\n]*\\\\{|` +\n `\\\\bf'[^'\\\\n]*(?:${SQL_KEYWORDS})\\\\b[^'\\\\n]*\\\\{`,\n 'i',\n ),\n /**\n * Interpolating a column list is not interpolating a value.\n *\n * const COLS = `tld, user_id, owner_email, price_usd`;\n * get(`SELECT ${COLS} FROM moshpit_tlds WHERE tld = ?`, [tld]);\n *\n * That query *is* parameterised: every value the caller supplies rides a\n * `?`, and the only thing spliced into the text is a constant written a\n * few lines up. Naming the column list once instead of repeating it in\n * fourteen queries is ordinary hygiene, and it is the shape this rule met\n * most often in practice — one repository produced eighteen findings this\n * way and not one of them could be injected into.\n *\n * The guard resolves the interpolations rather than trusting the shape, so\n * the moment a query mixes a constant with anything else —\n * `` `SELECT ${COLS} FROM t WHERE id = ${req.query.id}` `` — it is reported\n * again. `interpolationsAreConstant` requires *every* `${…}` to resolve.\n */\n constantInterpolationGuard: true,\n },\n {\n id: 'sql-format-call',\n title: 'SQL text produced by a format helper',\n consequence:\n '`Sprintf`/`String.format` substitute without quoting; the resulting string is concatenated SQL by another name.',\n cwe: 'CWE-89',\n severity: 'critical',\n languages: ['go', 'java'],\n pattern: new RegExp(\n `\\\\b(?:fmt\\\\.Sprintf|String\\\\.format)\\\\s*\\\\(\\\\s*\"[^\"\\\\n]*(?:${SQL_KEYWORDS})\\\\b`,\n 'i',\n ),\n },\n {\n id: 'rb-sql-interpolation',\n title: 'ActiveRecord query built by string interpolation',\n consequence:\n '`where(\"… #{value}\")` interpolates before the adapter sees it, so no binding ever happens.',\n cwe: 'CWE-89',\n severity: 'critical',\n languages: ['ruby'],\n pattern:\n /\\b(?:where|find_by_sql|execute|select_all|select_values|order|group|pluck)\\s*[( ]\\s*(?:\"[^\"\\n]*|'[^'\\n]*)#\\{/,\n },\n\n // ── Injection: OS command ────────────────────────────────────────────────\n {\n id: 'js-shell-exec-interpolation',\n title: 'shell execution with an interpolated string',\n consequence: 'A `;` or `$(…)` in the interpolated value runs as the server user.',\n cwe: 'CWE-78',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\b(?:exec|execSync|spawn|spawnSync)\\s*\\(\\s*(?:`[^`]*\\$\\{|['\"][^'\"]*['\"]\\s*\\+|[a-zA-Z_$][\\w$]*\\s*\\+)/,\n constantInterpolationGuard: true,\n // Interpolation is common in locally run CLI and installer code. Report\n // command execution as an injection vulnerability only when the nearby\n // code shows a caller-controlled source, rather than treating every\n // internally assembled command as attacker input.\n needsContext: true,\n },\n {\n id: 'py-shell-command-string',\n title: 'shell command built from a string',\n consequence:\n '`os.system` and `shell=True` hand the string to `/bin/sh`, which happily interprets metacharacters.',\n cwe: 'CWE-78',\n severity: 'critical',\n languages: ['python'],\n pattern:\n /\\bos\\.(?:system|popen)\\s*\\(\\s*(?:f?['\"][^'\"]*['\"]\\s*(?:\\+|%|\\.\\s*format)|f['\"]|[a-zA-Z_]\\w*\\s*[,)])|\\bsubprocess\\.(?:run|call|check_call|check_output|Popen)\\s*\\([^)]*\\bshell\\s*=\\s*True/,\n },\n {\n id: 'go-shell-exec-command',\n title: 'exec.Command invoking a shell',\n consequence:\n 'Passing `sh -c` re-introduces the shell that `exec.Command`’s argv interface exists to avoid.',\n cwe: 'CWE-78',\n severity: 'critical',\n languages: ['go'],\n pattern: /\\bexec\\.Command(?:Context)?\\s*\\(\\s*(?:ctx\\s*,\\s*)?\"(?:\\/bin\\/)?(?:sh|bash|zsh|cmd|powershell)\"\\s*,\\s*\"(?:-c|\\/c)\"/,\n // A call whose whole argv is string literals cannot be injected into.\n // `exec.Command(\"cmd\", \"/c\", \"ver\")` reads the Windows version; there is no\n // value in it for an attacker to reach, and the consequence above — that a\n // shell will interpret metacharacters — describes metacharacters nobody can\n // supply. gosec's G204 draws the line in the same place, and this was the\n // single finding a Go project got out of a whole scan before declining the\n // offer, which is an expensive way to report nothing.\n //\n // The guard has to end at the closing paren, so a literal followed by\n // anything else still reports: `\"ls \" + dir` leaves a `+` before the `)`,\n // `fmt.Sprintf(…)` leaves an identifier, and a bare variable leaves a name.\n // `(?:[^\"\\\\]|\\\\.)*` rather than `[^\"]*` so an escaped quote inside a\n // literal — `\"echo \\\"hi\\\"\"` — does not end the literal early and drop the\n // guard on a line it should have covered.\n lineGuard:\n /\\bexec\\.Command(?:Context)?\\s*\\(\\s*(?:ctx\\s*,\\s*)?\"(?:\\/bin\\/)?(?:sh|bash|zsh|cmd|powershell)\"\\s*,\\s*\"(?:-c|\\/c)\"\\s*(?:,\\s*\"(?:[^\"\\\\]|\\\\.)*\")*\\s*,?\\s*\\)/,\n },\n {\n id: 'rb-backtick-interpolation',\n title: 'backtick command with interpolation',\n consequence: 'Ruby backticks are a shell invocation; `#{}` inside one is command injection.',\n cwe: 'CWE-78',\n severity: 'critical',\n languages: ['ruby'],\n pattern: /`[^`\\n]*#\\{|\\bsystem\\s*\\(\\s*[\"'][^\"'\\n]*#\\{|%x\\[[^\\]]*#\\{/,\n },\n\n // ── Injection: dynamic code ──────────────────────────────────────────────\n {\n id: 'js-dynamic-code-execution',\n title: 'dynamic code execution',\n consequence: 'Any string reaching this call executes as code with the process’ privileges.',\n cwe: 'CWE-95',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\beval\\s*\\(|\\bnew\\s+Function\\s*\\(|\\bvm\\s*\\.\\s*run(?:InThisContext|InNewContext|InContext)\\s*\\(|\\bset(?:Timeout|Interval)\\s*\\(\\s*(?:['\"`]|(?:req|request|ctx|params|query|body)\\b)/,\n },\n {\n id: 'js-indirect-code-sink',\n title: 'code sink reached indirectly',\n consequence:\n 'Resolving `eval`/`Function` through `globalThis[…]` or `.constructor` hides the sink from literal matching. Legitimate code has no reason to.',\n cwe: 'CWE-506',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\bglobalThis\\s*\\[\\s*[a-zA-Z_$][\\w$]*\\s*\\]|\\(\\s*function\\s*\\(\\s*\\)\\s*\\{\\s*\\}\\s*\\)\\s*\\.\\s*constructor/,\n },\n {\n id: 'js-encoded-payload-execution',\n title: 'encoded blob decoded next to a code sink',\n consequence:\n 'A base64 literal that is decoded and executed is the standard shape of a planted backdoor; the encoding exists to defeat review.',\n cwe: 'CWE-506',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern: /\\bBuffer\\.from\\s*\\(\\s*[\\w.$]+\\s*,\\s*['\"]base64['\"]\\s*\\)|\\batob\\s*\\(\\s*[\\w.$]+\\s*\\)/,\n requires: CODE_SINK,\n guardBack: 6,\n guardForward: 3,\n },\n {\n id: 'py-dynamic-code-execution',\n title: 'dynamic code execution',\n consequence: 'Any string reaching this call executes as Python with the process’ privileges.',\n cwe: 'CWE-95',\n severity: 'critical',\n languages: ['python'],\n pattern: /\\b(?:eval|exec)\\s*\\(\\s*(?!['\"]\\s*\\))[a-zA-Z_(f'\"]/,\n needsContext: true,\n },\n {\n id: 'rb-dynamic-dispatch',\n title: 'dynamic code execution or unrestricted #send',\n consequence:\n '`eval` runs arbitrary Ruby; unrestricted `#send` lets the caller invoke any method on the receiver, including private ones.',\n cwe: 'CWE-95',\n severity: 'critical',\n languages: ['ruby'],\n pattern: /\\beval\\s*\\(|\\binstance_eval\\s*\\(|\\bclass_eval\\s*\\(|\\.\\s*send\\s*\\(\\s*(?:params|request|args)\\b/,\n },\n\n // ── Cross-site scripting ─────────────────────────────────────────────────\n {\n id: 'js-unescaped-html-sink',\n title: 'unescaped HTML rendering',\n consequence: 'A script tag in the value executes in the victim’s session — stored or reflected XSS.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n /**\n * The assignment alternative carries its own exemption, as a lookahead, so\n * that it is decided per assignment rather than per line.\n *\n * A whole-statement assignment of a string with no interpolation and no\n * concatenation carries no data, so it cannot carry attacker data. This was\n * the single largest source of noise: a codebase that builds its UI with\n * innerHTML reports every static heading and spinner as XSS, and a rule\n * that flags 40 safe lines to catch one real one gets switched off.\n *\n * Two things this has to get right, and a `lineGuard` could get neither:\n *\n * A statement ends at its semicolon, not at the newline. Anchoring to `$`\n * held the exemption for `el.innerHTML = '';` alone on a line and dropped\n * it the moment anything followed:\n *\n * function hide() { out.hidden = true; out.innerHTML = ''; rendered = null; }\n *\n * — the same assignment, clearing a node, reported as high-severity XSS\n * because two neighbours shared its line.\n *\n * And an exemption must not become a line-wide amnesty. A guard is tested\n * against the whole line, so one safe clear would exonerate a real sink\n * beside it:\n *\n * a.innerHTML = ''; b.innerHTML = userInput;\n *\n * As a lookahead the regex decides at each `=` it reaches, so the first\n * assignment is exempt and the second is still reported.\n *\n * The whitespace after `=` is matched *inside* the lookahead rather than\n * before it. Left outside, `\\s*` backtracks to zero width, the lookahead\n * then starts on the space instead of the quote, fails to see a literal,\n * and the negative lookahead succeeds — reinstating every finding the\n * exemption was written to remove.\n */\n pattern:\n /\\bdangerouslySetInnerHTML\\s*=|\\.\\s*(?:innerHTML|outerHTML)\\s*=(?!\\s*(?:'[^'\\\\\\n]*'|\"[^\"\\\\\\n]*\"|`[^`$\\\\\\n]*`)\\s*(?:;|$))|\\bdocument\\s*\\.\\s*write(?:ln)?\\s*\\(|\\.\\s*insertAdjacentHTML\\s*\\(/,\n sanitizedHtmlGuard: true,\n },\n {\n id: 'java-html-writer-concatenation',\n title: 'HTML written to the response by concatenation',\n consequence:\n 'The servlet writer performs no encoding; a value concatenated into markup is rendered as markup.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['java'],\n pattern: /\\b(?:println|print|write)\\s*\\(\\s*\"[^\"\\n]*<[^\"\\n]*\"\\s*\\+/,\n },\n {\n id: 'rb-unescaped-output',\n title: 'Rails output escaping bypassed',\n consequence:\n '`html_safe` and `raw` tell Rails the string is already safe. If it came from a parameter, it is not.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['ruby'],\n pattern: /\\.\\s*html_safe\\b|\\braw\\s*\\(\\s*(?:params|request|@)|\\blink_to\\s+[^,\\n]+,\\s*params\\s*\\[/,\n },\n {\n id: 'py-template-autoescape-off',\n title: 'template rendering with escaping disabled',\n consequence:\n 'With autoescape off — or a `|safe` filter — every interpolated value is rendered as markup.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['python'],\n pattern: /\\bEnvironment\\s*\\([^)]*\\bautoescape\\s*=\\s*False|\\|\\s*safe\\b|\\bMarkup\\s*\\(\\s*(?!['\"])/,\n },\n {\n id: 'py-template-from-input',\n title: 'template compiled from a non-literal source',\n consequence:\n 'Server-side template injection. In Jinja2 the sandbox is escapable, so this escalates from XSS to remote code execution.',\n cwe: 'CWE-1336',\n severity: 'critical',\n languages: ['python'],\n pattern: /\\bTemplate\\s*\\(\\s*(?!['\"])[a-zA-Z_]/,\n needsContext: true,\n },\n\n // ── Server-side request forgery ──────────────────────────────────────────\n {\n id: 'js-ssrf-outbound-request',\n title: 'outbound request to a non-constant URL',\n consequence:\n 'An attacker who controls the URL reaches the cloud metadata endpoint, localhost, and every service on the private network.',\n cwe: 'CWE-918',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\bfetch\\s*\\(\\s*[a-zA-Z_$][\\w$]*\\s*[,)]|\\bhttps?\\s*\\.\\s*(?:get|request)\\s*\\(\\s*[a-zA-Z_$][\\w$]*\\s*[,)]|\\baxios\\s*\\.\\s*get\\s*\\(\\s*[a-zA-Z_$][\\w$]*\\s*[,)]/,\n needsContext: true,\n },\n {\n id: 'py-ssrf-outbound-request',\n title: 'outbound request to a non-constant URL',\n consequence:\n 'An attacker who controls the URL reaches the cloud metadata endpoint, localhost, and every service on the private network.',\n cwe: 'CWE-918',\n severity: 'high',\n languages: ['python'],\n pattern:\n /\\brequests\\.(?:get|request|head)\\s*\\(\\s*[a-zA-Z_]\\w*\\s*[,)]|\\burlopen\\s*\\(\\s*[a-zA-Z_]\\w*\\s*[,)]|\\bhttpx\\.get\\s*\\(\\s*[a-zA-Z_]\\w*\\s*[,)]/,\n needsContext: true,\n },\n {\n id: 'go-ssrf-outbound-request',\n title: 'outbound request to a non-constant URL',\n consequence:\n 'An attacker who controls the URL reaches the cloud metadata endpoint, localhost, and every service on the private network.',\n cwe: 'CWE-918',\n severity: 'high',\n languages: ['go'],\n pattern: /\\bhttp\\.(?:Get|Post|Head)\\s*\\(\\s*(?:[a-zA-Z_]\\w*\\s*[,)]|\"[^\"]*\"\\s*\\+)/,\n needsContext: true,\n },\n\n // ── Open redirect ────────────────────────────────────────────────────────\n {\n id: 'js-open-redirect',\n title: 'redirect to a non-constant destination',\n consequence:\n 'Your domain becomes the credible first hop of a phishing chain; the victim sees your hostname in the link they clicked.',\n cwe: 'CWE-601',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\b(?:res|response)\\s*\\.\\s*redirect\\s*\\(\\s*[a-zA-Z_$][\\w$]*\\s*\\)|\\bwindow\\s*\\.\\s*location(?:\\s*\\.\\s*(?:href|replace))?\\s*(?:=\\s*[a-zA-Z_$]|\\(\\s*[a-zA-Z_$][\\w$]*\\s*\\))/,\n needsContext: true,\n safeRedirectGuard: true,\n },\n\n // ── Deserialisation ──────────────────────────────────────────────────────\n {\n id: 'py-unsafe-deserialization',\n title: 'deserialisation of untrusted data',\n consequence:\n '`pickle` and `yaml.load` instantiate arbitrary types during parsing — a crafted payload is remote code execution, not a parse error.',\n cwe: 'CWE-502',\n severity: 'critical',\n languages: ['python'],\n pattern: /\\bpickle\\.loads?\\s*\\(|\\bcPickle\\.loads?\\s*\\(|\\bmarshal\\.loads\\s*\\(|\\byaml\\.load\\s*\\(|\\bjsonpickle\\.decode\\s*\\(/,\n },\n {\n id: 'java-unsafe-deserialization',\n title: 'Java deserialisation without a class filter',\n consequence:\n 'A gadget chain in the classpath turns `readObject()` on attacker bytes into remote code execution.',\n cwe: 'CWE-502',\n severity: 'critical',\n languages: ['java'],\n pattern: /\\breadObject\\s*\\(\\s*\\)|\\bnew\\s+ObjectInputStream\\s*\\(/,\n guardBack: 8,\n // The stream is constructed, *then* filtered. Without a forward window the\n // guarded case matches on its constructor line and reports a correct\n // implementation as a finding.\n guardForward: 6,\n },\n {\n id: 'js-unsafe-yaml-load',\n title: 'YAML parsed with type resolution enabled',\n consequence: 'A crafted document can instantiate arbitrary types during parsing.',\n cwe: 'CWE-502',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\byaml\\s*\\.\\s*load\\s*\\((?![^)]*safe)|\\bloadAll\\s*\\([^)]*unsafe/i,\n },\n\n // ── XML external entities ────────────────────────────────────────────────\n //\n // Evidence that a file parses XML at all. The XXE rules match on receiver\n // *names* — `builder.parse(is)` is the shape the vulnerability actually takes,\n // and the declared type is rarely on that line — so without this the pattern\n // reads any `.parse()` on anything suffixed Builder, Parser or Reader as XML.\n // In practice that meant a hostname-mask parser (`HostMask.Parser.parse(...)`)\n // was reported as CWE-611 at high severity.\n //\n // An import is the cheapest honest signal: a file that parses XML says so at\n // the top, and one that never mentions XML is not parsing it.\n {\n id: 'java-xxe-parser-defaults',\n title: 'XML parser left on its insecure defaults',\n consequence:\n 'External entity expansion reads local files and makes outbound requests on the parser’s behalf — file disclosure and SSRF from a document.',\n cwe: 'CWE-611',\n severity: 'high',\n languages: ['java'],\n pattern:\n /\\b(?:DocumentBuilderFactory|SAXParserFactory|XMLInputFactory|TransformerFactory|SchemaFactory)\\s*\\.\\s*newInstance\\s*\\(\\s*\\)/,\n guard: XXE_GUARD,\n guardBack: 4,\n guardForward: 8,\n },\n {\n id: 'java-xxe-parse-call',\n title: 'XML parsed by a builder that was never hardened',\n consequence:\n 'The expansion happens at `parse()`. Flagging only the factory misses the line where the document is actually read.',\n cwe: 'CWE-611',\n severity: 'high',\n languages: ['java'],\n // Receiver-qualified so `LocalDate.parse(s)` and friends stay out of it.\n // The suffix alone is not enough — plenty of parsers parse things that are\n // not XML — so `fileRequires` decides whether the file is in scope at all.\n pattern: /\\b\\w*(?:[Bb]uilder|[Pp]arser|[Rr]eader)\\s*\\.\\s*parse\\s*\\(/,\n fileRequires: XML_PARSING_FILE,\n guard: XXE_GUARD,\n guardBack: 6,\n guardForward: 4,\n },\n\n // ── Path traversal ───────────────────────────────────────────────────────\n {\n id: 'py-path-traversal',\n title: 'file opened at a path built from input',\n consequence: 'A `../` sequence — or an absolute path — reads or writes outside the intended directory.',\n cwe: 'CWE-22',\n severity: 'high',\n languages: ['python'],\n pattern: /\\bopen\\s*\\(\\s*(?:os\\.path\\.join\\s*\\(|[a-zA-Z_]\\w*\\s*\\+|f['\"])/,\n needsContext: true,\n },\n {\n id: 'js-path-traversal',\n title: 'file path built from a variable',\n consequence: 'A `../` sequence in the value reads or writes outside the intended directory.',\n cwe: 'CWE-22',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\b(?:readFile|readFileSync|writeFile|writeFileSync|createReadStream|createWriteStream|unlink|unlinkSync|sendFile)\\s*\\(\\s*(?:`[^`]*\\$\\{|[a-zA-Z_$][\\w$]*\\s*\\+|path\\.join\\s*\\([^)]*(?:req|request)\\b)/,\n needsContext: true,\n },\n\n // ── Cryptography, tokens, randomness ─────────────────────────────────────\n {\n id: 'js-jwt-decode-without-verify',\n title: 'JWT decoded without verifying the signature',\n consequence:\n '`decode` parses the claims and checks nothing. Anyone can mint a token with any `sub` and any `role`.',\n cwe: 'CWE-347',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern: /\\bjwt\\s*\\.\\s*decode\\s*\\(|\\bjsonwebtoken\\s*\\.\\s*decode\\s*\\(|\\bdecodeJwt\\s*\\(/,\n },\n {\n id: 'tls-verification-disabled',\n inherent: true,\n title: 'TLS certificate verification disabled',\n consequence:\n 'Every connection made this way is trivially interceptable; the encryption is decorative.',\n cwe: 'CWE-295',\n severity: 'high',\n pattern:\n /rejectUnauthorized\\s*:\\s*false|NODE_TLS_REJECT_UNAUTHORIZED\\s*[=:]\\s*['\"]?0|strictSSL\\s*:\\s*false|\\bverify\\s*=\\s*False\\b|InsecureSkipVerify\\s*:\\s*true/,\n },\n {\n id: 'weak-hash-on-credential',\n title: 'broken hash used on a credential',\n consequence: 'MD5 and SHA-1 are fast and collision-prone; hashed passwords are recoverable.',\n cwe: 'CWE-327',\n severity: 'high',\n pattern:\n /(?:createHash|hashlib|MessageDigest\\.getInstance|Digest::)\\s*[.(]?\\s*['\"]?(?:md5|MD5|sha1|SHA-?1)['\"]?\\s*\\)?[\\s\\S]{0,80}(?:password|passwd|secret|token|credential)/i,\n },\n {\n id: 'insecure-randomness-for-secret',\n title: 'predictable randomness used for a security value',\n consequence:\n '`Math.random`/`random.random` are predictable; tokens, session ids and reset codes built from them are guessable.',\n cwe: 'CWE-338',\n severity: 'high',\n pattern:\n /(?:token|secret|password|salt|nonce|session|otp|reset|apikey|api_key)[\\w]*\\s*[:=][^;\\n]{0,60}(?:Math\\s*\\.\\s*random\\s*\\(|\\brandom\\s*\\.\\s*(?:random|randint|choice)\\s*\\(|\\brand\\s*\\()/i,\n },\n\n // ── Weak crypto: Python ──────────────────────────────────────────────────\n //\n // The generic rules above catch the credential case on the matched line.\n // These cover what they miss in Python, where the security role of a value is\n // set by the enclosing function rather than a same-line assignment — a\n // `random`-drawn token that is *returned*, an MD5 used to *verify* an\n // artifact — and the broken ciphers, which have no safe use at all.\n {\n id: 'py-broken-cipher',\n title: 'broken cipher or ECB mode',\n consequence:\n 'DES, RC2, RC4 and Blowfish are broken or too small to rely on, and ECB encrypts identical plaintext blocks to identical ciphertext, so structure in the data survives encryption. None of them provides the confidentiality their use implies.',\n cwe: 'CWE-327',\n severity: 'high',\n languages: ['python'],\n // PyCryptodome/PyCrypto constructors. The mode matters only for AES, whose\n // safe modes (GCM, CTR, CBC) are common — so AES matches solely on ECB,\n // while DES/RC4/Blowfish are broken by the algorithm regardless of mode.\n pattern:\n /\\b(?:DES|DES3|ARC2|RC2|ARC4|RC4|Blowfish|XOR)\\s*\\.\\s*new\\s*\\(|\\bAES\\s*\\.\\s*new\\s*\\([^)\\n]*\\bMODE_ECB\\b/,\n inherent: true,\n guard: false,\n },\n {\n id: 'py-weak-hash',\n title: 'broken hash algorithm',\n consequence:\n 'MD5 and SHA-1 have practical collisions, so a digest used for integrity or a signature can be forged to match a value the code trusts.',\n cwe: 'CWE-327',\n severity: 'medium',\n languages: ['python'],\n pattern: /\\bhashlib\\s*\\.\\s*(?:md5|sha1)\\s*\\(/,\n // Python 3.9+ marks a non-security digest — a cache key, an ETag — with\n // `usedforsecurity=False`, which is exactly the \"this MD5 is not a security\n // claim\" signal, so it exempts the line rather than being flagged.\n lineGuard: /usedforsecurity\\s*=\\s*False/,\n },\n {\n id: 'py-predictable-random-seed',\n title: 'PRNG seeded from a predictable value',\n consequence:\n 'Seeding `random` from the clock or the process id makes its whole sequence reproducible, so anything drawn from it afterwards — a token, an id, a shuffle — can be regenerated by guessing the seed.',\n cwe: 'CWE-338',\n severity: 'high',\n languages: ['python'],\n // A time- or pid-derived seed, which is the predictable kind. A fixed\n // integer seed (`random.seed(42)`) is deliberate reproducibility for tests\n // and simulations, so it is left alone. This needs no credential context:\n // seeding the global PRNG from the clock is a weakness on its own terms,\n // which is why the enclosing function's name — that this engine does not\n // read as evidence anyway — is not consulted.\n pattern:\n /\\brandom\\s*\\.\\s*seed\\s*\\([^)\\n]*(?:time\\s*\\.\\s*time|datetime|\\.\\s*now\\s*\\(|getpid)/,\n inherent: true,\n },\n {\n id: 'redos-nested-quantifier',\n title: 'regex with nested unbounded quantifiers',\n consequence:\n 'Catastrophic backtracking: a crafted input of a few dozen characters pins a CPU core for minutes.',\n cwe: 'CWE-1333',\n severity: 'medium',\n // Scoped, because unscoped this rule reads C as if it were a regex.\n //\n // `(void *)*memptr64` — a cast to a pointer type, then a dereference — is\n // the single most ordinary line in a C file, and it matches the first\n // alternative exactly: `(`, some text, `*`, `)`, `*`. Every `*(char *)*p`\n // in a codebase became a ReDoS finding. Caught on inspektor-gadget, where\n // the rule's one and only hit across 1186 files was a `bpf_probe_read_user`\n // call in an eBPF C program.\n //\n // Scoping is the fix rather than a cleverer pattern: C has no regex\n // literals, so there is nothing here for the rule to find no matter how\n // the pattern is written. `other` also covers C++, Rust and Zig, which\n // share the cast-then-deref spelling.\n languages: ['javascript', 'typescript', 'python', 'ruby', 'go', 'java', 'php'],\n pattern:\n /(?:^|[=(:,]\\s*)\\/(?:\\\\.|[^/\\\\\\n])*\\([^()\\n]*[+*][^()\\n]*\\)\\s*(?:[+*]|\\{\\d+,\\})|\\b(?:new\\s+RegExp|RegExp|re\\.compile|regexp\\.(?:Compile|MustCompile)|Pattern\\.compile)\\s*\\(\\s*(?:r)?[\"'][^\"'\\n]*\\([^()\\n]*[+*][^()\\n]*\\)\\s*(?:[+*]|\\{\\d+,\\})/,\n },\n\n // ── Temporary files ──────────────────────────────────────────────────────\n {\n id: 'insecure-temp-file',\n title: 'predictable temporary file path',\n consequence:\n 'A predictable name in a world-writable directory is a symlink attack: an attacker pre-creates the path and your process writes through it.',\n cwe: 'CWE-377',\n severity: 'medium',\n // `File.createTempFile` is specifically the safe Java API, and a string\n // containing `/tmp/` is not necessarily a write. Detect unsafe name\n // generators and actual writes to a literal temp path instead. Shell\n // redirections are handled by the shell-specific rule below.\n pattern: new RegExp(\n String.raw`\\btempfile\\.mktemp\\s*\\(|\\bos\\.tmpnam\\s*\\(|\\b(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream|FileOutputStream|FileWriter|os\\.OpenFile|open)\\s*\\([^\\n)]*['\"]\\/tmp\\/[^'\"\\n]+['\"]`,\n ),\n },\n\n // ── Information exposure ─────────────────────────────────────────────────\n {\n id: 'py-stack-trace-returned',\n title: 'stack trace returned to the caller',\n consequence:\n 'Tracebacks leak absolute paths, dependency versions and source fragments — the reconnaissance an attacker would otherwise have to guess at.',\n cwe: 'CWE-209',\n severity: 'medium',\n languages: ['python'],\n pattern: /\\breturn\\b[^\\n]*\\btraceback\\.(?:format_exc|format_exception|print_exc)\\s*\\(|\\breturn\\b[^\\n]*\\bstr\\s*\\(\\s*e\\s*\\)/,\n },\n {\n id: 'js-environment-exfiltration',\n title: 'process environment serialised into a payload',\n consequence:\n 'The environment is where every secret lives. Serialising it whole into a request body is credential exfiltration regardless of the endpoint.',\n cwe: 'CWE-532',\n severity: 'critical',\n languages: ['javascript', 'typescript'],\n pattern: /\\bJSON\\.stringify\\s*\\(\\s*\\{?[^)]*\\bprocess\\.env\\b(?!\\s*\\.)/,\n guard: false,\n },\n {\n id: 'js-credential-logged',\n title: 'credential read from the environment into a log sink',\n consequence:\n 'CI retains job logs, and on public forks it publishes them. A token printed once is a token leaked permanently.',\n cwe: 'CWE-532',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\b(?:token|apiKey|api_key|secret|password|credential|auth)\\w*\\s*:\\s*process\\.env\\.\\w+/i,\n requires: EXFIL_SINK,\n guard: false,\n guardBack: 4,\n guardForward: 1,\n },\n\n // ── Prototype pollution ──────────────────────────────────────────────────\n {\n id: 'js-prototype-pollution',\n title: 'write to a prototype-reachable key',\n consequence:\n 'An attacker-supplied `__proto__` key changes behaviour for every object in the process, including ones it never touched.',\n cwe: 'CWE-1321',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\[\\s*['\"]__proto__['\"]\\s*\\]|\\bObject\\s*\\.\\s*assign\\s*\\(\\s*[\\w.$]*\\.prototype\\b|\\.\\s*__proto__\\s*=/,\n },\n\n // ── Shell ────────────────────────────────────────────────────────────────\n //\n // `shell` was a language the type system knew about and no rule targeted, so\n // a repository written entirely in bash got secret detection and nothing\n // else. Installers, CI helpers and packaging scripts are where a great deal\n // of privileged work actually happens, and they run as whoever invoked them.\n {\n id: 'sh-remote-script-execution',\n title: 'network output piped into a shell',\n consequence:\n 'Whatever that URL serves at the moment this runs is executed as the invoking user. There is no version, no signature, and no review — a compromise of the host, or anyone able to answer for it, is a compromise of every machine that runs the script.',\n cwe: 'CWE-494',\n severity: 'high',\n languages: ['shell'],\n // The pipe must be the *next* thing: `curl -o f url && sh f` is a different\n // (and checkable) shape, and `curl url | jq` is not an execution at all.\n pattern: /\\b(?:curl|wget)\\b[^|\\n]*\\|\\s*(?:sudo\\s+(?:-\\S+\\s+)*)?(?:\\/bin\\/|\\/usr\\/bin\\/)?(?:ba|da|k|z|a)?sh\\b/,\n // This is a supply-chain review item, not proof that the repository is\n // compromised. A literal HTTPS installer URL is capped at medium; it only\n // escalates when nearby evidence shows that input can choose the download.\n guard: false,\n // Installer instructions printed by the script do not execute. Matching\n // them made a script report its own documentation as a network pipeline.\n lineGuard: /^\\s*(?:echo|printf|say|info|warn|error)\\s+[\"'][^\"'\\n]*\\b(?:curl|wget)\\b/,\n },\n {\n id: 'sh-eval-expansion',\n title: 'eval on an expanded string',\n consequence:\n 'The expansion is re-parsed as shell source, so a `;` or `$(…)` anywhere in the value runs as a command rather than arriving as data.',\n cwe: 'CWE-78',\n severity: 'high',\n languages: ['shell'],\n // Matched against eval's *argument*, not against the rest of the line.\n //\n // `\\beval\\b.*\\$` looks equivalent and is not: bash's ordinary dynamic-range\n // idiom, `eval echo {$((k + 1))..$((k + n))}`, contains `$k` inside the\n // arithmetic, so a line-wide search finds an expansion in a construct that\n // cannot carry a command — `$((…))` is parsed as an expression, where a `;`\n // is a syntax error rather than a second command. That spelling reported\n // 355 findings in one 3,500-line script, all of them the same safe loop.\n //\n // What is left is the form where eval is handed a value directly —\n // `eval \"$cmd\"`, `eval $cmd`, `eval \"$(…)\"` — which is the shape that\n // actually re-parses untrusted text as source. `eval echo $x` is not\n // covered; catching it without also catching the range idiom needs to know\n // which expansions are arithmetic, which is parsing, not matching.\n pattern: /\\beval\\s+(?:-\\S+\\s+)*(?:\"\\s*)?\\$(?:\\{?[A-Za-z_]\\w*|\\((?!\\())/,\n // The shell-init idiom `eval \"$(tool init -)\"` is the documented interface\n // of most version managers. It is still eval of program output, but the\n // program is a fixed local binary, and flagging it reports every developer\n // dotfile in existence.\n lineGuard:\n /\\beval\\s+\"?\\$\\(\\s*(?:ssh-agent|dircolors|direnv|rbenv|pyenv|nodenv|goenv|jenv|tfenv|opam|luarocks|conda|mamba|zoxide|starship|mise|asdf|fnm|nvm|brew|thefuck|register-python-argcomplete|_\\w+_completion)\\b/,\n },\n {\n id: 'sh-unquoted-expansion-destructive',\n title: 'unquoted expansion in a destructive command',\n consequence:\n 'An unquoted expansion is word-split and glob-expanded before the command sees it. A value with a space removes two paths instead of one; an empty value removes the argument entirely, which is how `rm -rf $DIR/` becomes `rm -rf /`.',\n cwe: 'CWE-78',\n severity: 'high',\n languages: ['shell'],\n // `[^\"'\\n]*?` cannot cross a quote, so `rm -rf \"$dir\"` — the correct form —\n // never reaches the `$` and never matches. Only a genuinely bare expansion\n // does. Restricted to recursive/forced removal: a bare `$f` in `rm $f` is\n // sloppy, but it is not the shape that erases a filesystem.\n pattern: /\\brm\\s+(?:-[a-zA-Z-]*[rRf][a-zA-Z-]*\\s+)+[^\"'\\n]*?\\$\\{?[A-Za-z_]/,\n },\n {\n id: 'sh-insecure-transport-flag',\n inherent: true,\n title: 'certificate verification disabled',\n consequence:\n 'Anyone positioned between this host and the server can substitute the response. When the response is a package, a key or a script, that is remote code execution with the transport doing nothing to stop it.',\n cwe: 'CWE-295',\n severity: 'high',\n languages: ['shell'],\n pattern:\n /\\b(?:curl|wget)\\b[^\\n|]*(?:\\s-k(?=\\s|$)|\\s--insecure\\b|\\s--no-check-certificate\\b)/,\n // Over plain HTTP there is no certificate to skip, so the flag is inert and\n // this rule has nothing to say — `sh-plaintext-download` is the finding\n // that fits. Reporting both put two entries on one line, one of which\n // recommended a fix that would change nothing.\n lineGuard: /^(?!.*https:\\/\\/).*\\bhttp:\\/\\//,\n },\n {\n id: 'sh-plaintext-download',\n inherent: true,\n title: 'download over plain HTTP',\n consequence:\n 'The response arrives unauthenticated over a channel any intermediary can rewrite. Where the payload is an archive, a package list or a key, substituting it is straightforward and leaves nothing for the script to notice.',\n cwe: 'CWE-319',\n severity: 'high',\n languages: ['shell'],\n pattern: /\\b(?:curl|wget)\\b[^\\n|]*\\bhttp:\\/\\//,\n // Loopback and link-local are not carried over a network anyone can sit on.\n lineGuard:\n /http:\\/\\/(?:localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|\\[::1\\]|169\\.254\\.|host\\.docker\\.internal)\\b/,\n },\n {\n id: 'sh-world-writable-permissions',\n inherent: true,\n title: 'world-writable permissions',\n consequence:\n 'Any local account can rewrite the file. If it is a script, a config or anything on a privileged path, the next process to read it runs someone else’s content.',\n cwe: 'CWE-732',\n severity: 'medium',\n languages: ['shell'],\n pattern: /\\bchmod\\s+(?:-[a-zA-Z-]+\\s+)*(?:0?777|a\\+rwx|ugo\\+rwx|a=rwx)\\b/,\n },\n {\n id: 'sh-predictable-temp-path',\n title: 'predictable temporary file',\n consequence:\n 'The name is guessable, so a local attacker can create it first — as a symlink to somewhere that matters — and the script writes through it with its own privileges.',\n cwe: 'CWE-377',\n severity: 'medium',\n languages: ['shell'],\n // Redirection or an explicit write into a literal `/tmp` path. A `$$` or\n // `$RANDOM` suffix is still predictable, so it is not treated as a fix;\n // `mktemp` is, and it is the guard below.\n pattern: /(?:>{1,2}\\s*|\\b(?:tee|touch|cp|mv|install)\\s+(?:-\\S+\\s+)*)\\/tmp\\/[\\w.$-]+/,\n guard: /\\bmktemp\\b/,\n guardBack: 6,\n guardForward: 2,\n },\n\n // ── PHP ──────────────────────────────────────────────────────────────────\n //\n // `php` was the second language in `ScanLanguage` that no rule targeted, for\n // the same reason `shell` was: nothing checks the two lists against each\n // other. `LANGUAGE_COVERAGE` in the tests does now.\n {\n id: 'php-sql-interpolation',\n title: 'SQL assembled by interpolation',\n consequence:\n 'PHP interpolates variables inside double-quoted strings, so the value is part of the statement before the driver ever sees it. A quote in the value ends the literal and the rest is parsed as SQL.',\n cwe: 'CWE-89',\n severity: 'critical',\n languages: ['php'],\n // Interpolation (`\"… $id …\"`, `\"… {$id} …\"`) or concatenation onto a SQL\n // string. A prepared statement passes placeholders and binds separately,\n // so its query string contains neither.\n pattern: new RegExp(\n `\\\\b(?:mysqli_query|mysql_query|pg_query|->\\\\s*(?:query|exec|unprepared))\\\\s*\\\\([^)]*(?:\"[^\"\\\\n]*(?:${SQL_KEYWORDS})\\\\b[^\"\\\\n]*(?:\\\\$\\\\w+|\\\\{\\\\$)|${SQL_STRING}\\\\s*\\\\.)`,\n 'i',\n ),\n },\n {\n id: 'php-shell-exec-interpolation',\n title: 'shell command built from a variable',\n consequence:\n 'The string is handed to `/bin/sh`, which interprets `;`, `|` and `$(…)` in whatever the variable held.',\n cwe: 'CWE-78',\n severity: 'critical',\n languages: ['php'],\n pattern:\n /\\b(?:exec|system|shell_exec|passthru|popen|proc_open|pcntl_exec)\\s*\\(\\s*(?:\"[^\"\\n]*(?:\\$\\w+|\\{\\$)|'[^'\\n]*'\\s*\\.|\\$\\w+\\s*\\.)/,\n // `escapeshellarg`/`escapeshellcmd` are the correct answer and are usually\n // applied inline, so a line-scoped guard is the right shape.\n lineGuard: /\\bescapeshell(?:arg|cmd)\\s*\\(/,\n },\n {\n id: 'php-dynamic-code-execution',\n title: 'dynamic code execution',\n consequence:\n 'Whatever reaches this call is executed as PHP source with the privileges of the web process.',\n cwe: 'CWE-95',\n severity: 'critical',\n languages: ['php'],\n pattern: /\\b(?:eval|assert|create_function)\\s*\\(\\s*(?:\\$\\w+|\"[^\"\\n]*(?:\\$\\w+|\\{\\$))/,\n guard: false,\n },\n {\n id: 'php-dynamic-file-inclusion',\n title: 'include path built from a variable',\n consequence:\n 'The included file is executed, not read. A traversal sequence reaches any file the process can open, and with a remote wrapper enabled the path need not be local at all.',\n cwe: 'CWE-98',\n severity: 'critical',\n languages: ['php'],\n pattern:\n /\\b(?:include|include_once|require|require_once)\\s*(?:\\(\\s*)?(?:\\$\\w+|\"[^\"\\n]*(?:\\$\\w+|\\{\\$)|'[^'\\n]*'\\s*\\.)/,\n // A basename-and-allow-list is the standard fix; `basename` alone still\n // leaves the extension open, but it defeats traversal, which is the part\n // this rule is about.\n lineGuard: /\\bbasename\\s*\\(/,\n },\n {\n id: 'php-unserialize-untrusted',\n title: 'unserialize on request data',\n consequence:\n 'PHP object deserialisation instantiates classes and runs their magic methods. With a suitable class in scope this is remote code execution, and no `unserialize` option short of `allowed_classes => false` prevents it.',\n cwe: 'CWE-502',\n severity: 'critical',\n languages: ['php'],\n pattern: /\\bunserialize\\s*\\(\\s*(?:\\$_(?:GET|POST|REQUEST|COOKIE)\\b|\\$\\w+)/,\n // The key is an array key and is normally quoted: `['allowed_classes' => false]`.\n lineGuard: /[\"']?allowed_classes[\"']?\\s*=>\\s*(?:false|\\[)/,\n needsContext: true,\n },\n {\n id: 'php-unescaped-output',\n title: 'request data echoed without escaping',\n consequence:\n 'The value is written into the response verbatim, so markup in it becomes markup in the page — script that runs with the victim’s session.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['php'],\n pattern:\n /\\b(?:echo|print)\\s+[^;\\n]*\\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\\b|<\\?=\\s*\\$_(?:GET|POST|REQUEST|COOKIE)\\b/,\n },\n {\n id: 'php-request-path-traversal',\n title: 'file path taken from the request',\n consequence:\n 'A `../` sequence in the value walks out of the intended directory, and the process reads or writes wherever it lands.',\n cwe: 'CWE-22',\n severity: 'high',\n languages: ['php'],\n pattern:\n /\\b(?:file_get_contents|file_put_contents|fopen|readfile|unlink|copy|rename|opendir|scandir)\\s*\\(\\s*[^)\\n]*\\$_(?:GET|POST|REQUEST|COOKIE)\\b/,\n lineGuard: /\\bbasename\\s*\\(|\\brealpath\\s*\\(/,\n },\n {\n id: 'php-variable-injection',\n title: 'request data expanded into local variables',\n consequence:\n '`extract` creates a variable per key, so a request can overwrite any local already in scope — including the one a subsequent authorisation check reads.',\n cwe: 'CWE-621',\n severity: 'high',\n languages: ['php'],\n pattern: /\\bextract\\s*\\(\\s*\\$_(?:GET|POST|REQUEST|COOKIE)\\b|\\bimport_request_variables\\s*\\(/,\n guard: false,\n },\n\n // ── Java and Go: classes the other languages already had ─────────────────\n //\n // Command injection, SSRF and path traversal were implemented for JavaScript\n // and, in part, for Go, and never for Java — so the same defect in the same\n // codebase was reported or not depending on which file it lived in. TLS\n // verification, weak hashing and insecure randomness are deliberately absent\n // here: `tls-verification-disabled`, `weak-hash-on-credential` and\n // `insecure-randomness-for-secret` are language-agnostic and already cover\n // both, including Go's `InsecureSkipVerify` and Java's `MessageDigest`.\n {\n id: 'java-runtime-exec-concatenation',\n title: 'Runtime.exec with a concatenated command',\n consequence:\n 'The single-string form of `exec` is split on whitespace and handed to the OS. A value carrying a space becomes extra arguments, and where a shell is invoked, `;` and `$(…)` become extra commands.',\n cwe: 'CWE-78',\n severity: 'critical',\n languages: ['java'],\n // The array form — `exec(new String[]{\"git\", arg})` — passes argv and is\n // the fix, so it is not matched: the `+` has to be inside the string\n // argument for this to fire.\n pattern:\n /\\b(?:Runtime\\s*\\.\\s*getRuntime\\s*\\(\\s*\\)\\s*\\.\\s*exec|ProcessBuilder)\\s*\\(\\s*(?:\"[^\"\\n]*\"\\s*\\+|\\w+\\s*\\+\\s*\")/,\n },\n {\n id: 'java-ssrf-outbound-request',\n title: 'outbound request to a computed URL',\n consequence:\n 'The destination is chosen by the caller, so the request can be aimed at internal services and cloud metadata endpoints that are reachable from this host and from nowhere else.',\n cwe: 'CWE-918',\n severity: 'high',\n languages: ['java'],\n pattern:\n /\\bnew\\s+URL\\s*\\(\\s*(?!\\s*\"[a-z]+:\\/\\/[^\"\\n]*\"\\s*\\))[^)\\n]*\\w|\\bHttpRequest\\s*\\.\\s*newBuilder\\s*\\(\\s*\\)\\s*\\.\\s*uri\\s*\\(\\s*URI\\s*\\.\\s*create\\s*\\(\\s*[^\"\\n)]/,\n needsContext: true,\n },\n {\n id: 'java-request-path-traversal',\n title: 'file path built from request data',\n consequence:\n 'A `../` sequence in the value walks out of the intended directory. The process then reads or writes wherever it lands, with its own privileges.',\n cwe: 'CWE-22',\n severity: 'high',\n languages: ['java'],\n pattern:\n /\\b(?:new\\s+File|new\\s+FileInputStream|new\\s+FileOutputStream|Paths\\s*\\.\\s*get|Files\\s*\\.\\s*(?:readAllBytes|newInputStream|newOutputStream|copy|delete))\\s*\\([^)\\n]*\\+/,\n // `getCanonicalPath().startsWith(base)` is the check that makes this safe,\n // and it is normally a line or two below the construction.\n guard: /getCanonicalPath|toRealPath|normalize\\s*\\(\\s*\\)|\\bstartsWith\\s*\\(/,\n guardForward: 4,\n needsContext: true,\n },\n {\n id: 'java-broken-cipher',\n inherent: true,\n title: 'broken cipher or ECB mode',\n consequence:\n 'DES, RC2, RC4 and Blowfish are broken or too small to rely on. ECB encrypts identical plaintext blocks to identical ciphertext blocks, so structure in the data survives encryption and is readable straight off the ciphertext.',\n cwe: 'CWE-327',\n severity: 'high',\n languages: ['java'],\n // Bare `\"AES\"` is included: the JCE resolves it to `AES/ECB/PKCS5Padding`,\n // so the default is the mode this rule exists to catch.\n pattern:\n /\\bCipher\\s*\\.\\s*getInstance\\s*\\(\\s*\"(?:DES|DESede|RC2|RC4|ARCFOUR|Blowfish)(?:\\/|\")|\\bCipher\\s*\\.\\s*getInstance\\s*\\(\\s*\"[^\"\\n]*\\/ECB\\/|\\bCipher\\s*\\.\\s*getInstance\\s*\\(\\s*\"AES\"\\s*\\)/,\n guard: false,\n },\n {\n id: 'go-request-path-traversal',\n title: 'file path built from request data',\n consequence:\n 'A `../` sequence in the value walks out of the intended directory, and the handler serves or writes whatever it reaches.',\n cwe: 'CWE-22',\n severity: 'high',\n languages: ['go'],\n pattern:\n /\\b(?:os\\s*\\.\\s*(?:Open|OpenFile|ReadFile|Create|Remove|WriteFile)|ioutil\\s*\\.\\s*(?:ReadFile|WriteFile)|http\\s*\\.\\s*ServeFile)\\s*\\([^)\\n]*(?:r\\s*\\.\\s*URL|FormValue|Query\\s*\\(\\s*\\)\\s*\\.\\s*Get|mux\\s*\\.\\s*Vars|\\bfilepath\\s*\\.\\s*Join\\s*\\([^)\\n]*\\w)/,\n // `filepath.Clean` alone does not bound the result to a directory, so it is\n // not a guard here — the containment check is.\n guard: /\\bstrings\\s*\\.\\s*HasPrefix\\s*\\(|\\bfilepath\\s*\\.\\s*Rel\\s*\\(|\\bfs\\s*\\.\\s*ValidPath\\s*\\(|\\bhttp\\s*\\.\\s*Dir\\b/,\n guardBack: 5,\n guardForward: 3,\n needsContext: true,\n },\n {\n id: 'go-template-escaping-bypass',\n title: 'value marked as pre-escaped HTML',\n consequence:\n '`template.HTML` tells `html/template` the value is already safe, which switches off the contextual escaping that makes the package worth using. Markup in the value reaches the page intact.',\n cwe: 'CWE-79',\n severity: 'high',\n languages: ['go'],\n // A conversion of a *variable*. `template.HTML(\"<br>\")` on a literal is a\n // constant the author wrote and is not a finding.\n pattern: /\\btemplate\\s*\\.\\s*(?:HTML|JS|CSS|HTMLAttr|URL|Srcset)\\s*\\(\\s*(?!\\s*[`\"])/,\n needsContext: true,\n },\n\n // ── Misconfiguration, weak crypto and the rest of the injection family ────\n //\n // Each of these is a defect the *line* shows — a debug flag left on, a\n // wildcard CORS origin, a key literal, a fast password hash — so the safe\n // counterpart in the corpus differs on something visible here, not three\n // functions away. The classes that genuinely need whole-function reasoning\n // (CSRF, IDOR, TOCTOU, missing authorization) are deliberately still absent;\n // see KNOWN_GAPS.\n {\n id: 'py-framework-debug-enabled',\n title: 'debug mode enabled',\n consequence:\n 'Framework debug mode serves an interactive traceback console on any error — arbitrary code execution to whoever triggers it — and leaks source and configuration.',\n cwe: 'CWE-489',\n severity: 'high',\n languages: ['python'],\n pattern: /\\bDEBUG['\"\\]]*\\s*[=:]\\s*True\\b|\\.\\s*run\\s*\\([^)\\n]*\\bdebug\\s*=\\s*True\\b/,\n inherent: true,\n },\n {\n id: 'js-cors-wildcard-credentials',\n title: 'wildcard CORS origin with credentials',\n consequence:\n 'A `*` origin combined with credentials lets any site read authenticated responses on the victim’s behalf: the browser attaches their cookies and hands the result to the attacker’s page.',\n cwe: 'CWE-942',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /origin\\s*:\\s*['\"`]\\*['\"`][^\\n]*credentials\\s*:\\s*true|credentials\\s*:\\s*true[^\\n]*origin\\s*:\\s*['\"`]\\*['\"`]/,\n inherent: true,\n },\n {\n id: 'js-cookie-insecure-flag',\n title: 'cookie set with Secure disabled',\n consequence:\n 'Without Secure the cookie travels over plain HTTP, where anyone on the path reads it. A session cookie set this way is a session anyone can lift.',\n cwe: 'CWE-614',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n pattern: /\\.\\s*cookie\\s*\\([^\\n]*\\bsecure\\s*:\\s*false\\b/i,\n },\n {\n id: 'js-hardcoded-crypto-key',\n title: 'hardcoded key material',\n consequence:\n 'A key committed to source is a key everyone with the repo has. The encryption it backs protects nothing once the source is shared, forked or leaked.',\n cwe: 'CWE-321',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\b(?:key|secret|iv|passphrase|salt|hmac)\\w*\\s*=\\s*Buffer\\s*\\.\\s*from\\s*\\(\\s*['\"`]/i,\n fileRequires: /\\bcrypto\\b|createCipheriv|createDecipheriv|createHmac/,\n },\n {\n id: 'py-hardcoded-secret-key',\n title: 'hardcoded application secret',\n consequence:\n 'A signing secret in source lets anyone with the code forge what it signs — session cookies, tokens, password-reset links.',\n cwe: 'CWE-798',\n severity: 'high',\n languages: ['python'],\n // Assigned a *string literal*. A value from a provider call (`os.environ`,\n // `secret_provider(...)`) is the correct shape and starts with an\n // identifier after the `=`, not a quote.\n pattern:\n /\\b(?:SECRET_KEY|JWT_SECRET|SIGNING_KEY|SESSION_SECRET|PRIVATE_KEY)['\"\\]]*\\s*[=:]\\s*['\"`][^'\"`\\n]{6,}/,\n },\n {\n id: 'py-ldap-injection',\n title: 'LDAP filter built by interpolation',\n consequence:\n 'Unescaped input in an LDAP filter lets an attacker rewrite the query — widening a match, bypassing a check, or enumerating the directory.',\n cwe: 'CWE-90',\n severity: 'high',\n languages: ['python'],\n // An f-string whose content is an LDAP filter (`(&…` / `(|…`) with an\n // interpolation. One variant per quote so an inner `'` inside a `\"`-string\n // does not end the class early.\n pattern: /\\bf\"[^\"\\n]*\\([&|][^\"\\n]*\\{[^}\\n]+\\}|\\bf'[^'\\n]*\\([&|][^'\\n]*\\{[^}\\n]+\\}/,\n // The guard is an escaper *call*, not the mere presence of `escape` — the\n // module-level `from ldap.filter import escape_filter_chars` sits in every\n // window and would otherwise exonerate the unescaped filter too.\n guard: /\\bescape\\w*\\s*\\(/i,\n },\n {\n id: 'py-xpath-injection',\n title: 'XPath built by interpolation',\n consequence:\n 'Unescaped input in an XPath expression lets an attacker rewrite the query and read nodes it was meant to exclude.',\n cwe: 'CWE-643',\n severity: 'high',\n languages: ['python'],\n // Per-quote, so an inner `'` in a `\"`-delimited f-string (`text()='{x}'`)\n // does not truncate the match before the interpolation.\n pattern:\n /\\bf\"[^\"\\n]*(?:\\/\\/|\\/\\w+\\[)[^\"\\n]*\\{[^}\\n]+\\}|\\bf'[^'\\n]*(?:\\/\\/|\\/\\w+\\[)[^'\\n]*\\{[^}\\n]+\\}/,\n },\n {\n id: 'py-fast-password-hash',\n title: 'password hashed with a fast digest',\n consequence:\n 'SHA-2 is built to be fast, which is exactly wrong for a password: a leaked hash is brute-forced at billions of guesses a second. Passwords need a slow, salted KDF (bcrypt, scrypt, argon2, PBKDF2).',\n cwe: 'CWE-759',\n severity: 'high',\n languages: ['python'],\n pattern:\n /\\bhashlib\\s*\\.\\s*(?:sha224|sha256|sha384|sha512)\\s*\\([^)\\n]*(?:password|passwd|passphrase|pwd)/i,\n guard: /pbkdf2|scrypt|bcrypt|argon/i,\n },\n {\n id: 'py-plaintext-password-retained',\n title: 'plaintext password stored',\n consequence:\n 'A record that keeps the password itself, not a hash, turns one database leak into every user’s credential — reused across every other site they log into.',\n cwe: 'CWE-256',\n severity: 'high',\n languages: ['python'],\n pattern: /['\"]password['\"]\\s*:\\s*(?:form|request|req|data|payload|body|params)\\b/i,\n },\n {\n id: 'js-timing-unsafe-mac-compare',\n title: 'MAC or signature compared with ==',\n consequence:\n '`===` on a signature returns the moment a byte differs, so response time leaks how much of a forged signature is correct — enough to recover a valid one byte by byte. Use `crypto.timingSafeEqual`.',\n cwe: 'CWE-208',\n severity: 'medium',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\b\\w*(?:[Ss]ignature|[Hh]mac|[Dd]igest)\\s*===?\\s*\\w|\\w\\s*===?\\s*\\w*(?:[Ss]ignature|[Hh]mac|[Dd]igest)\\b/,\n // Comparing `.length` is the *safe* preamble to a constant-time check, not\n // the timing-unsafe value comparison this rule is about — and the\n // `timingSafeEqual` that follows it sits forward of the line, out of the\n // backward guard window.\n lineGuard: /\\.\\s*length\\b/,\n guard: /timingSafeEqual/,\n },\n {\n id: 'js-predictable-cipher-iv',\n title: 'static initialization vector',\n consequence:\n 'A fixed IV reused across encryptions leaks whether two plaintexts are equal and, in CBC/CTR, breaks confidentiality outright. The IV must be random per message.',\n cwe: 'CWE-329',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern: /\\b\\w*[Ii][Vv]\\s*=\\s*Buffer\\s*\\.\\s*(?:alloc|from)\\s*\\(/,\n fileRequires: /createCipheriv|\\bcrypto\\b/,\n guard: /randomBytes|randomFill/,\n },\n // A rule for `Math.random().toString(36)` was tried and dropped: the exact\n // shape generates security tokens *and* benign callback/correlation ids\n // (Capacitor's native bridge uses it for the latter), with no line-visible\n // signal between them. The credential-scoped `insecure-randomness-for-secret`\n // above still catches the `token = …Math.random…` case; the bare shape is\n // left alone rather than flagged on every id generator.\n {\n id: 'js-mass-assignment',\n title: 'mass assignment from request data',\n consequence:\n 'Copying the whole request body onto a record lets a caller set fields you never exposed — `isAdmin`, `role`, `balance` — because nothing stands between the input and the object.',\n cwe: 'CWE-915',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\bObject\\s*\\.\\s*assign\\s*\\([^,\\n]+,\\s*(?:req|request|ctx)\\s*\\.\\s*(?:body|query|params)\\b/,\n },\n {\n id: 'js-header-injection',\n title: 'response header set from request input',\n consequence:\n 'A CR/LF in the value splits the response — the attacker injects headers or a whole second response (cache poisoning, a forged Set-Cookie).',\n cwe: 'CWE-113',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\.\\s*(?:setHeader|header|set)\\s*\\(\\s*['\"`][^'\"`\\n]+['\"`]\\s*,\\s*(?:req|request|ctx)\\s*\\.\\s*(?:query|body|params|headers)\\b/,\n },\n {\n id: 'js-nosql-injection',\n title: 'NoSQL query built from request data',\n consequence:\n 'A request object passed straight to `find`/`update` lets the caller supply MongoDB operators — `{\"$ne\": null}`, `{\"$gt\": \"\"}`, `{\"$where\": \"…\"}` — turning a lookup into an authentication bypass or arbitrary query.',\n cwe: 'CWE-943',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\.\\s*(?:find|findOne|findOneAndUpdate|updateOne|updateMany|update|deleteOne|deleteMany|remove|count|countDocuments|aggregate)\\s*\\(\\s*(?:req|request|ctx)\\s*\\.\\s*(?:body|query|params)\\b/,\n },\n {\n id: 'js-host-header-trust',\n title: 'URL built from the Host header',\n consequence:\n 'The Host header is attacker-controlled. Building a link from it — a password-reset URL above all — lets an attacker point the victim’s reset token at a domain they control.',\n cwe: 'CWE-346',\n severity: 'high',\n languages: ['javascript', 'typescript'],\n pattern:\n /\\$\\{[^}\\n]*\\breq(?:uest)?\\s*\\.\\s*(?:headers\\s*\\.\\s*host|hostname|host)\\b|['\"`]\\s*\\+\\s*req(?:uest)?\\s*\\.\\s*(?:headers\\s*\\.\\s*host|hostname)\\b/,\n /**\n * Parsing the request's own URL is not building a link from the Host\n * header, even though it is spelled with one.\n *\n * const url = new URL(request.url, `http://${request.headers.host}`);\n * const token = url.searchParams.get('token');\n *\n * `request.url` on a Node server is a path — `/ws?token=…` — and `new URL`\n * refuses a relative input without a base. The base exists to satisfy the\n * parser and is thrown away; only the path and query are ever read. Every\n * Node HTTP handler that wants a query parameter is written this way, so\n * the rule fired on the framework idiom rather than on the defect.\n *\n * Narrow on purpose: the first argument must be `req.url` itself. The\n * dangerous shape passes a *path* the application chose —\n * `new URL('/reset?t=…', `https://${req.headers.host}`)` — and that is what\n * produces an attacker-controlled link. It does not match this guard.\n */\n lineGuard: /\\bnew\\s+URL\\s*\\(\\s*(?:req|request|ctx)(?:uest)?\\s*\\.\\s*url\\b\\s*,/,\n },\n // A recursive-merge prototype-pollution rule (`target[key] = source[key]`\n // with no `__proto__` guard) was built and dropped. The bare copy-by-key is\n // the safe allow-listed shape (`updates[field] = body[field]` over an\n // `allowedFields` list) as often as the vulnerable one; whether it is a sink\n // depends on where the key comes from and which of endless guard idioms\n // filters it — a whole-function question this line-oriented engine does not\n // answer. It flagged legitimate merges in Capacitor and in this repo's own\n // web app. `js-prototype-pollution` still catches the explicit `__proto__`\n // literal; the recursive-merge case is left to KNOWN_GAPS.\n\n // Node-ecosystem classes — vm2, Electron, JWT, archive extraction, headless\n // browsers — are kept in their own table because each has to know which\n // package it is looking at before it can claim anything. Folded in here so\n // there stays exactly one rule list for every consumer to iterate.\n ...NODE_RULES,\n];\n\n/**\n * Classes deliberately not implemented, and why.\n *\n * Recorded in code rather than in a document because the reason is a design\n * constraint, not a backlog item: each of these needs reasoning this scanner\n * does not do, and the line-oriented approximation of each one flags ordinary\n * software. A missing detection is a known number. A rule that fires on every\n * session read is a scanner nobody runs twice.\n */\nexport const KNOWN_GAPS: readonly { cwe: string; name: string; why: string }[] = [\n {\n cwe: 'CWE-352',\n name: 'Missing CSRF token',\n why: 'Requires knowing that a handler is state-changing and that no token check dominates the mutation. Line-locally, the vulnerable and the guarded handler are the same code.',\n },\n {\n cwe: 'CWE-362',\n name: 'Check-then-use race (TOCTOU)',\n why: 'Requires pairing a check with a later use of the same path across statements. A rule matching either half alone flags every `os.path.exists`.',\n },\n {\n cwe: 'CWE-190',\n name: 'Integer overflow / unchecked narrowing',\n why: 'Requires range reasoning about the operands. Flagging arithmetic on a request value would flag arithmetic.',\n },\n {\n cwe: 'CWE-1321',\n name: 'Prototype pollution via generic dynamic assignment',\n why: '`target[key] = source[key]` is both the vulnerable merge and the guarded one; only a denylist several lines away distinguishes them. The explicit `__proto__` shapes are covered.',\n },\n];\n\nexport interface MatchContext {\n /** All lines of the file, 0-indexed. */\n lines: readonly string[];\n /** 0-indexed position of the line being tested. */\n index: number;\n language: ScanLanguage;\n /**\n * Indexes inside a multi-line string or block comment, from `proseLines`.\n * Treated exactly like comment lines: not scanned, not guard evidence.\n */\n prose?: ReadonlySet<number>;\n}\n\nconst COMMENT_PREFIX = /^\\s*(?:\\/\\/|\\/\\*|\\*|#|--|<!--)/;\n\n/**\n * A line that introduces a name rather than doing something with it.\n *\n * Excluded from guard windows because a *name* is not evidence. The corpus\n * contains `def sanitize_path_vulnerable(path):` directly above three\n * catastrophic-backtracking regexes: reading that signature as proof of\n * sanitisation suppressed all three. Naming a function `sanitize` does not\n * sanitise anything, and neither does calling one `validate` or `escape`.\n */\nconst DEFINITION_PREFIX =\n /^\\s*(?:(?:export|public|private|protected|static|final|async|abstract)\\s+)*(?:def|function|func|class|module|interface|struct|impl|fn|sub)\\b/;\n\n/**\n * Comment lines are documentation, not code.\n *\n * Excluded from guard windows for a reason found the hard way: the testbed's\n * vulnerable cases carry comments like \"No `__proto__` guard\" and \"without\n * allow-list validation\". Reading those as evidence of a guard suppresses\n * exactly the findings the corpus exists to measure.\n */\nexport function isComment(line: string): boolean {\n return COMMENT_PREFIX.test(line);\n}\n\n/**\n * Line indexes belonging to multi-line strings and block comments.\n *\n * Python module docstrings are the case that forced this. Every file in the\n * testbed opens with a `\"\"\"…\"\"\"` header describing the vulnerability it\n * contains — `pickle.loads`, `(a+)+`, `autoescape=False` — and scanning that\n * prose produces findings *about the documentation*, reported at line 9 of a\n * file whose code starts at line 18. They are unattributable by construction,\n * and they are the scanner reading its own description back to itself.\n */\nexport function proseLines(lines: readonly string[]): Set<number> {\n const inside = new Set<number>();\n let delimiter: string | null = null;\n\n lines.forEach((line, index) => {\n if (delimiter) {\n inside.add(index);\n if (line.includes(delimiter)) delimiter = null;\n return;\n }\n for (const candidate of ['\"\"\"', \"'''\"]) {\n const start = line.indexOf(candidate);\n if (start === -1) continue;\n // A docstring opened and closed on one line encloses nothing.\n if (line.indexOf(candidate, start + candidate.length) !== -1) return;\n delimiter = candidate;\n inside.add(index);\n return;\n }\n });\n\n return inside;\n}\n\nfunction skippable(line: string, index: number, prose?: ReadonlySet<number>): boolean {\n return isComment(line) || DEFINITION_PREFIX.test(line) || (prose?.has(index) ?? false);\n}\n\nfunction windowText(\n lines: readonly string[],\n index: number,\n back: number,\n forward: number,\n prose?: ReadonlySet<number>,\n): string {\n const from = Math.max(0, index - back);\n const to = Math.min(lines.length - 1, index + forward);\n const collected: string[] = [];\n for (let i = from; i <= to; i += 1) {\n const line = lines[i] ?? '';\n if (i !== index && skippable(line, i, prose)) continue;\n collected.push(line);\n }\n return collected.join('\\n');\n}\n\n/**\n * Whole-file text, memoised on the `lines` array it came from.\n *\n * `fileRequires` asks a question no window can answer, but joining the file on\n * every line of every rule would make scanning quadratic in file length. The\n * caller already reuses one `lines` array for the whole file, so keying on its\n * identity gives one join per file. A `WeakMap` keeps nothing alive after the\n * file is done with.\n */\nconst FILE_TEXT = new WeakMap<readonly string[], string>();\n\nfunction fileTextOf(lines: readonly string[]): string {\n let text = FILE_TEXT.get(lines);\n if (text === undefined) {\n text = lines.join('\\n');\n FILE_TEXT.set(lines, text);\n }\n return text;\n}\n\nexport interface RuleMatch {\n rule: CodeRule;\n confidence: Confidence;\n severity: Severity;\n}\n\n/**\n * Test one rule against one line.\n *\n * Returns `null` when the rule does not apply, does not match, is guarded, or\n * needs context it cannot see.\n */\n/**\n * Blank out single-quoted spans before looking for untrusted input.\n *\n * The shell performs no expansion inside single quotes, so a `$1` there is the\n * two characters `$1` and never a positional parameter. Without this, an awk\n * or sed program written inline — `gawk -F '=' '{print $2}'` — reads as\n * attacker-controlled input.\n *\n * That was not theoretical. In `ralyodio/debtap` it escalated one `curl -k`\n * line to `contextual`, and the ±6-line window carried the escalation to four\n * neighbouring findings, so the same defect reported `high` on lines 103–111\n * and `medium` on 113, 120 and 128 — decided entirely by distance from an awk\n * one-liner. A `--fail-on high` gate would have caught five of eight identical\n * problems.\n */\nfunction withoutSingleQuoted(text: string): string {\n return text.replace(/'[^'\\n]*'/g, \"''\");\n}\n\n/**\n * The callees of every call still open at the start of this line.\n *\n * A bracket walk over the preceding window, skipping string bodies so that a\n * parenthesis inside a message — `log('oops :(')` — does not unbalance it.\n * Returned outermost-first; a rule usually only cares whether *any* of them\n * matches.\n *\n * The walk starts mid-file, so a `)` closing a call opened before the window\n * pops an empty stack. That direction is safe: it can only lose an enclosing\n * name, never invent one, and a lost name means the finding is still reported.\n */\n/**\n * The dotted name immediately left of `open`, walking backwards from it.\n *\n * A backwards scan rather than `/([\\w$.]*)\\s*$/` over `text.slice(0, open)`:\n * the slice copies the whole prefix and the match rescans it, once per\n * parenthesis, which is quadratic on a long window for an answer that is\n * always the last few characters.\n */\nfunction calleeEndingAt(text: string, open: number): string {\n let end = open;\n while (end > 0 && (text[end - 1] === ' ' || text[end - 1] === '\\t')) end -= 1;\n let start = end;\n while (start > 0 && /[\\w$.]/.test(text[start - 1]!)) start -= 1;\n return text.slice(start, end);\n}\n\nexport function enclosingCallees(\n lines: readonly string[],\n index: number,\n back: number,\n): string[] {\n const before = lines.slice(Math.max(0, index - back), index).join('\\n');\n const stack: string[] = [];\n let quote: string | null = null;\n\n for (let i = 0; i < before.length; i += 1) {\n const ch = before[i]!;\n if (quote) {\n if (ch === '\\\\') i += 1;\n else if (ch === quote) quote = null;\n continue;\n }\n if (ch === '\"' || ch === \"'\" || ch === '`') quote = ch;\n else if (ch === '(') stack.push(calleeEndingAt(before, i));\n else if (ch === ')') stack.pop();\n }\n return stack;\n}\n\n/**\n * Every `${…}` on the line, or `null` if there are none to account for.\n *\n * Scanned rather than matched. The obvious `/\\$\\{([^}]*)\\}/g` is polynomial —\n * on a line of many unclosed `${`, each start position rescans to the end —\n * and a scanner that can be stalled by the file it is reading is a denial of\n * service in a CI gate. This repository reports that class as\n * `redos-nested-quantifier`; it should not ship it.\n *\n * `null` for an unterminated `${`, which is the safe direction: the caller\n * exonerates only when it can account for *every* interpolation, so refusing\n * to answer leaves the finding reported.\n */\nfunction interpolations(line: string): string[] | null {\n const found: string[] = [];\n for (let i = 0; ; ) {\n const start = line.indexOf('${', i);\n if (start === -1) break;\n const end = line.indexOf('}', start + 2);\n if (end === -1) return null;\n found.push(line.slice(start + 2, end).trim());\n i = end + 1;\n }\n return found.length > 0 ? found : null;\n}\n\n/** Is `name` bound in this file to a `const` holding a plain string literal? */\nfunction isConstantString(name: string, fileText: string): boolean {\n const escaped = name.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n return new RegExp(\n `\\\\bconst\\\\s+${escaped}\\\\s*(?::[^=\\\\n]+)?=\\\\s*(?:'[^'\\\\n]*'|\"[^\"\\\\n]*\"|\\`[^\\`$\\\\n]*\\`)`,\n ).test(fileText);\n}\n\n/**\n * Is a `dangerouslySetInnerHTML` value explicitly made safe on this line, or\n * a `const` whose sole binding was made safe earlier in the file?\n *\n * This intentionally recognises only explicit sanitizer/escaper names. It\n * does not treat a variable called `html` as trustworthy; the source must\n * visibly pass through an operation whose contract is HTML-safe output.\n */\nfunction hasSanitizedHtmlValue(line: string, fileText: string): boolean {\n const direct = /\\b__html\\s*:\\s*(?:[A-Za-z_$][\\w$]*\\s*\\.\\s*)?(?:sanitize\\w*|escape\\w*|serializeJsonForHtml|renderSanitizedMarkdown)\\s*\\(/i;\n if (direct.test(line)) return true;\n\n const value = /\\b__html\\s*:\\s*([A-Za-z_$][\\w$]*)\\b/.exec(line)?.[1];\n if (!value) return false;\n\n const escaped = value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n return new RegExp(\n `\\\\bconst\\\\s+${escaped}\\\\s*=[^\\\\n;]*(?:[A-Za-z_$][\\\\w$]*\\\\s*\\\\.\\\\s*)?(?:sanitize\\\\w*|escape\\\\w*|serializeJsonForHtml|renderSanitizedMarkdown)\\\\s*\\\\(`,\n 'i',\n ).test(fileText);\n}\n\nfunction isIdentifierStart(char: string | undefined): boolean {\n if (!char) return false;\n const code = char.charCodeAt(0);\n return char === '$' || char === '_' || (code >= 65 && code <= 90) || (code >= 97 && code <= 122);\n}\n\nfunction isIdentifierPart(char: string | undefined): boolean {\n if (isIdentifierStart(char)) return true;\n if (!char) return false;\n const code = char.charCodeAt(0);\n return code >= 48 && code <= 57;\n}\n\nfunction identifierAfter(text: string, start: number): string | null {\n let index = start;\n while (text[index] === ' ' || text[index] === '\\t') index += 1;\n if (!isIdentifierStart(text[index])) return null;\n const from = index;\n while (isIdentifierPart(text[index])) index += 1;\n return text.slice(from, index);\n}\n\n/** Does the redirected variable come from an explicit local-path validator? */\nfunction hasSafeRedirectValue(line: string, fileText: string): boolean {\n const location = line.indexOf('window.location');\n const redirect = line.indexOf('.redirect');\n const valueStart = location >= 0\n ? line.indexOf('=', location) + 1\n : redirect >= 0\n ? line.indexOf('(', redirect) + 1\n : 0;\n if (valueStart === 0) return false;\n\n const value = identifierAfter(line, valueStart);\n if (!value) return false;\n\n const declaration = `const ${value}`;\n for (const candidate of fileText.split('\\n')) {\n const at = candidate.indexOf(declaration);\n if (at === -1 || isIdentifierPart(candidate[at - 1]) || isIdentifierPart(candidate[at + declaration.length])) {\n continue;\n }\n const equals = candidate.indexOf('=', at + declaration.length);\n const initializer = candidate.slice(equals + 1);\n if (\n equals !== -1 &&\n ['safeRedirectPath(', 'safeRedirectUrl(', 'safeRedirectURL('].some((call) => initializer.includes(call))\n ) {\n return true;\n }\n }\n return false;\n}\n\n/**\n * Does every interpolation on this line resolve to a file-local constant?\n *\n * False when there are no interpolations at all: the concatenation spellings\n * of the same rules (`exec('cmd ' + arg)`) have nothing to resolve and must\n * stay reported.\n */\nexport function interpolationsAreConstant(line: string, fileText: string): boolean {\n const found = interpolations(line);\n if (!found) return false;\n return found.every(\n (expr) => /^[A-Za-z_$][\\w$]*$/.test(expr) && isConstantString(expr, fileText),\n );\n}\n\n/**\n * How far below an allocation a fill is still credibly *the* fill for it.\n *\n * Sixteen because the shape that motivated this is a ring-buffer read: the\n * allocation, an early return for the empty case, three or four lines working\n * out the wrap-around offsets, then the copies. Ten lines was not enough for\n * it. Past this the write is more likely to belong to something else, and the\n * finding should stand.\n */\nconst FILL_LOOKAHEAD = 16;\n\n/**\n * An identifier, matched only where one can actually begin.\n *\n * The lookbehind is load-bearing rather than decoration. `[A-Za-z_$][\\w$]*`\n * can start at *every* position inside a run of `$`, so a long run costs a\n * restart per character and the match is quadratic in line length. This\n * repository reports that class as `redos-nested-quantifier` and CodeQL\n * reports it as `js/polynomial-redos`; it should not ship it.\n */\nconst NAME = String.raw`(?<![\\w$])([A-Za-z_$][\\w$]*)`;\n\nconst ALLOCATION_BINDING = new RegExp(\n `${NAME}\\\\s*=\\\\s*(?:new\\\\s+Buffer\\\\s*\\\\(|Buffer\\\\s*\\\\.\\\\s*allocUnsafe(?:Slow)?\\\\s*\\\\()`,\n);\n\n/**\n * The name an uninitialised allocation on this line is bound to, if any.\n *\n * Declarations and plain assignments both. A property target such as\n * `this.buf = Buffer.allocUnsafe(n)` reduces to `buf`, which is how the writes\n * that follow will spell it.\n */\nfunction allocationBinding(line: string): string | null {\n return ALLOCATION_BINDING.exec(line)?.[1] ?? null;\n}\n\n/**\n * The spellings that write into a buffer: copied into as a destination, filled\n * or written through its own methods, `set` from a typed array, or assigned\n * per index.\n *\n * Fixed patterns that *capture* a name, rather than a pattern built by\n * interpolating the binding into `new RegExp`. The first version did the\n * latter and went wrong three ways at once — the name had to be escaped, the\n * escaper missed backslashes, and the constructed pattern was itself\n * polynomial on a name of many `$`. All three stop existing once the name is\n * compared as a string instead of spliced into a regex.\n */\nconst WRITE_SHAPES: readonly RegExp[] = [\n // `src.copy(name, …)` — name is the destination.\n /\\.\\s*copy\\s*\\(\\s*([A-Za-z_$][\\w$]*)\\s*[,)]/g,\n // `name.fill(…)`, `name.write*(…)`, `name.set(…)`.\n new RegExp(`${NAME}\\\\s*\\\\.\\\\s*(?:fill|set|write[A-Za-z0-9]*)\\\\s*\\\\(`, 'g'),\n // `name[i] = …`, but not `name[i] === …`.\n new RegExp(`${NAME}\\\\s*\\\\[[^\\\\]\\\\n]*\\\\]\\\\s*=(?!=)`, 'g'),\n];\n\n/** Does anything in `text` write into the buffer bound to `name`? */\nfunction writesInto(text: string, name: string): boolean {\n for (const shape of WRITE_SHAPES) {\n // Module-level and `g`, so the cursor from the previous call is still on\n // it. Reset before use rather than allocating a regex per line.\n shape.lastIndex = 0;\n for (let found = shape.exec(text); found !== null; found = shape.exec(text)) {\n if (found[1] === name) return true;\n }\n }\n return false;\n}\n\n/**\n * True when the buffer allocated on this line is filled before it escapes.\n *\n * Looks forward only. Code that fills a buffer runs after the allocation, by\n * definition — there is nothing above it to find.\n */\nexport function bufferFilledBeforeUse(ctx: MatchContext): boolean {\n const line = ctx.lines[ctx.index] ?? '';\n\n // `Buffer.allocUnsafe(n).fill(0)` — filled in the same breath, and there is\n // no binding to follow because none is needed.\n if (/\\ballocUnsafe(?:Slow)?\\s*\\([^)\\n]*\\)\\s*\\.\\s*fill\\s*\\(/.test(line)) return true;\n\n const name = allocationBinding(line);\n if (!name) return false;\n\n // The allocation line itself first: `const b = Buffer.allocUnsafe(n); b.fill(0);`\n // is one line, and a rule that missed it would be answering a question about\n // formatting rather than about the code. Only the part after the `=`, so the\n // binding on the left is not read as a write to itself.\n if (writesInto(line.slice(line.indexOf('=') + 1), name)) return true;\n\n const last = Math.min(ctx.lines.length - 1, ctx.index + FILL_LOOKAHEAD);\n for (let i = ctx.index + 1; i <= last; i += 1) {\n const next = ctx.lines[i] ?? '';\n if (skippable(next, i, ctx.prose)) continue;\n if (writesInto(next, name)) return true;\n }\n return false;\n}\n\nexport function evaluateRule(rule: CodeRule, ctx: MatchContext): RuleMatch | null {\n if (rule.languages && !rule.languages.includes(ctx.language)) return null;\n\n const line = ctx.lines[ctx.index] ?? '';\n if (isComment(line) || ctx.prose?.has(ctx.index)) return null;\n if (!rule.pattern.test(line)) return null;\n\n // Before any window work: a rule whose file-level precondition fails does not\n // apply to this file at all.\n if (rule.fileRequires && !rule.fileRequires.test(fileTextOf(ctx.lines))) return null;\n\n const back = rule.guardBack ?? 8;\n const forward = rule.guardForward ?? 0;\n const context = windowText(ctx.lines, ctx.index, back, forward, ctx.prose);\n\n if (rule.requires && !rule.requires.test(context)) return null;\n\n if (rule.lineGuard?.test(line)) return null;\n\n if (rule.enclosingCallGuard) {\n const callees = enclosingCallees(ctx.lines, ctx.index, back);\n if (callees.some((callee) => rule.enclosingCallGuard!.test(callee))) return null;\n }\n\n if (rule.constantInterpolationGuard && interpolationsAreConstant(line, fileTextOf(ctx.lines))) {\n return null;\n }\n\n if (rule.sanitizedHtmlGuard && hasSanitizedHtmlValue(line, fileTextOf(ctx.lines))) {\n return null;\n }\n\n if (rule.safeRedirectGuard && hasSafeRedirectValue(line, fileTextOf(ctx.lines))) {\n return null;\n }\n\n if (rule.filledBeforeUseGuard && bufferFilledBeforeUse(ctx)) return null;\n\n const guard = rule.guard === undefined ? GENERIC_GUARD : rule.guard;\n if (guard && (guard.test(line) || guard.test(context))) return null;\n\n const untrusted = untrustedPatternFor(ctx.language);\n const probeLine = ctx.language === 'shell' ? withoutSingleQuoted(line) : line;\n const probeContext = ctx.language === 'shell' ? withoutSingleQuoted(context) : context;\n const contextual = untrusted.test(probeLine) || untrusted.test(probeContext);\n if (rule.needsContext && !contextual) return null;\n\n // `inherent` short-circuits the whole context question. See the field's\n // documentation: for these rules the construct is the defect, so nearby\n // input cannot make it worse and its absence cannot make it better.\n const confidence: Confidence = rule.inherent\n ? 'evidence'\n : contextual\n ? 'contextual'\n : 'pattern';\n return { rule, confidence, severity: severityFor(rule.severity, confidence) };\n}\n","/**\n * Template-file rules: unescaped output, per engine.\n *\n * Why this is a separate engine\n * -----------------------------\n * `code-rules.ts` reasons about source code — it knows what a call looks like,\n * what a string literal looks like, and which identifiers carry request data.\n * A Handlebars file has none of that. It is markup with holes in it, and the\n * only security question worth asking is which holes skip escaping.\n *\n * That question is answered by *syntax*, and every engine spells it\n * differently: Handlebars has a triple-stache, Pug prefixes with `!`, EJS uses\n * a different tag character from the one that escapes, Dust hangs an `|s`\n * filter on the end. So a template rule is selected by file extension rather\n * than by language — the extension is what identifies the engine, and nothing\n * inside the file reliably does.\n *\n * Extension, not language, for a second reason: `.vue` and `.ejs` are already\n * mapped to `javascript` so their `<script>` halves get the full code rule\n * set. Remapping them to a `template` language to reach these rules would take\n * that away. Running the two engines over the same file, keyed differently, is\n * what njsscan does as well, and for the same reason.\n *\n * What these rules claim\n * ----------------------\n * Only that the interpolation does not escape. Not that the value is\n * attacker-controlled — a template cannot show that, and the variable is very\n * often a CMS body that was sanitised on the way in, which is the legitimate\n * reason to reach for unescaped output at all.\n *\n * So every rule here reports at confidence `pattern`, which the shared cap in\n * `types.ts` holds at `medium` however high the rule declares itself. That is\n * the honest ceiling for \"this line opts out of the engine's escaping\" with no\n * further evidence, and it keeps a template-heavy repository from filling a\n * report with `high` findings that nobody can triage.\n *\n * Provenance: the set of engines covered was chosen by looking at what njsscan\n * (LGPL-3.0) reports on, so this MIT package would not have a blind spot an\n * established Node scanner covers. The patterns, guards and prose are written\n * from scratch — see the note at the top of `node-rules.ts`.\n */\n\nimport type { Severity } from './types';\nimport { severityFor } from './types';\n\nexport interface TemplateRule {\n id: string;\n title: string;\n consequence: string;\n cwe: string;\n severity: Severity;\n /** Extensions this engine owns, lowercase and dot-prefixed. */\n extensions: readonly string[];\n pattern: RegExp;\n /** Evidence on the matched line that this occurrence is not user data. */\n lineGuard?: RegExp;\n}\n\n/**\n * The layout slot, which is not a variable.\n *\n * `{{{body}}}` in a Handlebars layout is where the rendered child template is\n * spliced in — it is unescaped because it is already HTML, by design, and\n * every project using layouts has exactly one. Reporting it means every\n * express-handlebars app opens its report with a false positive.\n */\nconst LAYOUT_SLOT = /\\{\\{\\{\\s*(?:body|content|outlet|children)\\s*\\}\\}\\}/;\n\nconst XSS_CONSEQUENCE =\n 'The value is written into the page as markup rather than as text, so a `<script>` or an `onerror=` attribute in it executes in the visitor’s session — with their cookies, and their privileges.';\n\nexport const TEMPLATE_RULES: readonly TemplateRule[] = [\n {\n id: 'tpl-handlebars-unescaped',\n title: 'Handlebars/Mustache interpolation that skips escaping',\n consequence: XSS_CONSEQUENCE,\n cwe: 'CWE-79',\n severity: 'high',\n extensions: ['.hbs', '.handlebars', '.hdbs', '.mustache', '.ms'],\n // Two spellings of the same opt-out: the triple-stache and the `&` prefix.\n pattern: /\\{\\{\\{(?!\\{)[^}]*\\}\\}\\}|\\{\\{\\s*&\\s*[^}]+\\}\\}/,\n lineGuard: LAYOUT_SLOT,\n },\n {\n id: 'tpl-vue-v-html',\n title: '`v-html` binding',\n consequence: XSS_CONSEQUENCE,\n cwe: 'CWE-79',\n severity: 'high',\n extensions: ['.vue', '.html', '.htm'],\n pattern: /\\bv-html\\s*=|\\s:inner-html\\.prop\\s*=/,\n },\n {\n id: 'tpl-pug-unescaped',\n title: 'Pug/Jade unescaped interpolation',\n consequence: XSS_CONSEQUENCE,\n cwe: 'CWE-79',\n severity: 'high',\n extensions: ['.pug', '.jade'],\n // `!{…}` is unescaped interpolation anywhere on the line. `!=` is\n // unescaped buffered code, but only in the tag position — anchored to the\n // start of the line and preceded by nothing but tag, class and id\n // characters, so the `!==` inside `- if (a !== b)` cannot reach it.\n pattern: /!\\{[^}\\n]*\\}|^\\s*[\\w.#%-]*!=(?!=)\\s*\\S/,\n },\n {\n id: 'tpl-ejs-raw-output',\n title: 'EJS/ECT raw output tag',\n consequence: XSS_CONSEQUENCE,\n cwe: 'CWE-79',\n severity: 'high',\n extensions: ['.ejs', '.ect'],\n // In EJS `<%= %>` escapes and `<%-` does not, which is the reverse of\n // Underscore's convention — see KNOWN_GAPS.\n pattern: /<%-(?!\\s*(?:include|-))/,\n // `<%- include('partial') %>` splices another template, not user data.\n lineGuard: /<%-\\s*(?:include|partial)\\s*\\(/,\n },\n {\n id: 'tpl-dust-escape-filter-off',\n title: 'Dust reference with escaping suppressed',\n consequence: XSS_CONSEQUENCE,\n cwe: 'CWE-79',\n severity: 'high',\n extensions: ['.dust', '.tl'],\n // The `|s` filter means \"suppress the default HTML escape\".\n pattern: /\\{[^{}\\n]+\\|\\s*s\\s*\\}/,\n },\n {\n id: 'tpl-jinja-safe-filter',\n title: 'Nunjucks/Twig/Jinja `safe` filter or autoescape block off',\n consequence: XSS_CONSEQUENCE,\n cwe: 'CWE-79',\n severity: 'high',\n extensions: ['.njk', '.nunjucks', '.twig', '.jinja', '.jinja2', '.j2'],\n pattern: /\\|\\s*(?:safe|raw)\\s*(?:\\}\\}|\\|)|\\{%\\s*autoescape\\s+(?:false|off)\\s*%\\}/,\n },\n {\n id: 'tpl-haml-unescaped',\n title: 'Haml unescaped output',\n consequence: XSS_CONSEQUENCE,\n cwe: 'CWE-79',\n severity: 'high',\n extensions: ['.haml'],\n pattern: /^\\s*[\\w.#%-]*!=(?!=)\\s*\\S/,\n },\n];\n\n/** Extensions any template rule owns. Folded into `SCAN_EXTENSIONS`. */\nexport const TEMPLATE_EXTENSIONS: ReadonlySet<string> = new Set(\n TEMPLATE_RULES.flatMap((rule) => rule.extensions),\n);\n\nexport interface TemplateMatch {\n rule: TemplateRule;\n severity: Severity;\n line: number;\n}\n\n/**\n * Run the rules that own this extension over the file's lines.\n *\n * Returns matches rather than findings so the caller keeps sole ownership of\n * how a finding is shaped — the same split the code rules use.\n */\nexport function evaluateTemplateRules(\n extension: string,\n lines: readonly string[],\n): TemplateMatch[] {\n const ext = extension.toLowerCase();\n const applicable = TEMPLATE_RULES.filter((rule) => rule.extensions.includes(ext));\n if (applicable.length === 0) return [];\n\n const matches: TemplateMatch[] = [];\n lines.forEach((line, index) => {\n for (const rule of applicable) {\n if (!rule.pattern.test(line)) continue;\n if (rule.lineGuard?.test(line)) continue;\n matches.push({\n rule,\n // A template cannot show that the value is untrusted, so the claim\n // never rises above `pattern` and the shared cap holds it at medium.\n severity: severityFor(rule.severity, 'pattern'),\n line: index + 1,\n });\n }\n });\n return matches;\n}\n\n/**\n * KNOWN_GAPS — template classes deliberately not covered.\n *\n * Underscore / Lodash templates\n * `<%= %>` is *unescaped* in Underscore and *escaped* in EJS, and the two\n * share the `.html` and `.tpl` extensions. Since the engine is what\n * decides which meaning applies, and nothing in the file says which engine\n * will render it, a rule for either convention is wrong half the time.\n *\n * Liquid\n * Liquid does not escape by default at all, so every interpolation would\n * match. A rule that fires on every line of every template is a rule\n * nobody leaves switched on.\n *\n * Whether the interpolated value is attacker-controlled\n * Needs the controller that renders the template, which is a different\n * file. This is the reason for the confidence ceiling, not an oversight.\n */\n","/**\n * Missing security controls: findings about what is *not* there.\n *\n * Every other rule in this package reports a construct it can point at. This\n * one reports an absence — no rate limiter anywhere in an HTTP service, no\n * CSRF token, no security headers — which is a different kind of claim and\n * needs different handling in three ways.\n *\n * **It is whole-project, not per-line.** A rate limiter installed in\n * `app.js` protects a route defined in `routes/admin.js`. Any per-file rule\n * would report the second file while the first sits three directories away\n * with the answer in it. So this accumulates across the whole walk and\n * reports once, at the end.\n *\n * **It is weaker evidence.** \"We did not see a CSRF token\" is not the same\n * statement as \"we saw a SQL query built by concatenation\". The control may\n * be installed by a framework, by a reverse proxy, by an API gateway, or by\n * a package whose name nobody here has heard of. So these are opt-in — the\n * CLI asks for them with `--missing-controls` — and they report at\n * confidence `pattern`, which the shared cap in `types.ts` holds at medium.\n *\n * **It needs an applicability test.** \"This library has no CSRF protection\"\n * is not a finding, it is a category error. Nothing is reported unless the\n * tree contains something that answers HTTP requests.\n *\n * Provenance: the idea of inverting rules to report absent controls is\n * njsscan's, and the four controls checked here are the ones it covers. The\n * mechanism is not — njsscan detects controls with its ordinary rule engine\n * and subtracts the hits afterwards, while this accumulates evidence during\n * the walk so no file has to be held in memory. Patterns and prose are\n * original; see the licence note at the top of `node-rules.ts`.\n */\n\nimport type { ScanFinding, Severity } from './types';\nimport { severityFor } from './types';\n\nexport interface SecurityControl {\n id: string;\n title: string;\n /** What the absence costs. */\n consequence: string;\n cwe: string;\n severity: Severity;\n /** Anything matching this, anywhere in the tree, counts as installed. */\n evidence: RegExp;\n}\n\n/**\n * Evidence that this tree serves HTTP.\n *\n * The gate for the whole module. A CLI, a library or a batch job has no\n * business being told it is missing a CSRF token, and reporting one is the\n * fastest way to teach an operator that these findings are noise.\n *\n * Deliberately narrow: constructing the server, not merely importing\n * something HTTP-shaped. A build script that requires `express` to type a\n * config object is not a web service.\n */\nconst SERVER_FRAMEWORK =\n /\\bexpress\\s*\\(\\s*\\)|\\bnew\\s+Koa\\s*\\(|\\bfastify\\s*\\(|\\brequire\\s*\\(\\s*['\"](?:express|koa|@hapi\\/hapi|restify)['\"]\\s*\\)|\\bfrom\\s+['\"](?:express|koa|@hapi\\/hapi|restify)['\"]|\\bhttp\\s*\\.\\s*createServer\\s*\\(|\\bNestFactory\\s*\\.\\s*create\\s*\\(/;\n\nexport const SECURITY_CONTROLS: readonly SecurityControl[] = [\n {\n id: 'control-security-headers-absent',\n title: 'no security header middleware',\n consequence:\n 'Without them the browser applies no framing protection, sniffs content types, sends full referrers cross-origin and never learns to require HTTPS — a set of defences that cost one line to enable.',\n cwe: 'CWE-693',\n severity: 'medium',\n evidence:\n /\\bhelmet\\b|\\bkoa-helmet\\b|\\b@fastify\\/helmet\\b|\\blusca\\b|Strict-Transport-Security|Content-Security-Policy|X-Frame-Options|X-Content-Type-Options/i,\n },\n {\n id: 'control-anti-csrf-absent',\n title: 'no cross-site request forgery protection',\n consequence:\n 'A cookie-authenticated endpoint with no token check can be driven by a form on any other site — the browser attaches the session automatically, so the victim only has to visit a page.',\n cwe: 'CWE-352',\n severity: 'medium',\n // SameSite counts. A cookie the browser refuses to send cross-site is not\n // reachable by the attack this control exists to stop, so a project that\n // chose that route instead of tokens has the control, not a gap.\n evidence:\n /\\bcsurf\\b|\\bcsrf\\b|\\bxsrf\\b|\\blusca\\b|\\b@fastify\\/csrf\\b|\\bdouble-csrf\\b|\\bsameSite\\s*:\\s*['\"](?:strict|lax)['\"]/i,\n },\n {\n id: 'control-rate-limiting-absent',\n title: 'no request rate limiting',\n consequence:\n 'Login and password-reset endpoints with no limiter can be tried at the speed of the network — credential stuffing, token brute force and enumeration all become a matter of waiting.',\n cwe: 'CWE-770',\n severity: 'medium',\n evidence:\n /\\bexpress-rate-limit\\b|\\brateLimit\\b|\\brate-limiter\\b|\\bratelimit\\b|\\bexpress-slow-down\\b|\\bslowDown\\b|\\bbottleneck\\b|\\bthrottle\\b/i,\n },\n {\n id: 'control-body-size-limit-absent',\n title: 'no request body size limit',\n consequence:\n 'The body is parsed into memory before any handler — and before any authentication check — so unbounded parsing lets a few concurrent requests exhaust the process.',\n cwe: 'CWE-400',\n severity: 'medium',\n evidence: /\\blimit\\s*:\\s*['\"]?\\d+\\s*(?:kb|mb|b)\\b|\\bbodyLimit\\b|\\bmaxRequestBodySize\\b|\\bclient_max_body_size\\b/i,\n },\n];\n\n/**\n * Accumulates control evidence over a walk, then reports what was never seen.\n *\n * Holds four booleans and one path, not the files — a whole-project question\n * answered without a whole-project buffer, which matters because the walker is\n * otherwise streaming and a repository can be large.\n */\nexport class ControlAudit {\n private readonly seen = new Set<string>();\n /** Where the server is built. Anchors the findings somewhere meaningful. */\n private serverFile: string | null = null;\n\n observe(relativePath: string, text: string): void {\n if (this.serverFile === null && SERVER_FRAMEWORK.test(text)) {\n this.serverFile = relativePath;\n }\n for (const control of SECURITY_CONTROLS) {\n if (this.seen.has(control.id)) continue;\n if (control.evidence.test(text)) this.seen.add(control.id);\n }\n }\n\n /** Controls with no evidence anywhere. Empty when the tree serves no HTTP. */\n missing(): readonly SecurityControl[] {\n if (this.serverFile === null) return [];\n return SECURITY_CONTROLS.filter((control) => !this.seen.has(control.id));\n }\n\n findings(): ScanFinding[] {\n const anchor = this.serverFile;\n if (anchor === null) return [];\n\n return this.missing().map((control) => ({\n ruleId: control.id,\n title: control.title,\n file: anchor,\n line: 1,\n // `pattern` is doing real work here: it caps the severity, and it says\n // in the report itself how much the scanner is claiming. An absence is\n // never `evidence`.\n severity: severityFor(control.severity, 'pattern'),\n confidence: 'pattern' as const,\n message: `${control.title} — no evidence of one anywhere in the scanned tree (${control.cwe})`,\n consequence: control.consequence,\n cwe: control.cwe,\n excerpt: '',\n category: 'code' as const,\n }));\n }\n}\n","/**\n * Dependency-manifest rules — typosquats, dependency confusion, and\n * install-time lifecycle scripts.\n *\n * This is the one detector here that does not need a vulnerability to exist\n * yet. `event-stream` (2018), `ua-parser-js` (2021) and `node-ipc` (2022) were\n * all advisory-clean at the moment they were installed; the advisory gets\n * written *after* somebody notices. What they shared was a name you would\n * misread and a lifecycle script that ran with the installing user's\n * privileges. Both are visible in the manifest, before anything is fetched.\n */\n\nimport type { Severity } from './types';\n\nexport interface ManifestFinding {\n ruleId: string;\n title: string;\n line: number;\n severity: Severity;\n cwe: string;\n message: string;\n consequence: string;\n excerpt: string;\n}\n\n/**\n * Popular package names, by ecosystem.\n *\n * Not a registry mirror and not trying to be. It is the set of names worth\n * *impersonating* — a typosquat only pays off against a package people install\n * without looking. A longer list would not find more attacks; it would find\n * more legitimate packages that happen to sit one edit from something famous.\n */\nconst POPULAR_NPM = [\n 'react', 'react-dom', 'lodash', 'express', 'axios', 'chalk', 'commander', 'debug',\n 'moment', 'dayjs', 'uuid', 'dotenv', 'typescript', 'webpack', 'vite', 'rollup',\n 'eslint', 'prettier', 'jest', 'vitest', 'mocha', 'chai', 'sinon', 'request',\n 'node-fetch', 'cross-env', 'rimraf', 'glob', 'minimist', 'yargs', 'inquirer',\n 'colors', 'ora', 'semver', 'ws', 'socket.io', 'mongoose', 'sequelize', 'knex',\n 'pg', 'mysql', 'mysql2', 'redis', 'ioredis', 'jsonwebtoken', 'bcrypt', 'passport',\n 'cors', 'helmet', 'morgan', 'body-parser', 'multer', 'nodemailer', 'puppeteer',\n 'playwright', 'cheerio', 'sharp', 'canvas', 'esbuild', 'babel', 'postcss',\n 'tailwindcss', 'next', 'nuxt', 'vue', 'svelte', 'angular', 'rxjs', 'zod',\n];\n\nconst POPULAR_PYPI = [\n 'requests', 'urllib3', 'numpy', 'pandas', 'scipy', 'flask', 'django', 'fastapi',\n 'sqlalchemy', 'pydantic', 'click', 'jinja2', 'pyyaml', 'boto3', 'botocore',\n 'setuptools', 'wheel', 'pip', 'six', 'certifi', 'idna', 'chardet', 'attrs',\n 'python-dateutil', 'pytz', 'pytest', 'tox', 'black', 'flake8', 'mypy', 'isort',\n 'beautifulsoup4', 'lxml', 'pillow', 'matplotlib', 'seaborn', 'scikit-learn',\n 'tensorflow', 'torch', 'transformers', 'openai', 'anthropic', 'httpx', 'aiohttp',\n 'celery', 'redis', 'psycopg2', 'pymongo', 'cryptography', 'paramiko', 'colorama',\n];\n\n/**\n * Names that read as belonging to a private registry.\n *\n * A manifest that asks a public index for a package whose name announces it is\n * internal is the dependency-confusion setup: whoever registers the name\n * publicly first wins, and the build takes their copy.\n */\nconst INTERNAL_MARKER = /(?:^|[-_/@])(?:internal|private|corp|intranet|inhouse|confidential)(?:$|[-_/])/i;\n\n/** Strip the separators a squatter varies but a reader does not notice. */\nfunction normalizeName(name: string): string {\n return name.toLowerCase().replace(/^@/, '').replace(/[-_.\\s]/g, '');\n}\n\n/**\n * Damerau-Levenshtein distance, capped.\n *\n * Damerau rather than plain Levenshtein because the single most common\n * typosquat is a transposition — `lodahs` for `lodash`, `reqeust` for\n * `request`. Levenshtein scores those as 2, the same as two unrelated edits,\n * which puts them below any threshold tight enough to be useful.\n */\nexport function editDistance(a: string, b: string, cap = 3): number {\n if (a === b) return 0;\n if (Math.abs(a.length - b.length) > cap) return cap + 1;\n\n const rows: number[][] = [];\n for (let i = 0; i <= a.length; i += 1) {\n rows.push(new Array<number>(b.length + 1).fill(0));\n rows[i]![0] = i;\n }\n for (let j = 0; j <= b.length; j += 1) rows[0]![j] = j;\n\n for (let i = 1; i <= a.length; i += 1) {\n for (let j = 1; j <= b.length; j += 1) {\n const cost = a[i - 1] === b[j - 1] ? 0 : 1;\n let best = Math.min(\n rows[i - 1]![j]! + 1,\n rows[i]![j - 1]! + 1,\n rows[i - 1]![j - 1]! + cost,\n );\n if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {\n best = Math.min(best, rows[i - 2]![j - 2]! + 1);\n }\n rows[i]![j] = best;\n }\n }\n return rows[a.length]![b.length]!;\n}\n\nexport interface SquatVerdict {\n impersonates: string;\n /** `separator` when only punctuation differs, `edit` when a character does. */\n kind: 'separator' | 'edit';\n}\n\n/**\n * Whether `name` looks like an attempt to be mistaken for a popular package.\n *\n * Exact matches return null first, always. The check that follows is\n * deliberately asymmetric: a name is suspicious for being *close to* a popular\n * package, never for being popular itself.\n */\nexport function detectTyposquat(name: string, ecosystem: 'npm' | 'pypi'): SquatVerdict | null {\n const popular = ecosystem === 'npm' ? POPULAR_NPM : POPULAR_PYPI;\n const lower = name.toLowerCase();\n\n // A scoped name is left alone, scope and all.\n //\n // Discarding the scope before comparing was this rule's largest source of\n // false positives, and it fired on some of the most widely installed packages\n // there are: `@babel/core`, `@angular/core`, `@nestjs/core` and\n // `@capacitor/core` all reduce to `core`, which sits one edit from `cors`.\n //\n // Scopes are owned. Publishing `@babel/anything` requires control of the\n // `@babel` scope, so a squat cannot be planted inside a legitimate one, and\n // nobody typing `npm i cors` arrives at `@capacitor/core` by accident. The\n // misreading this rule exists to catch does not cross the scope boundary, so\n // a name that has one is not a candidate.\n //\n // The scoped attack that *is* real is a lookalike scope — `@babeljs/core` for\n // `@babel/core`. Catching it means comparing scopes against a list of popular\n // scopes, which is a different check than this one rather than a variation on\n // it. Stripping the scope never performed that check; it only compared the\n // part after the slash, so nothing is lost here.\n if (/^@[^/]+\\//.test(lower)) return null;\n\n if (popular.includes(lower)) return null;\n if (lower.length < 4) return null;\n\n const normalized = normalizeName(lower);\n for (const candidate of popular) {\n const candidateNormalized = normalizeName(candidate);\n // `urllib-3` and `pythondateutil` normalise onto their targets exactly.\n // Nothing legitimate reaches a popular package's spelling by deleting or\n // inserting punctuation.\n if (normalized === candidateNormalized) return { impersonates: candidate, kind: 'separator' };\n if (editDistance(normalized, candidateNormalized, 1) === 1) {\n return { impersonates: candidate, kind: 'edit' };\n }\n }\n return null;\n}\n\nconst LIFECYCLE_SCRIPTS = ['preinstall', 'install', 'postinstall', 'prepare', 'prepublish'];\n\n/**\n * Lifecycle hooks are a normal npm feature. Reporting every `prepare` or\n * `postinstall` turns build compilation, generated clients, and workspace\n * setup into security findings. The security-relevant subset is a hook that\n * itself contains an execution primitive commonly used to hide or fetch a\n * payload. The script remains visible in package.json either way; this rule\n * is reserved for the cases that need security triage.\n */\nfunction isRiskyLifecycleScript(body: unknown): boolean {\n if (typeof body !== 'string') return false;\n return /\\b(?:curl|wget)\\b[^\\n|]*\\|\\s*(?:\\w*sh|bash|node|python)\\b|\\b(?:curl|wget)\\b[^\\n]*(?:https?:|--upload-file)|\\b(?:node|python|ruby|perl)\\s+-e\\b|\\b(?:base64|openssl)\\b[^\\n]*(?:-d|--decode)|\\beval\\s+|\\bchmod\\s+(?:\\S+\\s+)*(?:777|a\\+rwx)\\b/i.test(body);\n}\n\n/**\n * Scan a `package.json`.\n *\n * Text-oriented rather than object-oriented so every finding can carry the\n * line it came from. A finding an operator cannot navigate to is a finding\n * they will not act on.\n */\nexport function scanPackageJson(text: string): ManifestFinding[] {\n const findings: ManifestFinding[] = [];\n const lines = text.split('\\n');\n\n let parsed: Record<string, unknown>;\n try {\n parsed = JSON.parse(text) as Record<string, unknown>;\n } catch {\n return findings;\n }\n\n const lineOf = (needle: string): number => {\n const index = lines.findIndex((line) => line.includes(`\"${needle}\"`));\n return index === -1 ? 1 : index + 1;\n };\n\n const depBuckets = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];\n for (const bucket of depBuckets) {\n const deps = parsed[bucket];\n if (!deps || typeof deps !== 'object') continue;\n for (const name of Object.keys(deps as Record<string, unknown>)) {\n const line = lineOf(name);\n\n if (INTERNAL_MARKER.test(name)) {\n findings.push({\n ruleId: 'manifest-dependency-confusion',\n title: 'internal-looking package resolved from a public registry',\n line,\n severity: 'critical',\n cwe: 'CWE-1357',\n message: `\"${name}\" names itself as internal but carries no registry pin`,\n consequence:\n 'Whoever registers this name publicly first wins the resolution, and their code runs in your build.',\n excerpt: (lines[line - 1] ?? '').trim(),\n });\n continue;\n }\n\n const squat = detectTyposquat(name, 'npm');\n if (squat) {\n findings.push({\n ruleId: 'manifest-typosquat',\n title: 'dependency name close to a popular package',\n line,\n severity: 'high',\n cwe: 'CWE-1357',\n message:\n squat.kind === 'separator'\n ? `\"${name}\" differs from \"${squat.impersonates}\" only in punctuation`\n : `\"${name}\" is one edit from \"${squat.impersonates}\"`,\n consequence:\n 'A reviewer scanning a diff reads the name they expected. The package that installs is the one that was written.',\n excerpt: (lines[line - 1] ?? '').trim(),\n });\n }\n }\n }\n\n const scripts = parsed.scripts;\n if (scripts && typeof scripts === 'object') {\n for (const [name, body] of Object.entries(scripts as Record<string, unknown>)) {\n if (!LIFECYCLE_SCRIPTS.includes(name)) continue;\n if (!isRiskyLifecycleScript(body)) continue;\n findings.push({\n ruleId: 'manifest-risky-install-lifecycle-script',\n title: 'risky install-time lifecycle script',\n line: lineOf(name),\n severity: 'medium',\n cwe: 'CWE-506',\n message: `\"${name}\" runs automatically on install and contains a network or code-execution primitive: ${String(body).slice(0, 120)}`,\n consequence:\n 'Lifecycle scripts run with the installing user’s privileges and network access, before any code is reviewed. It is the execution vector every notable npm compromise has used.',\n excerpt: (lines[lineOf(name) - 1] ?? '').trim(),\n });\n }\n }\n\n return findings;\n}\n\n/** Scan a `requirements.txt`. Same checks, different grammar. */\nexport function scanRequirementsTxt(text: string): ManifestFinding[] {\n const findings: ManifestFinding[] = [];\n const lines = text.split('\\n');\n\n lines.forEach((raw, index) => {\n const line = raw.trim();\n if (!line || line.startsWith('#') || line.startsWith('-')) return;\n\n const match = /^([A-Za-z0-9_.-]+)\\s*(?:[=<>!~]=|@|$)/.exec(line);\n const name = match?.[1];\n if (!name) return;\n\n if (INTERNAL_MARKER.test(name)) {\n findings.push({\n ruleId: 'manifest-dependency-confusion',\n title: 'internal-looking package resolved from a public index',\n line: index + 1,\n severity: 'critical',\n cwe: 'CWE-1357',\n message: `\"${name}\" names itself as internal but carries no index pin`,\n consequence:\n 'pip resolves the highest version across every configured index, so a public package of the same name shadows the private one.',\n excerpt: line,\n });\n return;\n }\n\n const squat = detectTyposquat(name, 'pypi');\n if (squat) {\n findings.push({\n ruleId: 'manifest-typosquat',\n title: 'dependency name close to a popular package',\n line: index + 1,\n severity: 'high',\n cwe: 'CWE-1357',\n message:\n squat.kind === 'separator'\n ? `\"${name}\" differs from \"${squat.impersonates}\" only in punctuation`\n : `\"${name}\" is one edit from \"${squat.impersonates}\"`,\n consequence:\n 'A reviewer scanning a diff reads the name they expected. The package that installs is the one that was written.',\n excerpt: line,\n });\n }\n });\n\n return findings;\n}\n","/**\n * Credential-shape rules for `threatcrush scan`.\n *\n * These are the rules ThreatCrush already scored 0.0% false positives on\n * against the public testbed's control group, so the bar for changing one is\n * high: a secret rule earns its place by matching material that is a\n * credential, not by matching material that looks vaguely random.\n *\n * The distinction that keeps the false-positive rate at zero is *shape with a\n * vendor prefix*. `AKIA…`, `ghp_…`, `xoxb-…`, `sk_live_…` are issued formats —\n * nothing else produces them. Entropy alone is not a rule here, because\n * entropy alone flags every UUID, hash and minified bundle in the tree.\n *\n * Two lines in the testbed corpus are the reason for that discipline. Both\n * live in the same `.env` file as five real credentials:\n *\n * AWS_ROLE_ARN=arn:aws:iam::123456789012:role/app-runtime\n * DATABASE_URL_SSM_PARAMETER=/prod/app/database-url\n *\n * An identifier and a lookup path. Both sit under secret-shaped variable\n * names, and neither is a credential. A rule keyed on the variable name would\n * flag both.\n */\n\nimport type { Severity } from './types';\n\nexport interface SecretRule {\n id: string;\n /** Vendor-facing name, e.g. \"AWS Access Key\". */\n name: string;\n pattern: RegExp;\n severity: Severity;\n cwe: string;\n /** What an attacker does with it. */\n consequence: string;\n /**\n * Does this rule key on a *keyword* rather than on an issued format?\n *\n * `AKIA…` and `ghp_…` are minted by a vendor: nobody types one by accident,\n * so a match is a credential wherever it appears — including in a test, where\n * it is reported at `low` but still reported. The keyword-shaped rules are\n * the opposite. `password = '…'` fires on the *variable name*, and the value\n * beside it in a test file is a fixture in overwhelming proportion.\n *\n * Only rules marked here are eligible for the test-fixture exemption in\n * `isTestFixtureValue`. The distinction is the whole reason that exemption is\n * safe: it can never silence a vendor-issued key.\n */\n keywordShaped?: boolean;\n}\n\nexport const SECRET_RULES: readonly SecretRule[] = [\n {\n id: 'secret-aws-access-key',\n name: 'AWS Access Key',\n pattern: /\\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\\b/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Paired with a secret key, grants the API access of whatever IAM principal issued it.',\n },\n {\n id: 'secret-aws-secret-key',\n name: 'AWS Secret Access Key',\n pattern:\n /(?:aws_secret_access_key|AWS_SECRET(?:_ACCESS_KEY)?)\\s*[=:]\\s*['\"]?([A-Za-z0-9/+=]{40})['\"]?/i,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'The other half of an AWS credential pair; on its own it is still the hard half to guess.',\n },\n {\n id: 'secret-github-token',\n name: 'GitHub Token',\n pattern: /\\b(?:ghp_[A-Za-z0-9]{36}|gho_[A-Za-z0-9]{36}|ghu_[A-Za-z0-9]{36}|ghs_[A-Za-z0-9]{36}|ghr_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{60,})\\b/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Repository read or write as the issuing account, including the ability to push workflow changes.',\n },\n {\n id: 'secret-npm-token',\n name: 'npm Token',\n pattern: /\\bnpm_[A-Za-z0-9]{36}\\b/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Publish rights to every package the account owns — a supply-chain compromise in one command.',\n },\n {\n id: 'secret-private-key',\n name: 'Private Key',\n pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Key material, committed. Rotation is the only remediation.',\n },\n {\n id: 'secret-slack-token',\n name: 'Slack Token',\n pattern: /\\bxox[bpoasr]-[A-Za-z0-9-]{10,}/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Read and post access to the workspace as the installing app.',\n },\n {\n id: 'secret-slack-webhook',\n name: 'Slack Webhook URL',\n pattern: /https:\\/\\/hooks\\.slack\\.com\\/services\\/[A-Za-z0-9_+\\/-]{6,}/,\n severity: 'high',\n cwe: 'CWE-798',\n consequence: 'The URL *is* the credential — anyone holding it can post to that channel.',\n },\n {\n id: 'secret-stripe-key',\n name: 'Stripe Key',\n pattern: /\\b(?:sk_live_|rk_live_|sk_test_|rk_test_)[A-Za-z0-9]{20,}\\b/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Charge, refund and customer-data access against the account.',\n },\n {\n id: 'secret-sendgrid-key',\n name: 'SendGrid API Key',\n pattern: /\\bSG\\.[A-Za-z0-9_-]{16,}\\.[A-Za-z0-9_-]{16,}\\b/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Send mail as the domain — the credential behind most convincing phishing from a real sender.',\n },\n {\n id: 'secret-google-api-key',\n name: 'Google API Key',\n pattern: /\\bAIza[0-9A-Za-z_-]{35}\\b/,\n severity: 'high',\n cwe: 'CWE-798',\n consequence: 'Quota theft at minimum; API access to whatever the key was scoped to at worst.',\n },\n {\n id: 'secret-openai-key',\n name: 'OpenAI API Key',\n pattern: /\\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}\\b/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Billed inference against the owner’s account, with no per-key spend limit by default.',\n },\n {\n id: 'secret-anthropic-key',\n name: 'Anthropic API Key',\n pattern: /\\bsk-ant-(?:api\\d{2}-)?[A-Za-z0-9_-]{32,}\\b/,\n severity: 'critical',\n cwe: 'CWE-798',\n consequence: 'Billed inference against the owner’s account.',\n },\n {\n id: 'secret-database-url',\n name: 'Database URL with credentials',\n // Requires a credential segment before the `@` — `postgres://localhost/db`\n // is a hostname, not a secret.\n pattern: /\\b(?:postgres(?:ql)?|mysql|mongodb(?:\\+srv)?|redis|amqp|clickhouse):\\/\\/[^\\s'\"@\\/]*:[^\\s'\"@\\/]*@[^\\s'\"]+/i,\n severity: 'high',\n cwe: 'CWE-798',\n consequence: 'Direct database access, usually bypassing every application-level authorisation check.',\n },\n {\n id: 'secret-jwt',\n name: 'JSON Web Token',\n pattern: /\\beyJ[A-Za-z0-9_-]{8,}\\.eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_.+/=-]*/,\n severity: 'medium',\n cwe: 'CWE-798',\n consequence: 'Session or service identity until it expires — and committed tokens are usually long-lived.',\n keywordShaped: true,\n },\n {\n id: 'secret-generic-api-key',\n name: 'Generic API Key',\n // Quoted assignment only. An unquoted value in a `.env` is covered by the\n // vendor-prefixed rules above; matching it here is what starts flagging\n // ARNs and parameter-store paths.\n pattern: /(?:api[_-]?key|apikey|access[_-]?token|auth[_-]?token)\\s*[=:]\\s*['\"]([A-Za-z0-9\\-_.]{20,})['\"]/i,\n severity: 'high',\n cwe: 'CWE-798',\n consequence: 'Whatever the third-party service lets the key do, for as long as it stays valid.',\n keywordShaped: true,\n },\n {\n id: 'secret-generic-credential',\n name: 'Hardcoded Credential',\n pattern: /(?:secret|password|passwd|pwd|token)\\s*[=:]\\s*['\"]([^'\"\\s]{8,})['\"]/i,\n severity: 'high',\n cwe: 'CWE-798',\n consequence: 'A password in source is a password in every clone, fork and CI cache of that source.',\n keywordShaped: true,\n },\n {\n id: 'secret-hex-token',\n name: 'High-entropy Hex Token',\n pattern: /(?:token|key|secret|auth|signing)\\w*\\s*[=:]\\s*['\"]?([0-9a-f]{32,})['\"]?/i,\n severity: 'medium',\n cwe: 'CWE-798',\n consequence: 'Signing secrets and session keys are usually hex; a leaked one forges anything they sign.',\n keywordShaped: true,\n },\n];\n\n/**\n * Values that satisfy a credential shape but are not credentials.\n *\n * Kept deliberately short. Every entry is a documented, publicly-published\n * placeholder — not a guess that something \"looks like a test value\". A\n * generous allow-list here is how a scanner talks itself out of a real finding.\n */\nconst KNOWN_PLACEHOLDERS = [\n // Deliberately NOT here: AWS's published documentation key/secret pair\n // (`AKIAIOSFODNN7EXAMPLE`, `wJalrXUtnFEMI/…`). GitHub allow-lists them, and\n // the argument for following suit is that they authenticate nothing. The\n // argument against is stronger: they appear in a repository because someone\n // pasted a credentials template and left it there, and the remediation —\n // move this to the secret manager — is identical to the one for a live key.\n // Exempting them means the scanner goes quiet on the file most likely to\n // acquire a real key next.\n /\\bEXAMPLE_?KEY\\b/i,\n /\\bYOUR_[A-Z_]*(?:KEY|TOKEN|SECRET|PASSWORD)\\b/,\n /\\b(?:xxx+|X{4,}|\\*{4,}|<[a-z-]+>)\\b/,\n /\\bchangeme\\b/i,\n // The metasyntactic pair in a connection string, `postgres://user:pass@host`.\n // This is not the AWS case above and the distinction is the whole reason it\n // is allowed: `AKIAIOSFODNN7EXAMPLE` is a real credential *format* carrying a\n // fake value, so it arrives by way of a pasted template. `user:pass` is the\n // English words sitting where a credential goes, which is how every database\n // driver writes its DSN in its own README, and nobody pastes that out of a\n // secret manager.\n //\n // Both halves have to be metasyntactic. `root:hunter2@` is not exempt, since\n // a real password beside a common username is the case this must not swallow.\n /:\\/\\/(?:user(?:name)?|admin|root|dbuser|myuser):(?:pass(?:word|wd)?|secret|dbpass|mypassword)@/i,\n];\n\n/**\n * Whether the matched text is a documented placeholder rather than material.\n *\n * Note what this does *not* do: it does not exempt a value for being all\n * zeros, all A's, or otherwise \"obviously fake\". Those shapes are exactly what\n * the testbed's fixtures use, deliberately, and a scanner that skips them\n * scores zero on a corpus of real credential formats. Only values a vendor has\n * published as examples are exempt.\n */\nexport function isKnownPlaceholder(text: string): boolean {\n return KNOWN_PLACEHOLDERS.some((pattern) => pattern.test(text));\n}\n\n/*\n * Deliberately absent: a rule exempting a *typed sequence*.\n *\n * mulgadc/spinifex's API documentation is built out of an `ASIA` prefix\n * followed by `1A2B3C4D5E6F7890` — digits running 1234567890, letters running\n * ABCDEF, a person walking two keyboards at once. Six of them sit in `docs/`,\n * and because a documented key is neither a fixture nor annotated nor\n * self-describing, those six are every remaining critical on that repository.\n * Detecting the two monotonic runs is easy, and it was written, measured and\n * removed again.\n *\n * It cannot be had. `false-positives.test.ts` pins an `AKIA` prefix followed by\n * `1234567890ABCDEF` as a key that must never be exempted however it is named,\n * and that value *is* a typed sequence — the same shape, indistinguishable by\n * any rule that is not simply a list of the two literals. The header above says\n * why the test is right: the corpus this scanner is measured against builds its\n * fixtures out of exactly these shapes, so a scanner that skips them scores zero\n * on a corpus of real credential formats. Quiet documentation is not worth that\n * trade.\n *\n * The noise is real and stays. It is a cost of keying on value rather than on\n * path, which remains the correct axis — see `isDocPath`.\n */\n\n/**\n * Is the value the example text an empty input field shows?\n *\n * `placeholder` is the one HTML attribute whose contents are, by definition,\n * not data — it is the grey hint that disappears the moment a user types. A\n * credential-shaped string there is the interface telling somebody what to\n * paste, which is the same reason spinifex's cert-import dialog holds\n * `placeholder=\"-----BEGIN PRIVATE KEY-----\"`: a banner with no key under it.\n *\n * Both of those were criticals, and a critical is what a maintainer reads\n * first. Softened rather than skipped, like everything else here — a real key\n * left in a placeholder is rendered to every visitor, so it stays in the report.\n */\nexport function isPlaceholderAttribute(line: string, value: string): boolean {\n const at = line.lastIndexOf(value);\n if (at === -1) return false;\n return /(?:^|\\s)(?:aria-)?placeholder\\s*=\\s*[{(\"'`]*$/i.test(line.slice(0, at));\n}\n\n/**\n * Is the matched value a variable reference rather than a literal?\n *\n * The highest-volume false positive outside test files, and the one that needs\n * no judgement to dismiss: a value made entirely of an expansion holds nothing.\n *\n * SUPABASE_ACCESS_TOKEN=\"${SUPABASE_ACCESS_TOKEN:-}\"\n * TWILIO_AUTH_TOKEN=\"${TWILIO_AUTH_TOKEN:-}\"\n *\n * Those two lines are the canonical shape of a script that *refuses* to default\n * a secret — the `:-` with an empty right-hand side exists precisely so the\n * script fails when the variable is unset. Reporting them as hardcoded\n * credentials flags the remediation as the defect.\n *\n * The one thing this must not swallow is an expansion with a real fallback.\n * `${DB_PASSWORD:-hunter2}` *is* a hardcoded credential — it is the default the\n * process runs with — so a literal on the right of `:-` disqualifies the value.\n * A fallback that is itself another variable carries no literal and stays\n * exempt.\n */\nexport function isVariableReference(value: string): boolean {\n const trimmed = value.trim();\n\n // `${NAME}`, `${NAME:-}`, `${NAME:-$OTHER}` — shell parameter expansion, and\n // the same syntax a JavaScript template literal uses.\n const braced = /^\\$\\{\\s*([A-Za-z_][\\w.]*)\\s*(?::?[-=+?]([\\s\\S]*))?\\}$/.exec(trimmed);\n if (braced) {\n const fallback = braced[2];\n if (fallback === undefined || fallback.trim() === '') return true;\n return /^\\$\\{?[A-Za-z_][\\w.]*\\}?$/.test(fallback.trim());\n }\n\n return (\n /^\\$[A-Za-z_]\\w*$/.test(trimmed) || // $VAR\n /^\\$\\([\\s\\S]*\\)$/.test(trimmed) || // $(command substitution)\n /^%[A-Za-z_]\\w*%$/.test(trimmed) || // %VAR% on Windows\n /^\\{\\{[\\s\\S]*\\}\\}$/.test(trimmed) || // {{ template }}\n /^#\\{[\\s\\S]*\\}$/.test(trimmed) || // #{ruby}\n /^<%=?[\\s\\S]*%>$/.test(trimmed) // <%= erb %>\n );\n}\n\n/** Stems that announce a value as scaffolding rather than material. */\nconst FIXTURE_STEMS = [\n 'test', 'mock', 'fake', 'dummy', 'stub', 'sample', 'example', 'placeholder',\n 'fixture', 'invalid', 'expired', 'forged', 'bogus', 'notreal', 'nonexistent',\n 'changeme', 'foobar', 'lorem',\n];\n\n/**\n * Words that appear in every declaration and say nothing about the value.\n *\n * Without this, `const` in the key and any value containing the letters\n * \"const\" would agree, and more usefully: a keyword shared by all declarations\n * is not evidence that the value echoes the *name*.\n */\nconst KEY_NOISE = new Set(['const', 'this', 'return', 'await', 'async', 'expect', 'value']);\n\n/** Alphabetic runs, splitting snake_case, kebab-case and camelCase alike. */\nfunction words(text: string): string[] {\n return text\n .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n .replace(/[^A-Za-z]+/g, ' ')\n .toLowerCase()\n .split(' ')\n .filter(Boolean);\n}\n\n/**\n * In a test file, does this value describe itself as a fixture?\n *\n * Applied only to `keywordShaped` rules and only under `isTestPath`, which is\n * what keeps it from being the generous allow-list the header warns about. Two\n * signals, both read off the value rather than off the variable holding it:\n *\n * 1. A word of it begins with a fixture stem — `test-token`,\n * `mock-session-token`, `testpassword123`, `forgedToken`. Matching a stem\n * at the start of a *word* rather than anywhere in the string is what\n * keeps `latest` and `contest` from reading as \"test\".\n * 2. It repeats a word from its own key — `access_token: 'access-token'`,\n * `const password = 'mySecurePassword123'`, `testGPGPassword:\n * 'gpgPassword456'`. A credential that spells out the word \"password\" is\n * a description of one, not one.\n *\n * The second signal is capped at 48 characters, and that cap is load-bearing.\n * Base64 is dense enough that a long blob contains a four-letter word by\n * accident — a 200-character service JWT would eventually \"echo\" any key you\n * put beside it and exempt itself. Real credentials are long and fixtures are\n * short, so the cap costs nothing and closes the hole.\n *\n * What stays reported, deliberately: a value with neither signal. In the\n * corpus this was written against that left four findings out of seventy-nine,\n * one of them a real Supabase service JWT pasted into a debug script — which\n * is exactly the one worth a human's attention.\n */\nexport function isTestFixtureValue(line: string, value: string): boolean {\n const valueWords = words(value);\n if (valueWords.some((word) => FIXTURE_STEMS.some((stem) => word.startsWith(stem)))) return true;\n\n return describesItsOwnKey(line, value);\n}\n\n/**\n * Does the value repeat a word from the name of the thing holding it?\n *\n * Signal 2 of `isTestFixtureValue`, lifted out because the reasoning behind it\n * was never about tests. `access_token: 'access-token'` is a description of a\n * credential rather than a credential in a test file and in production code\n * alike — the difference is only what to do about it, and that is the caller's\n * decision, not this function's.\n *\n * Outside a test the caller downgrades instead of skipping, which is what makes\n * generalising it safe. `DB_PASSWORD = \"password123\"` echoes its key and is\n * also a real, terrible, hardcoded credential; it stays in the report.\n *\n * This is the third of the three structural false-positive causes measured on\n * Go repositories, and on a cloud project it is the loudest. An AWS-compatible\n * API surface is built out of constants that name credentials without being\n * them:\n *\n * ErrExpiredToken = \"ExpiredToken\" // an API error code\n * pathToken = \"/latest/api/token\" // a URL path\n * hdrToken = \"X-aws-ec2-metadata-token\" // a header name\n * CommandSetMasterPassword = \"set-master-password\" // a CLI verb\n *\n * Every one matches `secret-generic-credential`, which keys on the *word*\n * `token` or `password` next to a quoted string and never looks at what the\n * string is. Every one repeats its own key.\n *\n * The 48-character cap is load-bearing and is explained on `isTestFixtureValue`:\n * base64 is dense enough that a long blob eventually contains a four-letter\n * word by accident and would exempt itself.\n */\nexport function describesItsOwnKey(line: string, value: string): boolean {\n if (value.length > 48) return false;\n\n const valueAt = line.lastIndexOf(value);\n const key = valueAt === -1 ? line : line.slice(0, valueAt);\n const flattened = words(value).join('');\n\n return words(key)\n .filter((word) => word.length >= 4 && !KEY_NOISE.has(word))\n .some((word) => flattened.includes(word));\n}\n\n/**\n * Replace anything that looks like credential material with asterisks.\n *\n * Applied to every excerpt on a secret finding before it reaches a terminal, a\n * SARIF file, a CI log or a PR comment. A scanner that prints the secret it\n * found has moved the secret somewhere new, and CI logs are retained and, on\n * public forks, published.\n */\nexport function redactSecret(line: string): string {\n return line.replace(/([A-Za-z0-9+/=_.-]{12,})/g, (match) => {\n if (match.length <= 12) return match;\n return `${match.slice(0, 3)}${'*'.repeat(Math.min(16, match.length - 3))}`;\n });\n}\n\n/** Files whose mere presence is worth reporting, independent of content. */\nexport const SENSITIVE_FILES: readonly { pattern: string; message: string; severity: Severity }[] = [\n { pattern: '.env', message: 'Environment file committed — the usual home of every runtime credential', severity: 'high' },\n { pattern: '.env.local', message: 'Local environment file committed', severity: 'high' },\n { pattern: '.env.production', message: 'Production environment file committed', severity: 'critical' },\n { pattern: 'id_rsa', message: 'Private SSH key committed', severity: 'critical' },\n { pattern: 'id_ed25519', message: 'Private SSH key committed', severity: 'critical' },\n { pattern: 'id_ecdsa', message: 'Private SSH key committed', severity: 'critical' },\n { pattern: '.pem', message: 'PEM certificate or key file committed', severity: 'high' },\n { pattern: '.p12', message: 'PKCS#12 keystore committed', severity: 'high' },\n { pattern: '.pfx', message: 'PKCS#12 keystore committed', severity: 'high' },\n { pattern: '.keystore', message: 'Java keystore committed', severity: 'high' },\n // Deliberately not `.npmrc`. Its presence is normal; only an `_authToken`\n // line in it is a credential, and that is a content match, not a filename\n // match. Reporting the file itself trades a real finding for a chore.\n];\n","/**\n * The scan engine, minus the filesystem: run every rule set over text.\n *\n * Kept free of I/O entirely — no reading, no printing, no exit codes, no\n * SARIF. The command layer decides how to present what this returns, which is\n * what lets the same scan feed a terminal, a SARIF file and a daemon run\n * without three implementations drifting apart.\n *\n * The absence of `node:` imports here is load-bearing, not incidental. This\n * module is the package's default entry point, and the browser surfaces —\n * web, extension, desktop renderer — import it directly. A single\n * `import … from 'node:fs'` anywhere in this file's dependency graph breaks\n * every one of their bundles, so the tree walker lives in `./node/walk.ts`\n * and everything here works on strings that somebody else read.\n */\n\nimport { CODE_RULES, evaluateRule, proseLines } from './code-rules';\nimport { scanPackageJson, scanRequirementsTxt } from './manifest-rules';\nimport {\n describesItsOwnKey,\n isKnownPlaceholder,\n isPlaceholderAttribute,\n isTestFixtureValue,\n isVariableReference,\n redactSecret,\n SECRET_RULES,\n} from './secret-rules';\nimport { evaluateTemplateRules, TEMPLATE_EXTENSIONS } from './template-rules';\nimport type { ScanFinding, ScanLanguage, Severity } from './types';\nimport { severityRank } from './types';\n\n/**\n * `extname` and `basename`, reimplemented in three lines each.\n *\n * Importing them from `node:path` is what would otherwise put this module —\n * and therefore the package's whole default entry point — out of reach of a\n * browser bundle, for two functions that are pure string arithmetic.\n *\n * Semantics match the originals on the inputs that reach them: a leading dot\n * is not an extension, so `.env` has none, and a name with no dot has none\n * either. Only `/` is treated as a separator, which is what the callers pass —\n * repository-relative paths and shebang interpreter paths.\n */\nfunction baseNameOf(path: string): string {\n return path.slice(path.lastIndexOf('/') + 1);\n}\n\nfunction extensionOf(path: string): string {\n const base = baseNameOf(path);\n const dot = base.lastIndexOf('.');\n return dot <= 0 ? '' : base.slice(dot);\n}\n\nexport const SKIP_DIRS = new Set([\n 'node_modules', '.git', '.next', '.nuxt', 'dist', 'build', 'out', '__pycache__',\n '.venv', 'venv', 'vendor', '.terraform', 'coverage', '.cache', '.pnpm-store',\n 'target', '.gradle', '.idea', '.vscode', 'bower_components', '.svelte-kit',\n]);\n\nexport const SCAN_EXTENSIONS = new Set([\n '.ts', '.js', '.tsx', '.jsx', '.mjs', '.cjs', '.mts', '.cts',\n '.py', '.rb', '.go', '.java', '.kt', '.scala', '.php', '.rs',\n '.c', '.cc', '.cpp', '.h', '.hpp', '.cs', '.swift',\n '.yml', '.yaml', '.json', '.toml', '.ini', '.cfg', '.conf', '.env',\n '.sh', '.bash', '.zsh', '.tf', '.hcl', '.xml', '.properties', '.gradle',\n '.txt', '.md', '.sql', '.erb', '.ejs', '.vue', '.svelte',\n // Template files, so the engine in `template-rules.ts` has something to\n // read. Sourced from the rules themselves rather than repeated here: an\n // engine added there becomes scannable without a second edit that could be\n // forgotten, which is how a rule ends up quietly never firing.\n ...TEMPLATE_EXTENSIONS,\n]);\n\nconst LANGUAGE_BY_EXTENSION: Record<string, ScanLanguage> = {\n '.js': 'javascript', '.jsx': 'javascript', '.mjs': 'javascript', '.cjs': 'javascript',\n '.ts': 'typescript', '.tsx': 'typescript', '.mts': 'typescript', '.cts': 'typescript',\n '.vue': 'javascript', '.svelte': 'javascript', '.ejs': 'javascript',\n '.py': 'python',\n '.rb': 'ruby', '.erb': 'ruby',\n '.go': 'go',\n '.java': 'java', '.kt': 'java', '.scala': 'java',\n '.php': 'php',\n '.sh': 'shell', '.bash': 'shell', '.zsh': 'shell',\n '.yml': 'config', '.yaml': 'config', '.json': 'config', '.toml': 'config',\n '.ini': 'config', '.cfg': 'config', '.conf': 'config', '.env': 'config',\n '.tf': 'config', '.hcl': 'config', '.properties': 'config',\n};\n\nexport function languageOf(filename: string): ScanLanguage {\n if (filename.startsWith('.env') || filename.endsWith('.env')) return 'config';\n return LANGUAGE_BY_EXTENSION[extensionOf(filename).toLowerCase()] ?? 'other';\n}\n\n/** Interpreters worth recognising, by the language their scripts are written in. */\nconst LANGUAGE_BY_INTERPRETER: Record<string, ScanLanguage> = {\n sh: 'shell', bash: 'shell', zsh: 'shell', dash: 'shell', ksh: 'shell', ash: 'shell',\n python: 'python', python2: 'python', python3: 'python',\n ruby: 'ruby',\n node: 'javascript', nodejs: 'javascript', deno: 'javascript', bun: 'javascript',\n php: 'php',\n};\n\n/**\n * The language a `#!` line declares, or `null` if the line is not a shebang.\n *\n * An executable in a repository root is routinely named for the command it\n * provides rather than the language it is written in — `debtap`, `configure`,\n * `gradlew`. Extension-based detection skips every one of them, which is worst\n * exactly where it matters: a project whose entire source is one extensionless\n * script gets a clean scan because nothing was read.\n *\n * The shebang is the authoritative answer to a question the filename cannot\n * answer, and the kernel already treats it that way.\n */\nexport function languageOfShebang(firstLine: string): ScanLanguage | null {\n const match = /^#!\\s*(\\S+)(?:\\s+(.+?))?\\s*$/.exec(firstLine);\n if (!match) return null;\n\n // `#!/usr/bin/env bash` names the interpreter in the argument, not the path.\n const command = baseNameOf(match[1]!);\n const args = match[2]?.trim().split(/\\s+/) ?? [];\n const splitString = args[0] === '-S' || args[0] === '--split-string';\n const name = command === 'env' ? baseNameOf(args[splitString ? 1 : 0] ?? '') : command;\n\n const exact = LANGUAGE_BY_INTERPRETER[name];\n if (exact) return exact;\n\n // `python3.11` and `bash5` are the same interpreters with a version glued on.\n const stripped = name.replace(/[\\d.]+$/, '');\n return (stripped ? LANGUAGE_BY_INTERPRETER[stripped] : undefined) ?? null;\n}\n\n\n/**\n * Inline suppression, matching the convention `modules/code-scanner` already\n * uses so a repository does not learn two syntaxes for the same idea.\n *\n * // threatcrush-disable-next-line secret-aws-access-key fixture, not a key\n * // threatcrush-disable-line\n *\n * The rule id is optional; without one the whole line is suppressed. This\n * exists because the highest-volume false positive in practice is a scanner's\n * own test fixtures — a file of deliberately-malformed credentials is\n * indistinguishable from a file of leaked ones, and only the author knows\n * which. Suppressions are counted and reported: a quiet scan full of\n * suppressions is not a clean one.\n */\nconst SUPPRESS_NEXT = /threatcrush-disable-next-line(?:\\s+([\\w-]+))?/;\nconst SUPPRESS_LINE = /threatcrush-disable-line(?:\\s+([\\w-]+))?/;\n\n/**\n * Another linter's suppression, naming the linter that means \"security\" in that\n * linter's own vocabulary.\n *\n * A repository that has already triaged a finding did so in the one place a\n * reviewer will look, which is the line itself. Re-raising it at full severity\n * asks the operator to make the same decision a second time in a different\n * tool, and printing an excerpt whose own text reads \"G101 false positive:\n * HTTP header name, not a credential\" is the clearest possible signal that\n * nothing read it.\n *\n * This used to insist the *rule* be named — `gosec` and `G101` both. That was\n * the wrong half of the annotation to key on, and it is the single biggest\n * source of noise on a mature Go repository. Measured on mulgadc/spinifex:\n * nine of its twenty-one `InsecureSkipVerify` lines carry a bare\n * `//nolint:gosec` with a written reason beside it —\n *\n * InsecureSkipVerify: true, //nolint:gosec // self-signed per-node certs\n *\n * — and every one was re-reported at high. Go projects overwhelmingly write the\n * bare form; requiring `G101` meant honouring the annotation almost nowhere it\n * is actually written, while claiming in the docstring to honour it.\n *\n * Naming the *linter* is still required, and that is what keeps this from\n * becoming a way to hide findings. `gosec` and `nosec` are a security linter\n * and its inline directive: a line carrying one has been looked at by a human\n * asking a security question. A bare `//nolint` is a statement about something,\n * with no reason to think it is about security at all, and `//nolint:errcheck`\n * is a statement about error handling. Neither counts.\n *\n * And the finding is downgraded rather than dropped, the way `isTestPath`\n * downgrades a fixture, so it stays in the report for anyone auditing the\n * suppressions themselves.\n */\nconst FOREIGN_SECURITY = /\\b(?:nolint:[\\w,]*gosec|nosec)\\b/;\n\nexport function foreignSecurityMark(line: string): boolean {\n return FOREIGN_SECURITY.test(line);\n}\n\nexport interface Suppressions {\n /** line index → set of rule ids, or `*` for every rule. */\n byLine: Map<number, Set<string>>;\n count: number;\n}\n\nexport function collectSuppressions(lines: readonly string[]): Suppressions {\n const byLine = new Map<number, Set<string>>();\n let count = 0;\n\n const add = (index: number, ruleId: string | undefined): void => {\n const existing = byLine.get(index) ?? new Set<string>();\n existing.add(ruleId ?? '*');\n byLine.set(index, existing);\n count += 1;\n };\n\n lines.forEach((line, index) => {\n const next = SUPPRESS_NEXT.exec(line);\n if (next) add(index + 1, next[1]);\n const same = SUPPRESS_LINE.exec(line);\n // `disable-next-line` also matches the `disable-line` substring, so only\n // treat it as a same-line directive when the longer form did not match.\n if (same && !next) add(index, same[1]);\n });\n\n return { byLine, count };\n}\n\nfunction isSuppressed(suppressions: Suppressions, index: number, ruleId: string): boolean {\n const rules = suppressions.byLine.get(index);\n if (!rules) return false;\n return rules.has('*') || rules.has(ruleId);\n}\n\n/**\n * Does this path hold tests or fixtures?\n *\n * Used to soften credential findings, never to hide them. A secret in a test\n * is nearly always a fixture — often a deliberately real-looking one, because\n * the test exists to prove the real path is guarded — but \"nearly always\" is\n * not \"always\", and a genuine key does get pasted into a test. So these are\n * still reported, at a severity that does not block a merge, rather than\n * dropped where nobody would ever see them.\n */\nexport function isTestPath(relativePath: string): boolean {\n const p = relativePath.replace(/\\\\/g, '/');\n return (\n /(?:^|\\/)(?:tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|e2e|testdata|testutils?|harness)\\//i.test(p) ||\n /(?:^|\\/)(?:test|conftest)_[^/]+$/i.test(p) ||\n /[._-](?:test|spec)\\.[a-z]+$/i.test(p) ||\n /_test\\.[a-z]+$/i.test(p)\n );\n}\n\n/**\n * Does this path hold documentation or illustrative code?\n *\n * The same softening as `isTestPath`, and for the *code* rules only. A fenced\n * block in a README is a transcript of a command someone might run, not a\n * program that runs: `go run . -log-dir /tmp/artifacts` in a usage example is\n * not a symlink attack on anybody, because nothing executes it.\n *\n * Deliberately not applied to the credential rules, which is the opposite of\n * what the volume on a documentation tree first suggests. Their noise is a\n * property of the *value*, and value is the axis they are keyed on:\n * `limen-regression.test.ts` pins a README quoting `postgres://user:pass@host`\n * as silent while a real DSN in that same README still reports at `high`, and a\n * path rule would give that up. A README is a perfectly ordinary place to leak\n * a key.\n *\n * mulgadc/spinifex matches the AWS key rule ninety-six times. Ninety of those\n * are in test paths and were already `low`; the remaining six are in `docs/`,\n * and they are every critical left on that repository after this change. See\n * the note in `secret-rules.ts` on typed sequences for why the value-side fix\n * that would have silenced them cannot be had without giving up real detection.\n */\nexport function isDocPath(relativePath: string): boolean {\n const p = relativePath.replace(/\\\\/g, '/');\n return (\n /(?:^|\\/)(?:docs?|examples?|samples?)\\//i.test(p) ||\n /\\.(?:md|mdx|markdown|rst|adoc)$/i.test(p)\n );\n}\n\n/**\n * Why a finding is being reported at `low` rather than at its rule's severity.\n *\n * Five contexts, one mechanism. Each says something about the *setting* of a\n * match rather than about the construct itself, so none of them may ever drop\n * a finding — a softened finding is still counted, still printed, still in the\n * SARIF, and `--fail-on low` still stops on it. The severity is the claim being\n * weakened, not the report.\n *\n * That is the line this must not cross. Every one of these is a heuristic about\n * where code lives or what it is named, and heuristics of that kind are wrong\n * often enough that they may inform a severity and never a verdict.\n */\ntype Softening = 'test' | 'docs' | 'suppressed' | 'placeholder' | 'self-describing';\n\n/** Most specific evidence first, so it is the reason the operator is shown. */\nconst SOFTENING_ORDER: readonly Softening[] = [\n 'suppressed',\n 'placeholder',\n 'self-describing',\n 'test',\n 'docs',\n];\n\nfunction softening(reasons: Partial<Record<Softening, boolean>>): Softening | null {\n return SOFTENING_ORDER.find((reason) => reasons[reason]) ?? null;\n}\n\n/** The clause completing \"Possible AWS Access Key detected …\" on a secret. */\nconst SECRET_SOFTENING: Record<Softening, string> = {\n test: 'in a test file — usually a fixture, still worth confirming it is not a live credential',\n docs: 'in documentation — usually an illustrative example, still worth confirming it is not a live credential',\n suppressed: \"on a line already marked as a false positive for another linter's security rule\",\n placeholder: 'in example text an empty input field shows, not in data',\n 'self-describing':\n 'in a value that repeats the name of the field holding it — usually a description of a credential rather than one',\n};\n\n/** The clause appended to a code finding's message to say why it was softened. */\nconst CODE_SOFTENING: Record<Softening, string> = {\n test: 'in a test file, where the construct is ordinary',\n docs: 'in documentation or example code, which nothing runs',\n suppressed: \"on a line another linter's security suppression already covers\",\n placeholder: 'in example text rather than in data',\n 'self-describing': 'in a value that describes itself',\n};\n\n/** Scan a single file's text. Exposed for tests and for single-file callers. */\nexport function scanText(\n relativePath: string,\n text: string,\n language: ScanLanguage = languageOf(relativePath),\n): ScanFinding[] {\n const findings: ScanFinding[] = [];\n const lines = text.split('\\n');\n const suppressions = collectSuppressions(lines);\n const inTests = isTestPath(relativePath);\n const inDocs = isDocPath(relativePath);\n\n // ── Credentials ────────────────────────────────────────────────────────\n lines.forEach((line, index) => {\n for (const rule of SECRET_RULES) {\n const match = rule.pattern.exec(line);\n if (!match) continue;\n if (isKnownPlaceholder(match[0])) continue;\n if (isSuppressed(suppressions, index, rule.id)) continue;\n\n // The value the rule actually captured, falling back to the whole match\n // for the vendor-prefixed rules, which have no capture group because the\n // format *is* the value.\n const value = match[1] ?? match[0];\n\n // An expansion is not a literal, in a test file or anywhere else.\n if (isVariableReference(value)) continue;\n\n // Fixtures, and only in files that are fixtures by construction. See\n // `isTestFixtureValue` for why this cannot reach a vendor-issued key.\n if (inTests && rule.keywordShaped && isTestFixtureValue(line, value)) continue;\n\n // A value that repeats its own key is a description of a credential\n // rather than one — and unlike the fixture exemption above, that is true\n // outside a test too, so it softens rather than skips. See\n // `describesItsOwnKey`.\n //\n // Note the `false` where the code rules below pass `inDocs`. Documentation\n // noise is a *value* problem for the credential rules and is solved by\n // `isKnownPlaceholder`, deliberately: `limen-regression.test.ts` pins the\n // behaviour that a README quoting `postgres://user:pass@host` is silent\n // while a real DSN in the same README is still `high`. Softening secrets\n // by path would take that guarantee away, and a README is a perfectly\n // ordinary place to leak a key.\n const soft = softening({\n test: inTests,\n suppressed: foreignSecurityMark(line),\n placeholder: isPlaceholderAttribute(line, value),\n 'self-describing': rule.keywordShaped === true && describesItsOwnKey(line, value),\n });\n\n findings.push({\n ruleId: rule.id,\n title: rule.name,\n file: relativePath,\n line: index + 1,\n // Reported but not blocking wherever context weakens the claim — see\n // `softening`. Never dropped: the count is the same either way.\n severity: soft ? 'low' : rule.severity,\n // A matched credential format is the finding, not a proxy for one.\n confidence: 'evidence',\n message: soft\n ? `Possible ${rule.name} detected ${SECRET_SOFTENING[soft]}`\n : `Possible ${rule.name} detected`,\n consequence: rule.consequence,\n cwe: rule.cwe,\n excerpt: redactSecret(line.trim()).slice(0, 200),\n sensitive: true,\n category: 'secret',\n });\n }\n });\n\n // ── Code-level constructs ──────────────────────────────────────────────\n const prose = proseLines(lines);\n lines.forEach((_line, index) => {\n for (const rule of CODE_RULES) {\n if (isSuppressed(suppressions, index, rule.id)) continue;\n const match = evaluateRule(rule, { lines, index, language, prose });\n if (!match) continue;\n\n // The context the credential rules above have always read, applied to the\n // code rules for the first time. Leaving it off them was the second of\n // the three structural false-positive causes and much the largest: on\n // mulgadc/spinifex it is 104 findings, every one of them a code rule\n // reporting at full severity from inside a test — `\"/tmp/test-wal\"` in a\n // table-driven fixture, `exec.Command(\"sh\", \"-c\", \"exit 42\")` in a\n // process-supervision test, `InsecureSkipVerify` against the harness's own\n // self-signed certificate. Each is the normal way to write that test.\n const soft = softening({\n test: inTests,\n docs: inDocs,\n suppressed: foreignSecurityMark(lines[index] ?? ''),\n });\n\n findings.push({\n ruleId: rule.id,\n title: rule.title,\n file: relativePath,\n line: index + 1,\n severity: soft ? 'low' : match.severity,\n confidence: match.confidence,\n message: soft ? `${rule.title} (${rule.cwe}) — ${CODE_SOFTENING[soft]}` : `${rule.title} (${rule.cwe})`,\n consequence: rule.consequence,\n cwe: rule.cwe,\n excerpt: (lines[index] ?? '').trim().slice(0, 200),\n category: 'code',\n });\n }\n });\n\n // ── Template output ────────────────────────────────────────────────────\n //\n // Keyed on the extension rather than on `language`, because the extension is\n // what names the engine and the engine is what decides which syntax skips\n // escaping. This runs *in addition to* the code rules above, so a `.vue`\n // file is checked both as JavaScript and as a template.\n for (const match of evaluateTemplateRules(extensionOf(relativePath), lines)) {\n const index = match.line - 1;\n if (isSuppressed(suppressions, index, match.rule.id)) continue;\n\n const soft = softening({\n test: inTests,\n docs: inDocs,\n suppressed: foreignSecurityMark(lines[index] ?? ''),\n });\n\n findings.push({\n ruleId: match.rule.id,\n title: match.rule.title,\n file: relativePath,\n line: match.line,\n severity: soft ? 'low' : match.severity,\n confidence: 'pattern',\n message: soft\n ? `${match.rule.title} (${match.rule.cwe}) — ${CODE_SOFTENING[soft]}`\n : `${match.rule.title} (${match.rule.cwe})`,\n consequence: match.rule.consequence,\n cwe: match.rule.cwe,\n excerpt: (lines[index] ?? '').trim().slice(0, 200),\n category: 'code',\n });\n }\n\n return findings;\n}\n\nexport function scanManifest(relativePath: string, filename: string, text: string): ScanFinding[] {\n const manifestFindings =\n filename === 'package.json'\n ? scanPackageJson(text)\n : filename === 'requirements.txt'\n ? scanRequirementsTxt(text)\n : [];\n\n return manifestFindings.map((finding) => ({\n ruleId: finding.ruleId,\n title: finding.title,\n file: relativePath,\n line: finding.line,\n severity: finding.severity,\n confidence: 'evidence' as const,\n message: finding.message,\n consequence: finding.consequence,\n cwe: finding.cwe,\n excerpt: finding.excerpt.slice(0, 200),\n category: 'manifest' as const,\n }));\n}\n\n\n\n/** Highest severity present, or null for a clean scan. */\nexport function peakSeverity(findings: readonly ScanFinding[]): Severity | null {\n let peak: Severity | null = null;\n for (const finding of findings) {\n if (!peak || severityRank(finding.severity) > severityRank(peak)) peak = finding.severity;\n }\n return peak;\n}\n\n/** True when any finding is at or above `threshold`. Drives `--fail-on`. */\nexport function meetsFailThreshold(\n findings: readonly ScanFinding[],\n threshold: readonly Severity[],\n): boolean {\n if (threshold.length === 0) return false;\n const floor = Math.min(...threshold.map(severityRank));\n return findings.some((finding) => severityRank(finding.severity) >= floor);\n}\n","/**\n * The filesystem half of the scan engine: walk a tree, read what is scannable,\n * hand the text to the rules.\n *\n * Split from `../text.ts` because this file imports `node:fs` and that one must\n * not. The package's default entry point is consumed by browser bundles, and a\n * single filesystem import anywhere in its graph breaks all of them. Everything\n * that needs a disk lives behind the `./node` entry point instead.\n */\n\nimport {\n closeSync, fstatSync, openSync, readdirSync, readFileSync, readSync, statSync,\n} from 'node:fs';\nimport { basename, dirname, extname, join, relative, sep } from 'node:path';\nimport { ControlAudit } from '../controls';\nimport { SENSITIVE_FILES } from '../secret-rules';\nimport {\n collectSuppressions,\n languageOf,\n languageOfShebang,\n SCAN_EXTENSIONS,\n scanManifest,\n scanText,\n SKIP_DIRS,\n} from '../text';\nimport type { ScanFinding, ScanLanguage } from '../types';\nimport { severityRank } from '../types';\n\nexport interface ScanOptions {\n /** Skip files larger than this. Defaults to 1 MiB. */\n maxFileBytes?: number;\n /** Called once per file actually read, for progress reporting. */\n onFile?: (path: string) => void;\n /** Restrict to these rule categories. Defaults to all. */\n categories?: readonly ScanFinding['category'][];\n /**\n * Paths to skip, as globs over repository-relative POSIX paths.\n *\n * Merged with a `.threatcrushignore` file at the scan root, if present. The\n * intended use is generated output, vendored trees, and — the case that\n * prompted this — a scanner's own rule definitions and test fixtures, which\n * are vulnerable-looking by design and otherwise dominate its self-scan.\n *\n * Excluding is not the same as finding nothing: the count of skipped paths\n * is reported (`ScanReport.excluded`) and surfaced, so a scan silenced by a\n * broad glob cannot be mistaken for a clean one.\n */\n exclude?: readonly string[];\n /**\n * Also report security controls the tree has no evidence of.\n *\n * Opt-in, because an absence is a weaker claim than a present defect and\n * this one is answered from the whole tree rather than from a line — see\n * `../controls.ts`. Silently produces nothing when the tree serves no HTTP.\n */\n missingControls?: boolean;\n}\n\n/**\n * Compile exclusion globs into one predicate over relative POSIX paths.\n *\n * gitignore-flavoured: `*` matches within a path segment, `**` across\n * segments, `?` a single non-slash character. A pattern with no `/` matches by\n * name at any depth — `__tests__` excludes every directory so named — while a\n * pattern containing `/` is anchored to the scan root. Blank lines and `#`\n * comments are ignored, so a `.threatcrushignore` file can be passed straight\n * in. Exported for its own tests.\n */\nexport function compileExcludes(patterns: readonly string[]): (relPath: string) => boolean {\n const matchers = patterns\n .map((p) => p.trim())\n .filter((p) => p.length > 0 && !p.startsWith('#'))\n .map(compilePattern);\n if (matchers.length === 0) return () => false;\n return (relPath) => {\n const segs = relPath.split('/');\n return matchers.some((m) => m(segs));\n };\n}\n\n/**\n * Matching is done segment by segment, in code, rather than by compiling the\n * glob into one big regex.\n *\n * A cross-segment regex — `(?:[^/]+/)*` for depth, a dot-star for `**` — is the\n * shape that backtracks quadratically on a path full of slashes, the\n * polynomial-ReDoS CodeQL flags and this scanner has its own rule for. There is\n * no way to feed a whole path through a single generated pattern without that\n * risk. Splitting both the pattern and the path on `/` and walking them with a\n * two-pointer (the classic `**` alignment) removes it entirely: each per-segment\n * regex is a trivial `^…$` with a single quantifier and is tested against one\n * bounded segment, never the whole path.\n */\nconst GLOBSTAR = Symbol('globstar');\ntype SegMatcher = RegExp | typeof GLOBSTAR;\n\nfunction compilePattern(pattern: string): (segs: readonly string[]) => boolean {\n // Trailing slashes are trimmed without a regex: `/\\/+$/` is unanchored, so\n // `replace` retries at every start position and is quadratic on a value that\n // is all slashes — the very polynomial-ReDoS this file is avoiding.\n const withoutLead = pattern.replace(/^\\.?\\//, '');\n let end = withoutLead.length;\n while (end > 0 && withoutLead[end - 1] === '/') end -= 1;\n const p = withoutLead.slice(0, end);\n\n // A pattern with no `/` matches by name at any depth: excluded if any single\n // segment matches it.\n if (!p.includes('/')) {\n if (p === '**') return () => true;\n const rx = segToRegExp(p);\n return (segs) => segs.some((s) => rx.test(s));\n }\n\n const raw = p.split('/');\n // A trailing `**` means \"the contents of\", so it must not match the directory\n // itself — the path has to be strictly deeper than the leading parts.\n const trailingGlobstar = raw[raw.length - 1] === '**';\n const core = trailingGlobstar ? raw.slice(0, -1) : raw;\n const parts: SegMatcher[] = core.map((s) => (s === '**' ? GLOBSTAR : segToRegExp(s)));\n\n return (segs) => {\n const end = matchPrefix(parts, segs);\n if (end < 0) return false;\n // `end` is where the pattern stopped; everything past it is the pruned\n // subtree. A prefix match covers the path and all of its descendants;\n // `dir/**` additionally requires at least one descendant.\n return trailingGlobstar ? end < segs.length : true;\n };\n}\n\n/** `*` within a segment, `?` one character; a segment contains no slash. */\nfunction segToRegExp(seg: string): RegExp {\n let body = '';\n for (let i = 0; i < seg.length; i += 1) {\n const c = seg[i]!;\n if (c === '*') {\n // Collapse a run of `*` into one `[^/]*`; `[^/]*[^/]*` is two adjacent\n // stars over the same characters, which backtracks quadratically.\n while (seg[i + 1] === '*') i += 1;\n body += '[^/]*';\n } else if (c === '?') {\n body += '[^/]';\n } else {\n body += c.replace(/[.+^${}()|[\\]\\\\]/g, '\\\\$&');\n }\n }\n return new RegExp(`^${body}$`);\n}\n\n/**\n * Align `parts` against a prefix of `segs`, `GLOBSTAR` consuming zero or more\n * segments. Returns the index in `segs` where the match ends, or -1. A\n * two-pointer with one backtrack point for the active globstar — O(segments),\n * no catastrophic backtracking.\n */\nfunction matchPrefix(parts: readonly SegMatcher[], segs: readonly string[]): number {\n let pi = 0;\n let si = 0;\n let star = -1;\n let starSi = -1;\n\n while (pi < parts.length) {\n const part = parts[pi]!;\n if (part === GLOBSTAR) {\n star = pi;\n starSi = si;\n pi += 1;\n } else if (si < segs.length && part.test(segs[si]!)) {\n pi += 1;\n si += 1;\n } else if (star !== -1 && starSi < segs.length) {\n starSi += 1;\n si = starSi;\n pi = star + 1;\n } else {\n return -1;\n }\n }\n return si;\n}\n\n/** The globs in a `.threatcrushignore` at `root`, or `[]` if there is none. */\nfunction readIgnoreFile(root: string): string[] {\n try {\n return readFileSync(join(root, '.threatcrushignore'), 'utf-8').split('\\n');\n } catch {\n return [];\n }\n}\n\nexport interface ScanReport {\n findings: ScanFinding[];\n filesScanned: number;\n /**\n * How many inline suppressions were honoured. Reported, never hidden: a\n * scan that came back quiet because someone silenced forty rules is a\n * different result from a scan that came back quiet.\n */\n suppressed: number;\n /**\n * Directory that finding paths are relative to. Equal to the target for a\n * directory scan, its parent for a single-file scan. SARIF URI resolution\n * needs this — guessing it from the target is what produces file URIs that\n * resolve to nothing.\n */\n root: string;\n /**\n * Files matched by extension but unreadable. Reported rather than swallowed:\n * a scan that could not read a file has not cleared it, and \"0 findings\"\n * over an unread tree is the failure this scanner exists to avoid.\n */\n unreadable: string[];\n /**\n * How many paths an exclusion glob skipped — a pruned directory counts once,\n * not per file inside it. Reported for the same reason `suppressed` is: a\n * quiet scan produced by a broad `.threatcrushignore` is not a clean scan.\n */\n excluded: number;\n}\n\nexport function scanPath(targetPath: string, options: ScanOptions = {}): ScanReport {\n const maxFileBytes = options.maxFileBytes ?? 1024 * 1024;\n const allowed = options.categories ? new Set(options.categories) : null;\n const findings: ScanFinding[] = [];\n const controls = new ControlAudit();\n const unreadable: string[] = [];\n let filesScanned = 0;\n let suppressed = 0;\n let excluded = 0;\n\n // A file target is not a degenerate directory target. `readdirSync` on a\n // file throws ENOTDIR, which the walker below treats as an unreadable\n // directory — so `threatcrush scan app.js` reported a clean scan of a file\n // it never opened. Resolve the shape first, and walk only what is walkable.\n const rootIsDirectory = (() => {\n try {\n return statSync(targetPath).isDirectory();\n } catch {\n return true;\n }\n })();\n const walkRoot = rootIsDirectory ? targetPath : dirname(targetPath);\n\n // Exclusions come from both the caller and a committed `.threatcrushignore`,\n // so a repository can carry its own ignore list without every invocation\n // repeating `--exclude`. Compiled once for the whole walk.\n const isExcluded = compileExcludes([...(options.exclude ?? []), ...readIgnoreFile(walkRoot)]);\n\n const scanFile = (fullPath: string, filename: string): void => {\n const relativePath = toRelative(walkRoot, fullPath);\n const extension = extname(filename).toLowerCase();\n const isManifest = filename === 'package.json' || filename === 'requirements.txt';\n const scannable = SCAN_EXTENSIONS.has(extension) || filename.startsWith('.env');\n\n // A file with no extension gets one question asked of it before being\n // dismissed: does it start with a shebang? Executables are habitually named\n // for what they do rather than what they are written in, and skipping them\n // silently is how a repository whose only source file is `debtap` scans\n // clean. Files that carry an unrecognised extension are still skipped —\n // `.png` is not a script, and sniffing every one of them would mean reading\n // the whole tree.\n const mayDeclareInterpreter = !scannable && !isManifest && extension === '';\n\n if (!scannable && !isManifest && !mayDeclareInterpreter) {\n recordSensitiveFile(filename, relativePath, findings, []);\n return;\n }\n\n // Size-check and read through one descriptor.\n //\n // `statSync(path)` followed by `readFileSync(path)` is check-then-use: the\n // path can be replaced between the two calls, so the size that was checked\n // is not necessarily the size that gets read. Opening once and calling\n // `fstatSync` on the descriptor removes the window — the descriptor refers\n // to the same inode for both operations, whatever happens to the name.\n //\n // A scanner walking directories it does not control is exactly where this\n // matters, and CWE-362 is a class this tool reports on. Worth getting\n // right in its own walker.\n let text: string;\n let handle: number;\n let declared: ScanLanguage | null = null;\n try {\n handle = openSync(fullPath, 'r');\n } catch {\n unreadable.push(relativePath);\n return;\n }\n\n try {\n if (fstatSync(handle).size > maxFileBytes) return;\n\n // Sniff the shebang from a short prefix rather than the whole file, so an\n // extensionless blob — a checked-in binary, a data file — costs one small\n // read instead of a megabyte decoded as UTF-8 and thrown away.\n if (mayDeclareInterpreter) {\n const prefix = Buffer.alloc(128);\n const read = readSync(handle, prefix, 0, prefix.length, 0);\n declared = languageOfShebang(prefix.subarray(0, read).toString('utf-8').split('\\n', 1)[0] ?? '');\n if (!declared) return;\n }\n\n text = readFileSync(handle, 'utf-8');\n } catch {\n unreadable.push(relativePath);\n return;\n } finally {\n try {\n closeSync(handle);\n } catch {\n /* the descriptor is going away regardless */\n }\n }\n\n filesScanned += 1;\n options.onFile?.(relativePath);\n suppressed += collectSuppressions(text.split('\\n')).count;\n\n // Observed before the per-file rules run, and unconditionally: the audit\n // keeps four booleans, so the cost of always collecting is nil, and\n // gating it on the option would make the evidence depend on flag order.\n controls.observe(relativePath, text);\n\n const fileFindings = [\n ...scanText(relativePath, text, declared ?? languageOf(filename)),\n ...(isManifest ? scanManifest(relativePath, filename, text) : []),\n ];\n\n findings.push(...fileFindings);\n recordSensitiveFile(filename, relativePath, findings, fileFindings);\n };\n\n const walk = (currentPath: string): void => {\n let entries;\n try {\n entries = readdirSync(currentPath, { withFileTypes: true });\n } catch {\n unreadable.push(toRelative(walkRoot, currentPath));\n return;\n }\n\n for (const entry of entries) {\n const fullPath = join(currentPath, entry.name);\n const relativePath = toRelative(walkRoot, fullPath);\n\n if (entry.isDirectory()) {\n if (SKIP_DIRS.has(entry.name)) continue;\n // A directory match prunes the whole subtree and counts once, rather\n // than descending it to skip each file — the point is not to read it.\n if (isExcluded(relativePath)) {\n excluded += 1;\n continue;\n }\n walk(fullPath);\n continue;\n }\n if (!entry.isFile()) continue;\n if (isExcluded(relativePath)) {\n excluded += 1;\n continue;\n }\n\n scanFile(fullPath, entry.name);\n }\n };\n\n if (rootIsDirectory) {\n walk(targetPath);\n } else if (isExcluded(toRelative(walkRoot, targetPath))) {\n excluded += 1;\n } else {\n scanFile(targetPath, basename(targetPath));\n }\n\n // After the walk, because the question is \"anywhere in this tree\" and only\n // the last file can settle it.\n if (options.missingControls) findings.push(...controls.findings());\n\n const filtered = allowed ? findings.filter((f) => allowed.has(f.category)) : findings;\n filtered.sort(\n (a, b) =>\n severityRank(b.severity) - severityRank(a.severity) ||\n a.file.localeCompare(b.file) ||\n a.line - b.line,\n );\n\n return { findings: filtered, filesScanned, unreadable, suppressed, excluded, root: walkRoot };\n}\n\n/**\n * Report a file whose *name* is the finding — but only when its contents\n * produced nothing.\n *\n * A `.env` full of detected credentials does not also need \"this is a .env\n * file\" stapled to line 1. The filename finding exists for the case the\n * content rules cannot cover: an env file whose values are shapes no vendor\n * rule matches, which is still an env file that should not be committed.\n */\nfunction recordSensitiveFile(\n filename: string,\n relativePath: string,\n sink: ScanFinding[],\n fileFindings: readonly ScanFinding[],\n): void {\n if (fileFindings.length > 0) return;\n\n for (const sensitive of SENSITIVE_FILES) {\n const matches = filename === sensitive.pattern || filename.endsWith(sensitive.pattern);\n if (!matches) continue;\n sink.push({\n ruleId: 'sensitive-file-committed',\n title: 'Sensitive file',\n file: relativePath,\n line: 1,\n severity: sensitive.severity,\n confidence: 'evidence',\n message: sensitive.message,\n consequence: 'Anything in this file is in every clone, fork and CI cache of the repository.',\n cwe: 'CWE-538',\n excerpt: '',\n sensitive: true,\n category: 'file',\n });\n return;\n }\n}\n\nfunction toRelative(base: string, target: string): string {\n const rel = relative(base, target);\n return (rel === '' ? target : rel).split(sep).join('/');\n}\n","/**\n * Dependency advisory lookup against OSV.dev (PRD 06).\n *\n * Split out of `commands/scan.ts` unchanged in behaviour. It is the only part\n * of a scan that makes network calls, and that difference is worth a module\n * boundary: the pattern rules are deterministic and fast, this is neither, and\n * CI wants to choose. `runScan` keeps calling it (the daemon has always\n * included advisories); the CLI asks for it with `--deps`.\n *\n * The lockfile list and the parser used to disagree. `pnpm-lock.yaml`,\n * `yarn.lock` and `Pipfile.lock` were listed as supported, matched by\n * filename, and then fell through a parser that only implemented\n * `package-lock.json` and `requirements.txt` — so they resolved to zero\n * dependencies and the scan reported nothing. Not \"could not parse this\n * lockfile\": nothing, which reads exactly like a clean result. A pnpm\n * repository (this one included) got a dependency scan that never asked OSV a\n * single question.\n *\n * So every entry in `LOCKFILES` now names the function that parses it. Adding\n * a filename without a parser is a type error rather than a silent hole.\n */\n\nimport { existsSync, readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport type { ScanFinding, Severity } from '../types';\n\ninterface OsvVulnerability {\n id: string;\n summary?: string;\n details?: string;\n severity?: Array<{ type: string; score: string }>;\n}\n\nexport interface LockedDependency {\n name: string;\n version: string;\n}\n\ntype LockfileParser = (content: string) => LockedDependency[];\n\ninterface LockfileSupport {\n file: string;\n ecosystem: string;\n parse: LockfileParser;\n}\n\n/** Cap per lockfile, so a first run on a neglected tree summarises rather than floods OSV. */\nconst MAX_DEPS_PER_LOCKFILE = 50;\n\nexport async function scanDependencies(targetPath: string): Promise<ScanFinding[]> {\n const findings: ScanFinding[] = [];\n\n for (const { file, ecosystem, parse } of LOCKFILES) {\n const lockPath = join(targetPath, file);\n if (!existsSync(lockPath)) continue;\n\n let deps: LockedDependency[];\n try {\n deps = dedupe(parse(readFileSync(lockPath, 'utf-8')));\n } catch {\n continue;\n }\n\n // A lockfile that parsed to nothing is a parser problem, not an empty\n // project — real lockfiles have entries. Say so rather than moving on,\n // because the alternative is a scan that reports clean without asking.\n if (deps.length === 0) {\n findings.push(incompleteFinding(file, 'No dependencies could be read from this lockfile.'));\n continue;\n }\n\n if (deps.length > MAX_DEPS_PER_LOCKFILE) {\n findings.push(\n incompleteFinding(\n file,\n `Only the first ${MAX_DEPS_PER_LOCKFILE} of ${deps.length} locked packages were checked against OSV.`,\n ),\n );\n }\n\n for (const dep of deps.slice(0, MAX_DEPS_PER_LOCKFILE)) {\n let vulns: OsvVulnerability[];\n try {\n vulns = await queryOsv(dep.name, dep.version, ecosystem);\n } catch {\n continue;\n }\n\n for (const vuln of vulns) {\n const cvss = vuln.severity?.find((entry) => entry.type === 'CVSS_V3')?.score;\n findings.push({\n ruleId: 'dependency-known-vulnerability',\n title: 'Dependency CVE',\n file,\n line: 1,\n severity: severityFromCvss(cvss),\n confidence: 'evidence',\n message: `${dep.name}@${dep.version}: ${vuln.summary ?? vuln.id}`,\n consequence: 'A published advisory exists for the exact version resolved in this lockfile.',\n excerpt: `${vuln.id}${cvss ? ` (CVSS: ${cvss})` : ''}`,\n category: 'dependency',\n });\n }\n }\n }\n\n return findings;\n}\n\n/**\n * Coverage the operator did not get. Low severity because nothing dangerous\n * has been found; the point is that the absence of findings for this file\n * carries no information, and a clean report should not imply otherwise.\n */\nfunction incompleteFinding(file: string, message: string): ScanFinding {\n return {\n ruleId: 'dependency-scan-incomplete',\n title: 'Dependency scan incomplete',\n file,\n line: 1,\n severity: 'low',\n confidence: 'evidence',\n message,\n consequence: 'Advisories affecting the unchecked packages would not appear in this report.',\n excerpt: file,\n category: 'dependency',\n };\n}\n\nfunction severityFromCvss(score: string | undefined): Severity {\n if (!score) return 'medium';\n const value = Number.parseFloat(score);\n if (Number.isNaN(value)) return 'medium';\n if (value >= 9) return 'critical';\n if (value >= 7) return 'high';\n if (value >= 4) return 'medium';\n return 'low';\n}\n\n/**\n * One query per distinct name@version. Lockfiles repeat a package once per\n * dependent, and a 900-line `yarn.lock` can resolve to a few hundred unique\n * packages — the duplicates would spend the per-file cap on questions already\n * asked.\n */\nfunction dedupe(deps: LockedDependency[]): LockedDependency[] {\n const seen = new Set<string>();\n const unique: LockedDependency[] = [];\n for (const dep of deps) {\n const key = `${dep.name}@${dep.version}`;\n if (seen.has(key)) continue;\n seen.add(key);\n unique.push(dep);\n }\n return unique;\n}\n\n/**\n * Split `name@version` where the name may itself begin with `@`.\n *\n * `@babel/core@7.24.7` has two `@`, and only the last one separates. Anything\n * without a separating `@` is a spec this parser does not understand, and is\n * dropped rather than guessed at.\n */\nfunction splitNameVersion(spec: string): LockedDependency | null {\n const at = spec.lastIndexOf('@');\n if (at <= 0) return null;\n const name = spec.slice(0, at);\n const version = spec.slice(at + 1);\n if (!name || !version) return null;\n return { name, version };\n}\n\n/**\n * A resolved version, or null if the string is a range, a tag or a URL.\n *\n * OSV answers questions about exact versions. `^7.0.0`, `next` and\n * `github:owner/repo` are not versions, and sending them produces a confident\n * empty answer — the worst possible result, because it looks like \"no known\n * advisories\".\n */\nfunction exactVersion(raw: string): string | null {\n const version = raw.trim().replace(/^[=v]+/, '');\n return /^[0-9][0-9a-zA-Z.+-]*$/.test(version) ? version : null;\n}\n\nfunction parsePackageLock(content: string): LockedDependency[] {\n const lock = JSON.parse(content) as {\n packages?: Record<string, { version?: string }>;\n dependencies?: Record<string, { version?: string }>;\n };\n const packages = lock.packages ?? lock.dependencies ?? {};\n const deps: LockedDependency[] = [];\n for (const [key, value] of Object.entries(packages)) {\n // v2+ keys are paths (`node_modules/a/node_modules/b`); the package is the\n // last segment, not the whole path.\n const name = key.replace(/^.*node_modules\\//, '');\n const version = value?.version;\n if (name && version && !name.startsWith('.')) deps.push({ name, version });\n }\n return deps;\n}\n\n/**\n * pnpm writes its resolved tree as keys under `packages:`, and has changed the\n * shape of those keys three times:\n *\n * v5 `/@babel/core/7.24.7:`\n * v6 `/@babel/core@7.24.7:`\n * v9 `'@babel/core@7.24.7':`\n *\n * All three are handled by normalising the key rather than by detecting the\n * lockfile version, because a scanner that recognises only the version it was\n * written against fails silently on the next one — which is the failure this\n * file exists to fix.\n *\n * Peer-dependency suffixes (`(react@18.3.1)`, `_react@17.0.2`) are stripped:\n * they describe the resolution context, not the package.\n */\nfunction parsePnpmLock(content: string): LockedDependency[] {\n const deps: LockedDependency[] = [];\n let inPackages = false;\n\n for (const line of content.split('\\n')) {\n if (/^[a-zA-Z]/.test(line)) {\n inPackages = line.startsWith('packages:');\n continue;\n }\n if (!inPackages) continue;\n\n // Entries sit exactly one level in. Deeper lines are the entry's fields.\n const match = /^ {2}(?! )(.+):\\s*$/.exec(line);\n if (!match?.[1]) continue;\n\n let key = match[1].trim().replace(/^['\"]|['\"]$/g, '');\n key = key.replace(/^\\//, '');\n // Parentheses cannot occur in a package name, so the v6/v9 peer suffix can\n // be cut from the whole key.\n key = key.replace(/\\(.*$/, '');\n\n // v5 separated the version with a slash. It is split here rather than\n // rewritten into the `@` form, because a v5 peer suffix (`_react@17.0.2`)\n // contains an `@` of its own and would capture the generic splitter.\n let name: string;\n let rawVersion: string;\n const slashed = /^(@?[^@]+)\\/([0-9][^/]*)$/.exec(key);\n if (slashed?.[1] && slashed[2]) {\n name = slashed[1];\n rawVersion = slashed[2];\n } else {\n const dep = splitNameVersion(key);\n if (!dep) continue;\n name = dep.name;\n rawVersion = dep.version;\n }\n\n // The v5 peer suffix is an underscore, which *is* legal in a package name\n // — so it is only ever stripped from the version, never from the name.\n const version = exactVersion(rawVersion.replace(/_.*$/, ''));\n if (version) deps.push({ name, version });\n }\n\n return deps;\n}\n\n/**\n * Both yarn dialects, which differ in punctuation rather than structure:\n *\n * v1 `\"@babel/core@^7.0.0\":` then ` version \"7.24.7\"`\n * berry `\"@babel/core@npm:^7.0.0\":` then ` version: 7.24.7`\n *\n * The header carries the name and the indented `version` carries the truth, so\n * the parser holds the last header and waits.\n */\nfunction parseYarnLock(content: string): LockedDependency[] {\n const deps: LockedDependency[] = [];\n let pendingName: string | null = null;\n\n for (const line of content.split('\\n')) {\n if (line.startsWith('#') || line.trim() === '') continue;\n\n if (!/^\\s/.test(line)) {\n pendingName = null;\n const header = line.replace(/:\\s*$/, '');\n // Multiple specs share one entry; they name the same package, so the\n // first is enough.\n const first = header.split(',')[0]?.trim().replace(/^['\"]|['\"]$/g, '');\n if (!first) continue;\n // `__metadata:` and other berry bookkeeping blocks are not packages.\n if (!first.includes('@') || first === '__metadata') continue;\n // Anything resolved by a non-registry protocol is local to this\n // checkout — the workspace root resolves to `0.0.0-use.local`, which is\n // a well-formed version of a package no registry has ever heard of.\n // Asking OSV about it spends the per-file cap on a guaranteed miss.\n if (/@(?:workspace|file|link|portal|exec|patch):/.test(first)) continue;\n const dep = splitNameVersion(first.replace(/@npm:/, '@'));\n if (dep) pendingName = dep.name;\n continue;\n }\n\n if (!pendingName) continue;\n const version = /^\\s+version:?\\s+[\"']?([^\"'\\s]+)[\"']?\\s*$/.exec(line);\n if (!version?.[1]) continue;\n const exact = exactVersion(version[1]);\n if (exact) deps.push({ name: pendingName, version: exact });\n pendingName = null;\n }\n\n return deps;\n}\n\n/** Pipenv's lockfile is JSON, with versions written as the `==x.y.z` specifier. */\nfunction parsePipfileLock(content: string): LockedDependency[] {\n const lock = JSON.parse(content) as Record<string, Record<string, { version?: string }>>;\n const deps: LockedDependency[] = [];\n\n for (const section of ['default', 'develop']) {\n const packages = lock[section];\n if (!packages || typeof packages !== 'object') continue;\n for (const [name, value] of Object.entries(packages)) {\n // VCS and file entries carry a ref instead of a version. There is no\n // version to ask OSV about, so they are skipped.\n const version = exactVersion(String(value?.version ?? '').replace(/^==/, ''));\n if (name && version) deps.push({ name, version });\n }\n }\n\n return deps;\n}\n\n/**\n * Only `==` pins are usable. A range gives OSV nothing to answer against, and\n * the previous `([0-9.]+)` version pattern also silently dropped every\n * pre-release and post-release pin PEP 440 allows (`2.0.0rc1`, `1.4.post1`),\n * which are ordinary in pinned production requirements.\n */\nfunction parseRequirementsTxt(content: string): LockedDependency[] {\n const deps: LockedDependency[] = [];\n\n for (const raw of content.split('\\n')) {\n // Environment markers and comments both describe the pin rather than\n // being part of it.\n const line = raw.split('#')[0]?.split(';')[0]?.trim();\n if (!line || line.startsWith('-')) continue;\n\n const match = /^([a-zA-Z0-9._-]+)\\s*(?:\\[[^\\]]*\\])?\\s*==\\s*([^\\s,]+)/.exec(line);\n if (!match?.[1] || !match[2]) continue;\n // A wildcard pin (`==1.4.*`) is a range wearing an equals sign.\n const version = exactVersion(match[2]);\n if (version) deps.push({ name: match[1], version });\n }\n\n return deps;\n}\n\nconst LOCKFILES: readonly LockfileSupport[] = [\n { file: 'package-lock.json', ecosystem: 'npm', parse: parsePackageLock },\n { file: 'pnpm-lock.yaml', ecosystem: 'npm', parse: parsePnpmLock },\n { file: 'yarn.lock', ecosystem: 'npm', parse: parseYarnLock },\n { file: 'requirements.txt', ecosystem: 'PyPI', parse: parseRequirementsTxt },\n { file: 'Pipfile.lock', ecosystem: 'PyPI', parse: parsePipfileLock },\n];\n\n/** Exposed so the parsers can be tested without a network or a fixture tree. */\nexport const LOCKFILE_PARSERS: Readonly<Record<string, LockfileParser>> = Object.fromEntries(\n LOCKFILES.map((entry) => [entry.file, entry.parse]),\n);\n\n/** Package names and versions are validated before they reach the query body. */\nfunction isValidPackageName(name: string): boolean {\n return /^[@a-zA-Z0-9_.\\-/]{1,214}$/.test(name);\n}\n\nfunction isValidVersion(version: string): boolean {\n return /^[0-9a-zA-Z._\\-+]{1,50}$/.test(version);\n}\n\nasync function queryOsv(name: string, version: string, ecosystem: string): Promise<OsvVulnerability[]> {\n if (!isValidPackageName(name) || !isValidVersion(version)) return [];\n\n try {\n const response = await fetch('https://api.osv.dev/v1/query', {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ package: { name, ecosystem }, version }),\n signal: AbortSignal.timeout(5000),\n });\n if (!response.ok) return [];\n const data = (await response.json()) as { vulns?: OsvVulnerability[] };\n return data.vulns ?? [];\n } catch {\n return [];\n }\n}\n","/**\n * SARIF 2.1.0 output.\n *\n * Why native, rather than converting the CLI's terminal output: a text parser\n * sitting between a scanner and its consumer fails in the one way that matters\n * — silently. `profullstack/malware-test-prs` documents three separate bugs its\n * `threatcrush-to-sarif.py` hit, and one of them (paths relative to the scan\n * root, unprefixed) made a working scan report a 0% true-positive rate. The\n * scan was fine. The pipe was lying.\n *\n * Emitting SARIF from the process that found the finding removes that class of\n * failure. It also makes the output portable: GitHub's Security tab, the\n * testbed's coverage validator, and any other SARIF consumer read the same\n * bytes, and none of them has to know what a ThreatCrush terminal line looks\n * like.\n *\n * Two details the spec is strict about and consumers are not forgiving about:\n *\n * - `startLine` must be >= 1. Whole-file findings carry no line, so they are\n * clamped rather than emitted as 0, which fails schema validation.\n * - `artifactLocation.uri` must be relative to something the consumer can\n * resolve. Absolute paths from a CI runner (`/home/runner/work/…`) match\n * nothing in the repository view, so every finding lands \"outside\" whatever\n * the consumer was scoping to.\n */\n\nimport { createHash } from 'node:crypto';\nimport { isAbsolute, relative, resolve, sep } from 'node:path';\nimport type { ScanFinding, Severity } from '../types';\n\n/**\n * The key our fingerprint is published under.\n *\n * Deliberately *not* `primaryLocationLineHash`. That name is reserved: the\n * CodeQL upload action computes its own value for it and logs\n *\n * Calculated fingerprint of 13bfd14c5cc763c:1 for file debtap line 104,\n * but found existing inconsistent fingerprint value <ours>\n *\n * for every finding whose value differs from what it derived — which is any\n * value we supply, whatever it contains. The first attempt at this replaced\n * the old `ruleId:file:line` with a content hash and still logged the warning,\n * because the collision is over the *key*, not the format.\n *\n * Namespacing it leaves GitHub to compute the fingerprint it wants while other\n * SARIF consumers keep a stable identity from us. The version suffix is there\n * so the hash input can change later without silently redefining what an\n * existing value meant.\n */\nconst FINGERPRINT_KEY = 'threatcrush/contentHash/v1';\n\n/**\n * A stable identity for a finding, for `partialFingerprints`.\n *\n * The line number is deliberately not part of it. It used to be — the value\n * was `ruleId:file:line` — which meant adding an import at the top of a file\n * re-fingerprinted every finding below it. A consumer that tracks findings by\n * fingerprint then treats them as new: previously dismissed ones come back,\n * and review comments detach from the code they were written about. Hashing\n * the rule, the file and the matched text instead keeps one finding identified\n * as one finding while it moves around the file.\n *\n * Whitespace is normalised so reindentation does not count as a new finding.\n * Two identical lines in one file collide onto one fingerprint, which is the\n * right trade: they are the same defect, and SARIF locations still tell them\n * apart.\n */\nexport function fingerprintOf(finding: ScanFinding): string {\n const content = finding.excerpt.replace(/\\s+/g, ' ').trim();\n return createHash('sha256')\n .update(`${finding.ruleId}\\n${finding.file}\\n${content}`)\n .digest('hex')\n .slice(0, 32);\n}\n\nexport const SARIF_VERSION = '2.1.0';\nexport const SARIF_SCHEMA =\n 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json';\n\nexport type SarifLevel = 'error' | 'warning' | 'note' | 'none';\n\n/**\n * SARIF has three levels; ThreatCrush has five severities. The mapping is\n * lossy in the direction that matters least — the exact severity survives in\n * `properties.severity` and in `security-severity`, which is what GitHub's\n * Security tab actually sorts on.\n */\nexport function sarifLevel(severity: Severity): SarifLevel {\n switch (severity) {\n case 'critical':\n case 'high':\n return 'error';\n case 'medium':\n return 'warning';\n case 'low':\n return 'note';\n default:\n return 'none';\n }\n}\n\n/** GitHub reads this to place a finding on its own severity scale. */\nexport function securitySeverity(severity: Severity): string {\n switch (severity) {\n case 'critical':\n return '9.0';\n case 'high':\n return '7.0';\n case 'medium':\n return '5.0';\n case 'low':\n return '3.0';\n default:\n return '1.0';\n }\n}\n\n/**\n * Turn a finding's path into a SARIF artifact URI.\n *\n * Findings carry paths relative to the *scan root*; consumers resolve URIs\n * against the *repository root*. Those are the same directory only when the\n * scan target is `.`, and the difference is silent — `secrets/x.env` matches\n * nothing in a repository that holds `vulns/secrets/x.env`, so a working scan\n * reports every finding as out-of-scope. `root` closes that gap by\n * reconstructing the absolute path before making it relative to `base`.\n *\n * Files outside `base` keep an absolute POSIX path rather than acquiring a run\n * of `../` segments no consumer resolves usefully.\n */\nexport function toArtifactUri(\n filePath: string,\n base: string,\n prefix = '',\n root = base,\n): string {\n const absolute = isAbsolute(filePath) ? filePath : resolve(root, filePath);\n const relativePath = relative(base, absolute);\n const escapedOut = relativePath.startsWith('..') || relativePath === '';\n const chosen = escapedOut ? absolute : relativePath;\n const posix = chosen.split(sep).join('/').replace(/^\\.\\//, '');\n if (!prefix || escapedOut) return posix;\n const trimmed = prefix.replace(/^\\/+|\\/+$/g, '');\n return trimmed ? `${trimmed}/${posix}` : posix;\n}\n\nexport interface SarifOptions {\n /** Version string reported as the tool's. */\n toolVersion: string;\n /**\n * Prepended to every relative URI. Covers the one case `root` cannot: a\n * scan run from *inside* the directory it is scanning, where the repository\n * root is not an ancestor of the working directory in any way the process\n * can observe.\n */\n pathPrefix?: string;\n /** Absolute path the URIs are made relative to. Defaults to `process.cwd()`. */\n base?: string;\n /** Absolute scan root that finding paths are relative to. Defaults to `base`. */\n root?: string;\n}\n\ninterface SarifRule {\n id: string;\n name: string;\n shortDescription: { text: string };\n fullDescription: { text: string };\n help: { text: string; markdown: string };\n defaultConfiguration: { level: SarifLevel };\n properties: {\n tags: string[];\n 'security-severity': string;\n precision: string;\n };\n}\n\n/**\n * Build a complete SARIF log.\n *\n * Always returns a valid run, including for zero findings — an empty `results`\n * array is a meaningful statement (\"looked, found nothing\") and consumers\n * distinguish it from a missing file.\n */\nexport function buildSarif(findings: readonly ScanFinding[], options: SarifOptions): unknown {\n const rules = new Map<string, SarifRule>();\n\n for (const finding of findings) {\n if (rules.has(finding.ruleId)) continue;\n const tags = ['security'];\n if (finding.cwe) tags.push(`external/cwe/${finding.cwe.toLowerCase()}`);\n tags.push(`threatcrush/${finding.category}`);\n\n const description = finding.consequence\n ? `${finding.title}. ${finding.consequence}`\n : finding.title;\n\n rules.set(finding.ruleId, {\n id: finding.ruleId,\n name: finding.ruleId,\n shortDescription: { text: finding.title },\n fullDescription: { text: description },\n help: {\n text: description,\n markdown: finding.consequence\n ? `**${finding.title}**\\n\\n${finding.consequence}`\n : `**${finding.title}**`,\n },\n defaultConfiguration: { level: sarifLevel(finding.severity) },\n properties: {\n tags,\n 'security-severity': securitySeverity(finding.severity),\n // SARIF's vocabulary for how much the rule is claiming. It lines up\n // with the confidence model: a bare construct match is `medium`, a\n // match with visible untrusted input is `high`.\n precision: finding.confidence === 'pattern' ? 'medium' : 'high',\n },\n });\n }\n\n const base = options.base ?? process.cwd();\n const root = options.root ?? base;\n\n const results = findings.map((finding) => ({\n ruleId: finding.ruleId,\n level: sarifLevel(finding.severity),\n message: { text: finding.message },\n locations: [\n {\n physicalLocation: {\n artifactLocation: {\n uri: toArtifactUri(finding.file, base, options.pathPrefix, root),\n uriBaseId: '%SRCROOT%',\n },\n region: {\n // Clamped, never 0. A whole-file finding has no line; SARIF has no\n // way to say that, and 0 fails validation outright.\n startLine: Math.max(1, finding.line),\n snippet: { text: finding.excerpt },\n },\n },\n },\n ],\n partialFingerprints: {\n [FINGERPRINT_KEY]: fingerprintOf(finding),\n },\n properties: {\n severity: finding.severity,\n confidence: finding.confidence,\n category: finding.category,\n ...(finding.cwe ? { cwe: finding.cwe } : {}),\n },\n }));\n\n return {\n $schema: SARIF_SCHEMA,\n version: SARIF_VERSION,\n runs: [\n {\n tool: {\n driver: {\n name: 'ThreatCrush',\n version: options.toolVersion,\n informationUri: 'https://threatcrush.com',\n rules: [...rules.values()],\n },\n },\n results,\n columnKind: 'utf16CodeUnits',\n },\n ],\n };\n}\n","import { execSync } from 'node:child_process';\nimport chalk from 'chalk';\nimport ora from 'ora';\nimport { banner, logger } from '../core/logger.js';\nimport type { RunResult, StructuredFinding } from '../core/run-result.js';\nimport { summarize } from '../core/run-result.js';\n\ninterface PentestResult {\n url: string;\n type: string;\n severity: 'low' | 'medium' | 'high' | 'critical';\n message: string;\n details?: string;\n}\n\n// Basic vulnerability tests\nconst PENTEST_CHECKS = [\n {\n name: 'XSS Reflected',\n test: (html: string) => /<script>alert\\(1\\)<\\/script>|<img\\s+src=x\\s+onerror=alert/i.test(html),\n severity: 'critical' as const,\n message: 'Reflected XSS payload rendered in response',\n },\n {\n name: 'Open Redirect',\n test: (url: string, body: string) => body.includes('location.href') || body.includes('window.location'),\n severity: 'medium' as const,\n message: 'Potential open redirect detected',\n },\n {\n name: 'Missing Security Headers',\n test: (_url: string, _body: string, headers: Record<string, string>) => {\n const required = ['x-content-type-options', 'x-frame-options', 'strict-transport-security'];\n const missing = required.filter(h => !headers[h.toLowerCase()]);\n return missing.length > 2;\n },\n severity: 'low' as const,\n message: 'Missing critical security headers (X-Content-Type-Options, X-Frame-Options, HSTS)',\n },\n {\n name: 'Server Version Disclosure',\n test: (_url: string, _body: string, headers: Record<string, string>) => {\n return !!(headers['server'] && /apache|nginx|iis|tomcat/i.test(headers['server']));\n },\n severity: 'low' as const,\n message: 'Server version disclosed in response header',\n },\n {\n name: 'Directory Listing',\n test: (html: string) => /Index of\\s*\\/|<title>Directory Listing/i.test(html),\n severity: 'medium' as const,\n message: 'Directory listing enabled',\n },\n {\n name: 'Error Page Information Disclosure',\n test: (html: string) => /stack trace|traceback|exception|at\\s+\\w+\\.\\w+\\(/i.test(html),\n severity: 'medium' as const,\n message: 'Error page reveals internal information',\n },\n // PRD 07: Additional checks\n {\n name: 'CORS Misconfiguration',\n test: (_url: string, _body: string, headers: Record<string, string>) => {\n const acao = headers['access-control-allow-origin'];\n return acao === '*' || acao === 'null';\n },\n severity: 'medium' as const,\n message: 'CORS allows any origin (Access-Control-Allow-Origin: *)',\n },\n {\n name: 'Cookie Security',\n test: (_url: string, _body: string, headers: Record<string, string>) => {\n const setCookie = headers['set-cookie'] || '';\n return setCookie.length > 0 && (!setCookie.includes('HttpOnly') || !setCookie.includes('Secure'));\n },\n severity: 'medium' as const,\n message: 'Cookies missing HttpOnly or Secure flags',\n },\n {\n name: 'Content Security Policy',\n test: (_url: string, _body: string, headers: Record<string, string>) => {\n return !headers['content-security-policy'];\n },\n severity: 'low' as const,\n message: 'No Content-Security-Policy header set',\n },\n {\n name: 'Sensitive Path Exposure',\n test: (html: string) => /\\.env|wp-admin|phpinfo|\\.git\\/config|server-status/i.test(html),\n severity: 'high' as const,\n message: 'Response references sensitive paths or admin endpoints',\n },\n];\n\nexport async function runPentest(rawUrl: string): Promise<RunResult> {\n const targetUrl = rawUrl.startsWith('http') ? rawUrl : `https://${rawUrl}`;\n const results = await collectPentestResults(targetUrl);\n const structured: StructuredFinding[] = results.map((r) => ({\n type: r.type,\n severity: r.severity === 'low' ? 'low' : (r.severity as StructuredFinding['severity']),\n message: r.message,\n location: r.url,\n details: r.details ? { detail: r.details } : undefined,\n }));\n const counts = summarize(structured);\n return {\n type: 'pentest',\n target: targetUrl,\n findings: structured,\n severity_summary: counts,\n summary: structured.length === 0\n ? 'No vulnerabilities detected'\n : `${structured.length} issue(s): ${counts.critical}C ${counts.high}H ${counts.medium}M ${counts.low}L`,\n };\n}\n\nasync function collectPentestResults(targetUrl: string): Promise<PentestResult[]> {\n const results: PentestResult[] = [];\n try {\n const resp = await fetch(targetUrl, { redirect: 'manual' });\n const headers: Record<string, string> = {};\n resp.headers.forEach((v, k) => { headers[k] = v; });\n const body = await resp.text();\n for (const check of PENTEST_CHECKS) {\n try {\n if (check.test(body, body, headers)) {\n results.push({ url: targetUrl, type: check.name, severity: check.severity, message: check.message });\n }\n } catch { /* skip */ }\n }\n } catch {\n return results;\n }\n\n const sqliPayloads = [\"' OR 1=1--\", \"1' UNION SELECT NULL--\", \"' AND '1'='1\"];\n for (const payload of sqliPayloads) {\n try {\n const testUrl = `${targetUrl}?id=${encodeURIComponent(payload)}`;\n const resp = await fetch(testUrl, { redirect: 'manual', signal: AbortSignal.timeout(5000) });\n const body = await resp.text();\n if (/sql\\s+(syntax|error|exception)|mysql|postgres|ORA-\\d+/i.test(body)) {\n results.push({ url: testUrl, type: 'SQL Injection', severity: 'critical', message: `SQL error with payload: ${payload}` });\n }\n } catch { /* skip */ }\n }\n\n const traversalPaths = ['../../etc/passwd', '..%2F..%2Fetc%2Fpasswd', '....//....//etc/passwd'];\n for (const path of traversalPaths) {\n try {\n const testUrl = `${targetUrl}/${path}`;\n const resp = await fetch(testUrl, { redirect: 'manual', signal: AbortSignal.timeout(5000) });\n const body = await resp.text();\n if (/root:.*:0:0:|daemon:.*:1:1:|nobody:.*:65534/i.test(body)) {\n results.push({ url: testUrl, type: 'Path Traversal', severity: 'critical', message: `Possible /etc/passwd disclosure: ${path}` });\n }\n } catch { /* skip */ }\n }\n\n const methods = ['OPTIONS', 'TRACE', 'DELETE', 'PUT'];\n for (const method of methods) {\n try {\n const resp = await fetch(targetUrl, { method, signal: AbortSignal.timeout(5000) });\n if (resp.status < 400 && method !== 'OPTIONS') {\n results.push({ url: targetUrl, type: `Unsafe HTTP Method: ${method}`, severity: 'medium', message: `${method} allowed (status ${resp.status})` });\n }\n if (method === 'OPTIONS') {\n const allow = resp.headers.get('allow');\n if (allow && /DELETE|PUT|TRACE/i.test(allow)) {\n results.push({ url: targetUrl, type: 'HTTP Methods', severity: 'low', message: `Allowed methods: ${allow}` });\n }\n }\n } catch { /* skip */ }\n }\n\n return results;\n}\n\nexport async function pentestCommand(targetUrl: string): Promise<RunResult> {\n banner();\n\n // Ensure URL has protocol\n if (!targetUrl.startsWith('http')) {\n targetUrl = `https://${targetUrl}`;\n }\n\n logger.info(`Penetration testing ${chalk.white(targetUrl)}...\\n`);\n\n const results: PentestResult[] = [];\n\n // Test 1: Basic response analysis\n const spinner = ora({ text: 'Fetching target...', color: 'green' }).start();\n try {\n const resp = await fetch(targetUrl, { redirect: 'manual' });\n const headers: Record<string, string> = {};\n resp.headers.forEach((v, k) => { headers[k] = v; });\n const body = await resp.text();\n\n spinner.succeed(`Got ${resp.status} response\\n`);\n\n // Run all checks\n for (const check of PENTEST_CHECKS) {\n try {\n if (check.test(body, body, headers)) {\n results.push({\n url: targetUrl,\n type: check.name,\n severity: check.severity,\n message: check.message,\n });\n }\n } catch {\n // Skip check on error\n }\n }\n } catch (err) {\n spinner.fail(`Failed to reach target: ${(err as Error).message}`);\n console.log(chalk.gray(' Check the URL and try again.\\n'));\n return {\n type: 'pentest',\n target: targetUrl,\n findings: [],\n severity_summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },\n summary: `Failed to reach target: ${(err as Error).message}`,\n error: (err as Error).message,\n };\n }\n\n // Test 2: SQL injection probe\n const sqliSpinner = ora({ text: 'Testing SQL injection vectors...', color: 'green' }).start();\n const sqliPayloads = [\"' OR 1=1--\", \"1' UNION SELECT NULL--\", \"' AND '1'='1\"];\n for (const payload of sqliPayloads) {\n try {\n const testUrl = `${targetUrl}?id=${encodeURIComponent(payload)}`;\n const resp = await fetch(testUrl, { redirect: 'manual', signal: AbortSignal.timeout(5000) });\n const body = await resp.text();\n if (/sql\\s+(syntax|error|exception)|mysql|postgres|ORA-\\d+/i.test(body)) {\n results.push({\n url: testUrl,\n type: 'SQL Injection',\n severity: 'critical',\n message: `SQL error response detected with payload: ${payload}`,\n });\n }\n } catch {\n // Skip on timeout/network error\n }\n }\n sqliSpinner.succeed('SQL injection tests complete\\n');\n\n // Test 3: Path traversal probe\n const pathSpinner = ora({ text: 'Testing path traversal...', color: 'green' }).start();\n const traversalPaths = ['../../etc/passwd', '..%2F..%2Fetc%2Fpasswd', '....//....//etc/passwd'];\n for (const path of traversalPaths) {\n try {\n const testUrl = `${targetUrl}/${path}`;\n const resp = await fetch(testUrl, { redirect: 'manual', signal: AbortSignal.timeout(5000) });\n const body = await resp.text();\n if (/root:.*:0:0:|daemon:.*:1:1:|nobody:.*:65534/i.test(body)) {\n results.push({\n url: testUrl,\n type: 'Path Traversal',\n severity: 'critical',\n message: `Possible /etc/passwd disclosure via: ${path}`,\n });\n }\n } catch {\n // Skip on timeout/network error\n }\n }\n pathSpinner.succeed('Path traversal tests complete\\n');\n\n // Test 4: HTTP methods\n const methodSpinner = ora({ text: 'Testing HTTP methods...', color: 'green' }).start();\n const methods = ['OPTIONS', 'TRACE', 'DELETE', 'PUT'];\n for (const method of methods) {\n try {\n const resp = await fetch(targetUrl, { method, signal: AbortSignal.timeout(5000) });\n if (resp.status < 400 && method !== 'OPTIONS') {\n results.push({\n url: targetUrl,\n type: `Unsafe HTTP Method: ${method}`,\n severity: 'medium',\n message: `${method} method is allowed (status ${resp.status})`,\n });\n }\n if (method === 'OPTIONS') {\n const allow = resp.headers.get('allow');\n if (allow && /DELETE|PUT|TRACE/i.test(allow)) {\n results.push({\n url: targetUrl,\n type: 'HTTP Methods',\n severity: 'low',\n message: `Allowed methods: ${allow}`,\n });\n }\n }\n } catch {\n // Skip on error\n }\n }\n methodSpinner.succeed('HTTP method tests complete\\n');\n\n const structured: StructuredFinding[] = results.map((r) => ({\n type: r.type,\n severity: r.severity as StructuredFinding['severity'],\n message: r.message,\n location: r.url,\n details: r.details ? { detail: r.details } : undefined,\n }));\n const sevCounts = summarize(structured);\n\n // Print results\n if (results.length === 0) {\n console.log(chalk.green.bold(' ✓ No vulnerabilities detected in basic scan!'));\n console.log(chalk.dim(' Note: This is a basic scan. Full pentest requires manual review.\\n'));\n return {\n type: 'pentest',\n target: targetUrl,\n findings: [],\n severity_summary: sevCounts,\n summary: 'No vulnerabilities detected',\n };\n }\n\n const critical = results.filter(r => r.severity === 'critical');\n const high = results.filter(r => r.severity === 'high');\n const medium = results.filter(r => r.severity === 'medium');\n const low = results.filter(r => r.severity === 'low');\n\n console.log(chalk.white.bold(' Penetration Test Results'));\n console.log(chalk.gray(' ' + '─'.repeat(70)));\n console.log(\n ` ${chalk.red.bold(critical.length + ' critical')} ` +\n `${chalk.red(high.length + ' high')} ` +\n `${chalk.yellow(medium.length + ' medium')} ` +\n `${chalk.gray(low.length + ' low')}`,\n );\n console.log(chalk.gray(' ' + '─'.repeat(70)));\n console.log();\n\n const sorted = [...critical, ...high, ...medium, ...low];\n for (const r of sorted) {\n const sev =\n r.severity === 'critical' ? chalk.bgRed.white.bold(` ${r.severity.toUpperCase()} `) :\n r.severity === 'high' ? chalk.red(`[${r.severity.toUpperCase()}]`) :\n r.severity === 'medium' ? chalk.yellow(`[${r.severity.toUpperCase()}]`) :\n chalk.gray(`[${r.severity.toUpperCase()}]`);\n\n console.log(` ${sev} ${chalk.white.bold(r.type)}`);\n console.log(` ${chalk.gray('URL:')} ${chalk.cyan(r.url)}`);\n console.log(` ${chalk.gray('Info:')} ${r.message}`);\n if (r.details) console.log(` ${chalk.gray('Details:')} ${r.details}`);\n console.log();\n }\n\n console.log(chalk.gray(' ' + '─'.repeat(70)));\n console.log(` ${chalk.white.bold(`${results.length} issue(s) found`)}`);\n console.log(chalk.dim(' Note: This is an automated basic scan. Manual review recommended.\\n'));\n\n return {\n type: 'pentest',\n target: targetUrl,\n findings: structured,\n severity_summary: sevCounts,\n summary: `${results.length} issue(s): ${sevCounts.critical}C ${sevCounts.high}H ${sevCounts.medium}M ${sevCounts.low}L`,\n };\n}\n","import type { EventBus } from '../event-bus.js';\nimport { readCliConfig, authHeaders, isLoggedIn } from '../../core/cli-config.js';\nimport { runScan } from '../../commands/scan.js';\nimport { runPentest } from '../../commands/pentest.js';\nimport { workerId, type RunResult } from '../../core/run-result.js';\n\nconst API_URL = process.env.THREATCRUSH_API_URL || 'https://threatcrush.com';\nconst POLL_INTERVAL_MS = 30_000;\nconst SCHEDULE_INTERVAL_MS = 120_000;\n\ninterface ClaimedRun {\n id: string;\n org_id: string;\n property_id: string;\n type: 'scan' | 'pentest';\n property: { id: string; name: string; kind: string; target: string } | null;\n}\n\n/**\n * Polls the server for queued property runs belonging to orgs the logged-in\n * user is a member of, claims them atomically, executes them locally, and\n * posts the result back.\n *\n * No-op unless `~/.threatcrush/config.json` contains a valid bearer token.\n */\nexport class RunsWorker {\n private pollTimer: NodeJS.Timeout | null = null;\n private scheduleTimer: NodeJS.Timeout | null = null;\n private running = false;\n private orgIds: string[] = [];\n\n constructor(private bus: EventBus) {}\n\n async start(): Promise<void> {\n if (!isLoggedIn()) return;\n\n try {\n await this.refreshOrgs();\n } catch {\n // First fetch may fail if the network is down; the tick loop will retry.\n }\n\n this.bus.announceModule('runs-worker', 'running', `poll ${POLL_INTERVAL_MS / 1000}s`);\n this.tick();\n this.scheduleTick();\n this.pollTimer = setInterval(() => this.tick(), POLL_INTERVAL_MS);\n this.scheduleTimer = setInterval(() => this.scheduleTick(), SCHEDULE_INTERVAL_MS);\n }\n\n stop(): void {\n if (this.pollTimer) clearInterval(this.pollTimer);\n if (this.scheduleTimer) clearInterval(this.scheduleTimer);\n this.pollTimer = null;\n this.scheduleTimer = null;\n this.bus.announceModule('runs-worker', 'stopped');\n }\n\n private async scheduleTick(): Promise<void> {\n if (!isLoggedIn()) return;\n try {\n if (this.orgIds.length === 0) await this.refreshOrgs();\n for (const orgId of this.orgIds) {\n try {\n await fetch(`${API_URL}/api/orgs/${orgId}/schedules/tick`, {\n method: 'POST',\n headers: authHeaders(),\n });\n } catch {\n // ignore transient network errors\n }\n }\n } catch {\n // swallow — retry next interval\n }\n }\n\n private async tick(): Promise<void> {\n if (this.running) return;\n if (!isLoggedIn()) return;\n\n this.running = true;\n try {\n if (this.orgIds.length === 0) await this.refreshOrgs();\n for (const orgId of this.orgIds) {\n const claimed = await this.claimOne(orgId);\n if (!claimed) continue;\n\n const result = await this.execute(claimed);\n await this.finalize(orgId, claimed, result);\n }\n } catch {\n // swallow — we'll try again on the next tick\n } finally {\n this.running = false;\n }\n }\n\n private async refreshOrgs(): Promise<void> {\n const res = await fetch(`${API_URL}/api/orgs`, { headers: authHeaders() });\n if (!res.ok) return;\n const data = await res.json() as { organizations?: Array<{ id: string }> };\n this.orgIds = (data.organizations || []).map((o) => o.id);\n }\n\n private async claimOne(orgId: string): Promise<ClaimedRun | null> {\n try {\n const res = await fetch(`${API_URL}/api/orgs/${orgId}/runs/pending`, {\n method: 'POST',\n headers: authHeaders(),\n body: JSON.stringify({ worker_id: workerId() }),\n });\n if (!res.ok) return null;\n const data = await res.json() as { run?: ClaimedRun | null };\n return data.run ?? null;\n } catch {\n return null;\n }\n }\n\n private async execute(run: ClaimedRun): Promise<RunResult> {\n const target = run.property?.target;\n if (!target) {\n return {\n type: run.type,\n target: '',\n findings: [],\n severity_summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },\n summary: 'property target missing',\n error: 'property target missing',\n };\n }\n\n this.bus.announceModule('runs-worker', 'running', `${run.type} ${run.property?.name || target}`);\n\n try {\n if (run.type === 'scan') return await runScan(target);\n return await runPentest(target);\n } catch (err) {\n return {\n type: run.type,\n target,\n findings: [],\n severity_summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },\n summary: `failed: ${(err as Error).message}`,\n error: (err as Error).message,\n };\n }\n }\n\n private async finalize(orgId: string, claimed: ClaimedRun, result: RunResult): Promise<void> {\n try {\n await fetch(\n `${API_URL}/api/orgs/${orgId}/properties/${claimed.property_id}/runs/${claimed.id}`,\n {\n method: 'PATCH',\n headers: authHeaders(),\n body: JSON.stringify({\n status: result.error ? 'failed' : 'succeeded',\n findings_count: result.findings.length,\n severity_summary: result.severity_summary,\n summary: result.summary,\n findings: result.findings,\n error: result.error,\n source: 'daemon',\n worker_id: workerId(),\n }),\n },\n );\n } catch {\n // best-effort\n } finally {\n this.bus.announceModule('runs-worker', 'idle');\n }\n }\n}\n","import type { ThreatEvent, EventSeverity } from '../../types/events.js';\n\nexport interface DetectionRule {\n id: string;\n title: string;\n description: string;\n version: string;\n category: string;\n severity: EventSeverity;\n source_types: string[];\n match: RuleMatch;\n threshold: number;\n window_seconds: number;\n cooldown_seconds: number;\n tags: string[];\n remediation?: {\n action?: string;\n ttl_seconds?: number;\n description?: string;\n };\n enabled: boolean;\n}\n\nexport interface RuleMatch {\n field: string;\n operator: 'contains' | 'regex' | 'equals' | 'starts_with' | 'ends_with';\n value: string;\n and?: RuleMatch[];\n or?: RuleMatch[];\n}\n\ninterface EventWindow {\n events: Array<{ timestamp: number; event: ThreatEvent }>;\n lastAlert: number;\n}\n\nexport class RuleEngine {\n private rules: DetectionRule[] = [];\n private windows = new Map<string, EventWindow>();\n\n constructor(private onDetection: (detection: {\n rule_id: string;\n severity: EventSeverity;\n title: string;\n description: string;\n source_ip?: string;\n username?: string;\n raw_metadata?: Record<string, unknown>;\n }) => void) {}\n\n loadRules(rules: DetectionRule[]): void {\n this.rules = rules.filter(r => r.enabled !== false);\n }\n\n getRules(): DetectionRule[] {\n return [...this.rules];\n }\n\n evaluate(event: ThreatEvent): void {\n const now = Date.now();\n\n for (const rule of this.rules) {\n // Check source type match\n if (rule.source_types.length > 0 && !rule.source_types.includes(event.module) && !rule.source_types.includes(event.category)) {\n continue;\n }\n\n // Check match conditions\n if (!this.matchesCondition(event, rule.match)) continue;\n\n // Window key: rule_id + source_ip (or 'global')\n const windowKey = `${rule.id}:${event.source_ip || 'global'}`;\n let window = this.windows.get(windowKey);\n if (!window) {\n window = { events: [], lastAlert: 0 };\n this.windows.set(windowKey, window);\n }\n\n // Add event to window\n window.events.push({ timestamp: now, event });\n\n // Prune old events outside window\n const cutoff = now - (rule.window_seconds * 1000);\n window.events = window.events.filter(e => e.timestamp >= cutoff);\n\n // Check threshold\n if (window.events.length < rule.threshold) continue;\n\n // Check cooldown\n if (window.lastAlert > 0 && (now - window.lastAlert) < (rule.cooldown_seconds * 1000)) continue;\n\n // Fire detection\n window.lastAlert = now;\n window.events = []; // Reset window after detection\n\n this.onDetection({\n rule_id: rule.id,\n severity: rule.severity,\n title: rule.title,\n description: `${rule.description} (${rule.threshold} events in ${rule.window_seconds}s)`,\n source_ip: event.source_ip,\n username: event.details?.user as string || undefined,\n raw_metadata: {\n rule_version: rule.version,\n tags: rule.tags,\n category: rule.category,\n remediation: rule.remediation,\n },\n });\n }\n }\n\n private matchesCondition(event: ThreatEvent, match: RuleMatch): boolean {\n const fieldValue = this.getFieldValue(event, match.field);\n if (fieldValue === undefined) return false;\n\n const strValue = String(fieldValue);\n let result = false;\n\n switch (match.operator) {\n case 'contains':\n result = strValue.toLowerCase().includes(String(match.value).toLowerCase());\n break;\n case 'regex':\n try { result = new RegExp(String(match.value), 'i').test(strValue); } catch { result = false; }\n break;\n case 'equals':\n result = strValue === String(match.value);\n break;\n case 'starts_with':\n result = strValue.startsWith(String(match.value));\n break;\n case 'ends_with':\n result = strValue.endsWith(String(match.value));\n break;\n }\n\n // AND conditions\n if (result && match.and) {\n result = match.and.every(m => this.matchesCondition(event, m));\n }\n\n // OR conditions\n if (!result && match.or) {\n result = match.or.some(m => this.matchesCondition(event, m));\n }\n\n return result;\n }\n\n private getFieldValue(event: ThreatEvent, field: string): unknown {\n switch (field) {\n case 'message': return event.message;\n case 'severity': return event.severity;\n case 'module': return event.module;\n case 'category': return event.category;\n case 'source_ip': return event.source_ip;\n default:\n return event.details?.[field];\n }\n }\n\n // Periodic cleanup of stale windows\n cleanup(): void {\n const now = Date.now();\n for (const [key, window] of this.windows.entries()) {\n if (window.events.length === 0 && (now - window.lastAlert) > 3600_000) {\n this.windows.delete(key);\n }\n }\n }\n}\n","import { existsSync, readdirSync, readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport type { DetectionRule } from './engine.js';\nimport { DEFAULT_RULES } from './default-rules.js';\n\nconst RULES_DIR = '/etc/threatcrush/rules.d';\n\nexport function loadAllRules(customDir?: string): DetectionRule[] {\n const rules = [...DEFAULT_RULES];\n const dir = customDir || RULES_DIR;\n\n if (existsSync(dir)) {\n const files = readdirSync(dir).filter(f => f.endsWith('.json'));\n for (const file of files) {\n try {\n const raw = readFileSync(join(dir, file), 'utf-8');\n const parsed = JSON.parse(raw);\n const customRules: DetectionRule[] = Array.isArray(parsed) ? parsed : [parsed];\n for (const rule of customRules) {\n if (!rule.id || !rule.title || !rule.match) {\n console.warn(`[rules] skipping invalid rule in ${file}: missing required fields`);\n continue;\n }\n const existingIdx = rules.findIndex(r => r.id === rule.id);\n if (existingIdx >= 0) {\n rules[existingIdx] = { ...rules[existingIdx], ...rule };\n } else {\n rules.push(rule);\n }\n }\n } catch (err) {\n console.warn(`[rules] failed to load ${file}: ${(err as Error).message}`);\n }\n }\n }\n\n return rules;\n}\n","import type { DetectionRule } from './engine.js';\n\nexport const DEFAULT_RULES: DetectionRule[] = [\n {\n id: 'ssh-brute-force',\n title: 'SSH Brute Force Detected',\n description: 'Multiple failed SSH login attempts from the same source',\n version: '1.0.0',\n category: 'auth',\n severity: 'high',\n source_types: ['ssh-guard', 'auth'],\n match: {\n field: 'message',\n operator: 'regex',\n value: 'failed ssh login|invalid ssh user',\n },\n threshold: 5,\n window_seconds: 300,\n cooldown_seconds: 600,\n tags: ['ssh', 'brute-force', 'credential-stuffing'],\n remediation: {\n action: 'block',\n ttl_seconds: 3600,\n description: 'Block source IP for 1 hour',\n },\n enabled: true,\n },\n {\n id: 'ssh-success-after-failures',\n title: 'SSH Login After Failed Attempts',\n description: 'Successful SSH login from an IP that had recent failures',\n version: '1.0.0',\n category: 'auth',\n severity: 'critical',\n source_types: ['ssh-guard', 'auth'],\n match: {\n field: 'message',\n operator: 'contains',\n value: 'SSH login accepted',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['ssh', 'compromise-indicator'],\n enabled: true,\n },\n {\n id: 'ssh-root-login',\n title: 'Root SSH Login Attempt',\n description: 'Direct root login via SSH detected',\n version: '1.0.0',\n category: 'auth',\n severity: 'high',\n source_types: ['ssh-guard', 'auth'],\n match: {\n field: 'message',\n operator: 'regex',\n value: '(failed|accepted).*\\\\broot\\\\b',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['ssh', 'root-access'],\n remediation: {\n action: 'block',\n ttl_seconds: 7200,\n description: 'Block source IP attempting root login',\n },\n enabled: true,\n },\n {\n id: 'ssh-user-enumeration',\n title: 'SSH User Enumeration',\n description: 'Multiple SSH attempts with different usernames from same source',\n version: '1.0.0',\n category: 'auth',\n severity: 'high',\n source_types: ['ssh-guard', 'auth'],\n match: {\n field: 'message',\n operator: 'contains',\n value: 'Invalid SSH user',\n },\n threshold: 3,\n window_seconds: 120,\n cooldown_seconds: 600,\n tags: ['ssh', 'enumeration', 'reconnaissance'],\n remediation: {\n action: 'block',\n ttl_seconds: 3600,\n description: 'Block source IP performing user enumeration',\n },\n enabled: true,\n },\n {\n id: 'sudo-abuse',\n title: 'Sudo Authentication Failure',\n description: 'Repeated sudo authentication failures',\n version: '1.0.0',\n category: 'auth',\n severity: 'high',\n source_types: ['user-journal', 'system'],\n match: {\n field: 'message',\n operator: 'regex',\n value: 'sudo.*authentication failure|sudo.*incorrect password|sudo.*FAILED',\n },\n threshold: 3,\n window_seconds: 300,\n cooldown_seconds: 600,\n tags: ['sudo', 'privilege-escalation'],\n enabled: true,\n },\n {\n id: 'web-sqli-attack',\n title: 'SQL Injection Attack Detected',\n description: 'HTTP request with SQL injection patterns',\n version: '1.0.0',\n category: 'web',\n severity: 'critical',\n source_types: ['log-watcher', 'web'],\n match: {\n field: 'message',\n operator: 'contains',\n value: 'Attack detected [SQLI]',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['web', 'sqli', 'injection'],\n remediation: {\n action: 'block',\n ttl_seconds: 3600,\n description: 'Block source IP performing SQL injection',\n },\n enabled: true,\n },\n {\n id: 'web-path-traversal',\n title: 'Path Traversal Attack Detected',\n description: 'HTTP request with path traversal patterns',\n version: '1.0.0',\n category: 'web',\n severity: 'critical',\n source_types: ['log-watcher', 'web'],\n match: {\n field: 'message',\n operator: 'contains',\n value: 'Attack detected [PATH_TRAVERSAL]',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['web', 'path-traversal', 'lfi'],\n remediation: {\n action: 'block',\n ttl_seconds: 3600,\n description: 'Block source IP performing path traversal',\n },\n enabled: true,\n },\n {\n id: 'web-xss-attack',\n title: 'XSS Attack Detected',\n description: 'HTTP request with cross-site scripting patterns',\n version: '1.0.0',\n category: 'web',\n severity: 'high',\n source_types: ['log-watcher', 'web'],\n match: {\n field: 'message',\n operator: 'regex',\n value: 'Attack detected \\\\[XSS\\\\]',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['web', 'xss', 'injection'],\n remediation: {\n action: 'block',\n ttl_seconds: 3600,\n description: 'Block source IP performing XSS attack',\n },\n enabled: true,\n },\n {\n id: 'web-scanner-detection',\n title: 'Web Vulnerability Scanner Detected',\n description: 'High volume of 4xx errors suggesting automated scanning',\n version: '1.0.0',\n category: 'web',\n severity: 'medium',\n source_types: ['log-watcher', 'web'],\n match: {\n field: 'message',\n operator: 'regex',\n value: 'Client error 4\\\\d{2}:',\n },\n threshold: 20,\n window_seconds: 60,\n cooldown_seconds: 600,\n tags: ['web', 'scanner', 'reconnaissance'],\n remediation: {\n action: 'block',\n ttl_seconds: 1800,\n description: 'Block automated scanner',\n },\n enabled: true,\n },\n {\n id: 'port-scan-indicator',\n title: 'Port Scan Indicators',\n description: 'Connection attempts to many ports from a single source',\n version: '1.0.0',\n category: 'network',\n severity: 'medium',\n source_types: ['network-monitor', 'network'],\n match: {\n field: 'message',\n operator: 'contains',\n value: 'port scan',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['network', 'port-scan', 'reconnaissance'],\n remediation: {\n action: 'block',\n ttl_seconds: 3600,\n description: 'Block port scanner',\n },\n enabled: true,\n },\n {\n id: 'system-critical-error',\n title: 'Critical System Error',\n description: 'Critical or emergency level system log message',\n version: '1.0.0',\n category: 'system',\n severity: 'critical',\n source_types: ['user-journal', 'system'],\n match: {\n field: 'severity',\n operator: 'equals',\n value: 'critical',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['system', 'critical'],\n enabled: true,\n },\n {\n id: 'exploit-probe-pattern',\n title: 'Exploit Probe Pattern',\n description: 'HTTP requests matching common exploit probe patterns',\n version: '1.0.0',\n category: 'web',\n severity: 'high',\n source_types: ['log-watcher', 'web'],\n match: {\n field: 'message',\n operator: 'regex',\n value: 'Attack detected \\\\[(CMD_INJECTION|RCE|SSRF|XXE)\\\\]',\n },\n threshold: 1,\n window_seconds: 60,\n cooldown_seconds: 300,\n tags: ['web', 'exploit', 'probe'],\n remediation: {\n action: 'block',\n ttl_seconds: 7200,\n description: 'Block source IP performing exploit probes',\n },\n enabled: true,\n },\n];\n","import { execSync, spawnSync } from 'node:child_process';\nimport { isIP } from 'node:net';\n\nexport interface FirewallAdapter {\n name: string;\n isAvailable(): boolean;\n block(ip: string): Promise<void>;\n unblock(ip: string): Promise<void>;\n isBlocked(ip: string): Promise<boolean>;\n listBlocked(): Promise<string[]>;\n}\n\nfunction assertValidFirewallIp(ip: string): void {\n if (isIP(ip) !== 4) {\n throw new Error(`Invalid IPv4 address: ${ip}`);\n }\n}\n\nexport class NftablesAdapter implements FirewallAdapter {\n name = 'nftables';\n private table = 'threatcrush';\n private set = 'blocklist';\n\n isAvailable(): boolean {\n const result = spawnSync('nft', ['--version'], { stdio: 'pipe' });\n return result.status === 0;\n }\n\n private ensureSetup(): void {\n try {\n execSync(`nft list table inet ${this.table} 2>/dev/null`, { stdio: 'pipe' });\n } catch {\n execSync(`nft add table inet ${this.table}`);\n execSync(`nft add set inet ${this.table} ${this.set} '{ type ipv4_addr; flags timeout; }'`);\n execSync(`nft add chain inet ${this.table} input '{ type filter hook input priority -1; policy accept; }'`);\n execSync(`nft add rule inet ${this.table} input ip saddr @${this.set} drop`);\n }\n }\n\n async block(ip: string): Promise<void> {\n assertValidFirewallIp(ip);\n this.ensureSetup();\n execSync(`nft add element inet ${this.table} ${this.set} '{ ${ip} }'`);\n }\n\n async unblock(ip: string): Promise<void> {\n assertValidFirewallIp(ip);\n try {\n execSync(`nft delete element inet ${this.table} ${this.set} '{ ${ip} }'`);\n } catch { /* element may not exist */ }\n }\n\n async isBlocked(ip: string): Promise<boolean> {\n assertValidFirewallIp(ip);\n try {\n const output = execSync(`nft list set inet ${this.table} ${this.set}`, { encoding: 'utf-8' });\n return output.includes(ip);\n } catch { return false; }\n }\n\n async listBlocked(): Promise<string[]> {\n try {\n const output = execSync(`nft list set inet ${this.table} ${this.set}`, { encoding: 'utf-8' });\n const match = output.match(/elements\\s*=\\s*\\{([^}]*)\\}/);\n if (!match) return [];\n return match[1].split(',').map(s => s.trim().split(/\\s/)[0]).filter(Boolean);\n } catch { return []; }\n }\n}\n\nexport class IptablesAdapter implements FirewallAdapter {\n name = 'iptables';\n private chain = 'THREATCRUSH';\n\n isAvailable(): boolean {\n const result = spawnSync('iptables', ['--version'], { stdio: 'pipe' });\n return result.status === 0;\n }\n\n private ensureChain(): void {\n try {\n execSync(`iptables -n -L ${this.chain} 2>/dev/null`, { stdio: 'pipe' });\n } catch {\n execSync(`iptables -N ${this.chain}`);\n execSync(`iptables -I INPUT 1 -j ${this.chain}`);\n }\n }\n\n async block(ip: string): Promise<void> {\n assertValidFirewallIp(ip);\n this.ensureChain();\n if (await this.isBlocked(ip)) return;\n execSync(`iptables -A ${this.chain} -s ${ip} -j DROP`);\n }\n\n async unblock(ip: string): Promise<void> {\n assertValidFirewallIp(ip);\n try { execSync(`iptables -D ${this.chain} -s ${ip} -j DROP`); }\n catch { /* rule may not exist */ }\n }\n\n async isBlocked(ip: string): Promise<boolean> {\n assertValidFirewallIp(ip);\n try {\n const output = execSync(`iptables -n -L ${this.chain}`, { encoding: 'utf-8' });\n return output.includes(ip);\n } catch { return false; }\n }\n\n async listBlocked(): Promise<string[]> {\n try {\n const output = execSync(`iptables -n -L ${this.chain}`, { encoding: 'utf-8' });\n const ips: string[] = [];\n for (const line of output.split('\\n')) {\n const match = line.match(/DROP\\s+all\\s+--\\s+(\\d+\\.\\d+\\.\\d+\\.\\d+)/);\n if (match) ips.push(match[1]);\n }\n return ips;\n } catch { return []; }\n }\n}\n\nexport class DryRunAdapter implements FirewallAdapter {\n name = 'dry-run';\n private blocked = new Set<string>();\n\n isAvailable(): boolean { return true; }\n async block(ip: string): Promise<void> { assertValidFirewallIp(ip); this.blocked.add(ip); }\n async unblock(ip: string): Promise<void> { assertValidFirewallIp(ip); this.blocked.delete(ip); }\n async isBlocked(ip: string): Promise<boolean> { assertValidFirewallIp(ip); return this.blocked.has(ip); }\n async listBlocked(): Promise<string[]> { return [...this.blocked]; }\n}\n\nexport function detectFirewallAdapter(): FirewallAdapter {\n const nft = new NftablesAdapter();\n if (nft.isAvailable()) return nft;\n const ipt = new IptablesAdapter();\n if (ipt.isAvailable()) return ipt;\n return new DryRunAdapter();\n}\n","import { appendFileSync } from 'node:fs';\nimport type { FirewallAdapter } from './adapters.js';\nimport type { EventBus } from '../event-bus.js';\nimport { getModuleState, setModuleState } from '../../core/state.js';\nimport { PATHS } from '../paths.js';\nimport type { ThreatEvent } from '../../types/events.js';\n\ninterface BlockEntry {\n ip: string;\n reason: string;\n rule_id?: string;\n blocked_at: number;\n expires_at?: number;\n dry_run: boolean;\n}\n\ninterface RemediationConfig {\n enabled: boolean;\n dry_run: boolean;\n default_ttl_seconds: number;\n min_severity: string;\n allowlist: string[];\n}\n\nconst DEFAULT_CONFIG: RemediationConfig = {\n enabled: true,\n dry_run: true,\n default_ttl_seconds: 3600,\n min_severity: 'high',\n allowlist: ['127.0.0.1', '::1'],\n};\n\nconst SEVERITY_RANK: Record<string, number> = {\n info: 0, low: 1, medium: 2, high: 3, critical: 4,\n};\n\nexport class RemediationManager {\n private config: RemediationConfig;\n private blocklist: BlockEntry[] = [];\n private expiryTimer: NodeJS.Timeout | null = null;\n\n constructor(\n private adapter: FirewallAdapter,\n private bus: EventBus,\n config?: Partial<RemediationConfig>,\n ) {\n this.config = { ...DEFAULT_CONFIG, ...config };\n this.loadState();\n this.startExpiryWorker();\n }\n\n async handleDetection(event: ThreatEvent): Promise<void> {\n if (!this.config.enabled) return;\n\n const eventRank = SEVERITY_RANK[event.severity] ?? 0;\n const minRank = SEVERITY_RANK[this.config.min_severity] ?? 3;\n if (eventRank < minRank) return;\n\n const ip = event.source_ip;\n if (!ip) return;\n if (this.isAllowlisted(ip)) return;\n if (this.blocklist.some(b => b.ip === ip)) return;\n\n const ruleRemediation = event.details?.remediation as Record<string, unknown> | undefined;\n const ttl = (ruleRemediation?.ttl_seconds as number) || this.config.default_ttl_seconds;\n const ruleId = event.details?.rule_id as string | undefined;\n\n await this.blockIp(ip, event.message, ruleId, ttl);\n }\n\n async blockIp(ip: string, reason: string, ruleId?: string, ttlSeconds?: number): Promise<boolean> {\n if (this.isAllowlisted(ip)) return false;\n\n const entry: BlockEntry = {\n ip,\n reason,\n rule_id: ruleId,\n blocked_at: Date.now(),\n expires_at: ttlSeconds ? Date.now() + (ttlSeconds * 1000) : undefined,\n dry_run: this.config.dry_run,\n };\n\n if (!this.config.dry_run) {\n try {\n await this.adapter.block(ip);\n } catch (err) {\n this.logLine(`[firewall] EACCES or error blocking ${ip}: ${(err as Error).message}`);\n this.bus.publish({\n timestamp: new Date(),\n module: 'firewall-rules',\n category: 'system',\n severity: 'medium',\n message: `Failed to block ${ip}: ${(err as Error).message}. Ensure daemon has CAP_NET_ADMIN.`,\n });\n return false;\n }\n }\n\n this.blocklist.push(entry);\n this.saveState();\n\n const mode = this.config.dry_run ? '[DRY-RUN] ' : '';\n const expiryMsg = ttlSeconds ? ` (expires in ${ttlSeconds}s)` : ' (permanent)';\n this.logLine(`[firewall] ${mode}Blocked ${ip}: ${reason}${expiryMsg}`);\n\n this.bus.publish({\n timestamp: new Date(),\n module: 'firewall-rules',\n category: 'system',\n severity: 'info',\n message: `${mode}Blocked ${ip}: ${reason}${expiryMsg}`,\n source_ip: ip,\n details: { action: 'block', rule_id: ruleId, dry_run: this.config.dry_run, ttl_seconds: ttlSeconds },\n });\n\n return true;\n }\n\n async unblockIp(ip: string): Promise<boolean> {\n const idx = this.blocklist.findIndex(b => b.ip === ip);\n if (idx < 0) return false;\n\n const entry = this.blocklist[idx];\n if (!entry.dry_run) {\n try {\n await this.adapter.unblock(ip);\n } catch (err) {\n this.logLine(`[firewall] Error unblocking ${ip}: ${(err as Error).message}`);\n return false;\n }\n }\n\n this.blocklist.splice(idx, 1);\n this.saveState();\n\n this.logLine(`[firewall] Unblocked ${ip}`);\n this.bus.publish({\n timestamp: new Date(),\n module: 'firewall-rules',\n category: 'system',\n severity: 'info',\n message: `Unblocked ${ip}`,\n source_ip: ip,\n details: { action: 'unblock' },\n });\n\n return true;\n }\n\n isAllowlisted(ip: string): boolean {\n return this.config.allowlist.includes(ip);\n }\n\n addToAllowlist(ip: string): void {\n if (!this.config.allowlist.includes(ip)) {\n this.config.allowlist.push(ip);\n }\n }\n\n removeFromAllowlist(ip: string): void {\n this.config.allowlist = this.config.allowlist.filter(a => a !== ip);\n }\n\n getBlocklist(): BlockEntry[] { return [...this.blocklist]; }\n getAllowlist(): string[] { return [...this.config.allowlist]; }\n\n stop(): void {\n if (this.expiryTimer) clearInterval(this.expiryTimer);\n this.expiryTimer = null;\n }\n\n private startExpiryWorker(): void {\n this.expiryTimer = setInterval(() => void this.processExpiries(), 30_000);\n }\n\n private async processExpiries(): Promise<void> {\n const now = Date.now();\n const expired = this.blocklist.filter(b => b.expires_at && b.expires_at <= now);\n for (const entry of expired) {\n await this.unblockIp(entry.ip);\n }\n }\n\n private loadState(): void {\n try {\n const saved = getModuleState('firewall-rules', 'blocklist') as BlockEntry[] | undefined;\n if (Array.isArray(saved)) this.blocklist = saved;\n } catch { /* State DB may not be available */ }\n }\n\n private saveState(): void {\n try { setModuleState('firewall-rules', 'blocklist', this.blocklist); }\n catch { /* State DB may not be available */ }\n }\n\n private logLine(line: string): void {\n try { appendFileSync(PATHS.logFile, `${new Date().toISOString()} ${line}\\n`); }\n catch { /* best-effort */ }\n }\n}\n","/**\n * Opt-in error reporting for the CLI + daemon.\n *\n * Enabled only when `SENTRY_DSN` is set in the environment. Safe to call\n * from both short-lived CLI invocations and the long-running daemon.\n */\n\nlet ready = false;\n// Keep the import lazy so the CLI doesn't pay the Sentry bundle cost when\n// reporting is disabled.\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nlet sentry: any = null;\n\nasync function loadSentry(): Promise<void> {\n if (sentry) return;\n try {\n sentry = await import('@sentry/node');\n } catch {\n sentry = null;\n }\n}\n\nexport async function initTelemetry(context: 'cli' | 'daemon'): Promise<void> {\n if (ready) return;\n const dsn = process.env.SENTRY_DSN;\n if (!dsn) return;\n\n await loadSentry();\n if (!sentry) return;\n\n sentry.init({\n dsn,\n environment: process.env.NODE_ENV || 'production',\n release: process.env.SENTRY_RELEASE,\n serverName: context,\n tracesSampleRate: 0,\n beforeSend(event: Record<string, unknown>) {\n const req = (event as { request?: { headers?: Record<string, string> } }).request;\n if (req?.headers) {\n delete req.headers.authorization;\n delete req.headers.cookie;\n }\n return event;\n },\n });\n\n ready = true;\n}\n\nexport function captureException(err: unknown): void {\n if (!ready || !sentry) return;\n sentry.captureException(err);\n}\n\nexport async function flushTelemetry(timeoutMs = 2000): Promise<void> {\n if (!ready || !sentry) return;\n try { await sentry.flush(timeoutMs); } catch { /* ignore */ }\n}\n","#!/usr/bin/env node\nimport { runDaemon } from './daemon/index.js';\n\nrunDaemon().catch((err) => {\n console.error('threatcrushd failed to start:', err);\n process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA,sFAAAA,UAAAC,SAAA;AAAA;AACA,QAAM,YAAY;AAClB,QAAM,cAAN,MAAM,qBAAoB,MAAM;AAAA;AAAA,MAE9B,YAAa,KAAK,UAAU,YAAY;AACtC,cAAM,mBAAmB,KAAK,UAAU,UAAU;AAClD,aAAK,OAAO;AACZ,aAAK,OAAO;AACZ,YAAI,MAAM,kBAAmB,OAAM,kBAAkB,MAAM,YAAW;AAAA,MACxE;AAAA,IACF;AACA,QAAM,QAAN,MAAY;AAAA,MACV,YAAa,QAAQ;AACnB,aAAK,SAAS;AACd,aAAK,MAAM;AACX,aAAK,WAAW;AAChB,aAAK,SAAS;AACd,aAAK,cAAc;AACnB,aAAK,YAAY;AAAA,MACnB;AAAA,IACF;AACA,QAAM,SAAN,MAAa;AAAA,MACX,cAAe;AACb,aAAK,MAAM;AACX,aAAK,MAAM;AACX,aAAK,OAAO;AACZ,aAAK,MAAM,CAAC;AACZ,aAAK,MAAM,KAAK;AAChB,aAAK,QAAQ,CAAC;AACd,aAAK,OAAO;AACZ,aAAK,OAAO;AACZ,aAAK,KAAK;AACV,aAAK,QAAQ,IAAI,MAAM,KAAK,UAAU;AAAA,MACxC;AAAA,MAEA,MAAO,KAAK;AAEV,YAAI,IAAI,WAAW,KAAK,IAAI,UAAU,KAAM;AAE5C,aAAK,OAAO,OAAO,GAAG;AACtB,aAAK,KAAK;AACV,aAAK,OAAO;AACZ,YAAI;AACJ,eAAO,YAAY,SAAS,KAAK,SAAS,GAAG;AAC3C,oBAAU,KAAK,OAAO;AAAA,QACxB;AACA,aAAK,OAAO;AAAA,MACd;AAAA,MACA,WAAY;AACV,YAAI,KAAK,SAAS,IAAM;AACtB,YAAE,KAAK;AACP,eAAK,MAAM;AAAA,QACb;AACA,UAAE,KAAK;AACP,aAAK,OAAO,KAAK,KAAK,YAAY,KAAK,EAAE;AACzC,UAAE,KAAK;AACP,UAAE,KAAK;AACP,eAAO,KAAK,WAAW;AAAA,MACzB;AAAA,MACA,aAAc;AACZ,eAAO,KAAK,KAAK,KAAK,KAAK;AAAA,MAC7B;AAAA,MACA,SAAU;AACR,eAAO,KAAK,MAAM,OAAO,KAAK,MAAM,KAAK,MAAM,QAAQ;AAAA,MACzD;AAAA,MACA,SAAU;AACR,aAAK,OAAO;AACZ,YAAI;AACJ,WAAG;AACD,iBAAO,KAAK,MAAM;AAClB,eAAK,OAAO;AAAA,QACd,SAAS,KAAK,MAAM,WAAW;AAE/B,aAAK,MAAM;AACX,aAAK,QAAQ;AACb,aAAK,OAAO;AAEZ,eAAO,KAAK;AAAA,MACd;AAAA,MACA,KAAM,IAAI;AAER,YAAI,OAAO,OAAO,WAAY,OAAM,IAAI,YAAY,+CAA+C,KAAK,UAAU,EAAE,CAAC;AACrH,aAAK,MAAM,SAAS;AAAA,MACtB;AAAA,MACA,KAAM,IAAI;AACR,aAAK,KAAK,EAAE;AACZ,eAAO,KAAK,OAAO;AAAA,MACrB;AAAA,MACA,KAAM,IAAI,YAAY;AACpB,YAAI,WAAY,MAAK,KAAK,UAAU;AACpC,aAAK,MAAM,KAAK,KAAK,KAAK;AAC1B,aAAK,QAAQ,IAAI,MAAM,EAAE;AAAA,MAC3B;AAAA,MACA,QAAS,IAAI,YAAY;AACvB,aAAK,KAAK,IAAI,UAAU;AACxB,eAAO,KAAK,OAAO;AAAA,MACrB;AAAA,MACA,OAAQ,OAAO;AAEb,YAAI,KAAK,MAAM,WAAW,EAAG,OAAM,KAAK,MAAM,IAAI,YAAY,iBAAiB,CAAC;AAChF,YAAI,UAAU,OAAW,SAAQ,KAAK,MAAM;AAC5C,aAAK,QAAQ,KAAK,MAAM,IAAI;AAC5B,aAAK,MAAM,WAAW;AAAA,MACxB;AAAA,MACA,UAAW,OAAO;AAChB,aAAK,OAAO,KAAK;AACjB,eAAO,KAAK,OAAO;AAAA,MACrB;AAAA,MACA,UAAW;AAET,YAAI,KAAK,SAAS,UAAW,OAAM,KAAK,MAAM,IAAI,YAAY,0BAA0B,CAAC;AACzF,aAAK,MAAM,OAAO,KAAK,KAAK,KAAK,EAAE;AAAA,MACrC;AAAA,MACA,MAAO,KAAK;AACV,YAAI,OAAO,KAAK;AAChB,YAAI,MAAM,KAAK;AACf,YAAI,MAAM,KAAK;AACf,eAAO;AAAA,MACT;AAAA;AAAA,MAEA,aAAc;AACZ,cAAM,IAAI,YAAY,kCAAkC;AAAA,MAC1D;AAAA,IACF;AACA,WAAO,MAAM;AACb,WAAO,QAAQ;AACf,IAAAA,QAAO,UAAU;AAAA;AAAA;;;AC9HjB;AAAA,+FAAAC,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU,WAAS;AACxB,YAAM,OAAO,IAAI,KAAK,KAAK;AAE3B,UAAI,MAAM,IAAI,GAAG;AACf,cAAM,IAAI,UAAU,kBAAkB;AAAA,MACxC,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;;;ACTA;AAAA,0FAAAC,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU,CAAC,GAAG,QAAQ;AAC3B,YAAM,OAAO,GAAG;AAChB,aAAO,IAAI,SAAS,EAAG,OAAM,MAAM;AACnC,aAAO;AAAA,IACT;AAAA;AAAA;;;ACLA;AAAA,qGAAAC,UAAAC,SAAA;AAAA;AACA,QAAM,IAAI;AAEV,QAAM,mBAAN,cAA+B,KAAK;AAAA,MAClC,YAAa,OAAO;AAClB,cAAM,QAAQ,GAAG;AACjB,aAAK,aAAa;AAAA,MACpB;AAAA,MACA,cAAe;AACb,cAAM,OAAO,GAAG,KAAK,eAAe,CAAC,IAAI,EAAE,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC;AAChG,cAAM,OAAO,GAAG,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,cAAc,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,cAAc,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;AACvI,eAAO,GAAG,IAAI,IAAI,IAAI;AAAA,MACxB;AAAA,IACF;AAEA,IAAAA,QAAO,UAAU,WAAS;AACxB,YAAM,OAAO,IAAI,iBAAiB,KAAK;AAEvC,UAAI,MAAM,IAAI,GAAG;AACf,cAAM,IAAI,UAAU,kBAAkB;AAAA,MACxC,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;;;ACvBA;AAAA,2FAAAC,UAAAC,SAAA;AAAA;AACA,QAAM,IAAI;AACV,QAAM,WAAW,OAAO;AAExB,QAAMC,QAAN,cAAmB,SAAS;AAAA,MAC1B,YAAa,OAAO;AAClB,cAAM,KAAK;AACX,aAAK,SAAS;AAAA,MAChB;AAAA,MACA,cAAe;AACb,eAAO,GAAG,KAAK,eAAe,CAAC,IAAI,EAAE,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC;AAAA,MAC5F;AAAA,IACF;AAEA,IAAAD,QAAO,UAAU,WAAS;AACxB,YAAM,OAAO,IAAIC,MAAK,KAAK;AAE3B,UAAI,MAAM,IAAI,GAAG;AACf,cAAM,IAAI,UAAU,kBAAkB;AAAA,MACxC,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;;;ACtBA;AAAA,2FAAAC,UAAAC,SAAA;AAAA;AACA,QAAM,IAAI;AAEV,QAAM,OAAN,cAAmB,KAAK;AAAA,MACtB,YAAa,OAAO;AAClB,cAAM,cAAc,KAAK,GAAG;AAC5B,aAAK,SAAS;AAAA,MAChB;AAAA,MACA,cAAe;AACb,eAAO,GAAG,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,cAAc,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,cAAc,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;AAAA,MACnI;AAAA,IACF;AAEA,IAAAA,QAAO,UAAU,WAAS;AACxB,YAAM,OAAO,IAAI,KAAK,KAAK;AAE3B,UAAI,MAAM,IAAI,GAAG;AACf,cAAM,IAAI,UAAU,kBAAkB;AAAA,MACxC,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AAAA;AAAA;;;ACrBA;AAAA;AAAA;AAEA,WAAO,UAAU,gBAAgB,gBAAsB;AACvD,WAAO,QAAQ,kBAAkB;AAEjC,QAAM,YAAN,MAAM,mBAAkB,MAAM;AAAA,MAC5B,YAAa,KAAK;AAChB,cAAM,GAAG;AACT,aAAK,OAAO;AAEZ,YAAI,MAAM,kBAAmB,OAAM,kBAAkB,MAAM,UAAS;AACpE,aAAK,WAAW;AAChB,aAAK,UAAU;AAAA,MACjB;AAAA,IACF;AACA,cAAU,OAAO,SAAO;AACtB,YAAM,OAAO,IAAI,UAAU,IAAI,OAAO;AACtC,WAAK,OAAO,IAAI;AAChB,WAAK,UAAU;AACf,aAAO;AAAA,IACT;AACA,WAAO,QAAQ,YAAY;AAE3B,QAAM,iBAAiB;AACvB,QAAM,sBAAsB;AAC5B,QAAM,aAAa;AACnB,QAAM,aAAa;AAEnB,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,qBAAqB;AAC3B,QAAM,UAAU;AAChB,QAAM,YAAY;AAClB,QAAM,WAAW;AACjB,QAAM,YAAY;AAClB,QAAM,YAAY;AAClB,QAAM,aAAa;AACnB,QAAM,cAAc;AACpB,QAAM,cAAc;AACpB,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,aAAa;AACnB,QAAM,cAAc;AACpB,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,cAAc;AACpB,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,SAAS;AACf,QAAM,YAAY;AAClB,QAAM,YAAY;AAClB,QAAM,YAAY;AAClB,QAAM,YAAY;AAClB,QAAM,YAAY;AAClB,QAAM,WAAW;AACjB,QAAM,kBAAkB;AACxB,QAAM,iBAAiB;AAEvB,QAAM,UAAU;AAAA,MACd,CAAC,MAAM,GAAG;AAAA,MACV,CAAC,MAAM,GAAG;AAAA,MACV,CAAC,MAAM,GAAG;AAAA,MACV,CAAC,MAAM,GAAG;AAAA,MACV,CAAC,MAAM,GAAG;AAAA,MACV,CAAC,SAAS,GAAG;AAAA,MACb,CAAC,SAAS,GAAG;AAAA,IACf;AAEA,aAAS,QAAS,IAAI;AACpB,aAAO,MAAM,UAAU,MAAM;AAAA,IAC/B;AACA,aAAS,QAAS,IAAI;AACpB,aAAQ,MAAM,UAAU,MAAM,UAAY,MAAM,UAAU,MAAM,UAAY,MAAM,UAAU,MAAM;AAAA,IACpG;AACA,aAAS,MAAO,IAAI;AAClB,aAAO,OAAO,UAAU,OAAO;AAAA,IACjC;AACA,aAAS,QAAS,IAAI;AACpB,aAAQ,MAAM,UAAU,MAAM;AAAA,IAChC;AACA,aAAS,sBAAuB,IAAI;AAClC,aAAQ,MAAM,UAAU,MAAM,UACtB,MAAM,UAAU,MAAM,UACtB,MAAM,UAAU,MAAM,UACvB,OAAO,aACP,OAAO,aACP,OAAO,eACP,OAAO;AAAA,IAChB;AACA,aAAS,iBAAkB,IAAI;AAC7B,aAAQ,MAAM,UAAU,MAAM,UACtB,MAAM,UAAU,MAAM,UACtB,MAAM,UAAU,MAAM,UACvB,OAAO,eACP,OAAO;AAAA,IAChB;AACA,QAAM,QAAQ,uBAAO,MAAM;AAC3B,QAAM,YAAY,uBAAO,UAAU;AAEnC,QAAM,iBAAiB,OAAO,UAAU;AACxC,QAAM,iBAAiB,OAAO;AAC9B,QAAM,aAAa,EAAC,cAAc,MAAM,YAAY,MAAM,UAAU,MAAM,OAAO,OAAS;AAE1F,aAAS,OAAQ,KAAK,KAAK;AACzB,UAAI,eAAe,KAAK,KAAK,GAAG,EAAG,QAAO;AAC1C,UAAI,QAAQ,YAAa,gBAAe,KAAK,aAAa,UAAU;AACpE,aAAO;AAAA,IACT;AAEA,QAAM,eAAe,uBAAO,cAAc;AAC1C,aAAS,cAAe;AACtB,aAAO,OAAO,iBAAiB,CAAC,GAAG;AAAA,QACjC,CAAC,KAAK,GAAG,EAAC,OAAO,aAAY;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,aAAS,cAAe,KAAK;AAC3B,UAAI,QAAQ,QAAQ,OAAQ,QAAS,SAAU,QAAO;AACtD,aAAO,IAAI,KAAK,MAAM;AAAA,IACxB;AAEA,QAAM,QAAQ,uBAAO,OAAO;AAC5B,aAAS,QAAS;AAChB,aAAO,OAAO,iBAAiB,CAAC,GAAG;AAAA,QACjC,CAAC,KAAK,GAAG,EAAC,OAAO,MAAK;AAAA,QACtB,CAAC,SAAS,GAAG,EAAC,OAAO,OAAO,UAAU,KAAI;AAAA,MAC5C,CAAC;AAAA,IACH;AACA,aAAS,QAAS,KAAK;AACrB,UAAI,QAAQ,QAAQ,OAAQ,QAAS,SAAU,QAAO;AACtD,aAAO,IAAI,KAAK,MAAM;AAAA,IACxB;AAEA,QAAM,eAAe,uBAAO,cAAc;AAC1C,QAAM,cAAc,uBAAO,aAAa;AACxC,aAAS,WAAY,MAAM;AACzB,aAAO,OAAO,iBAAiB,CAAC,GAAG;AAAA,QACjC,CAAC,KAAK,GAAG,EAAC,OAAO,YAAW;AAAA,QAC5B,CAAC,YAAY,GAAG,EAAC,OAAO,KAAI;AAAA,MAC9B,CAAC;AAAA,IACH;AACA,aAAS,aAAc,KAAK;AAC1B,UAAI,QAAQ,QAAQ,OAAQ,QAAS,SAAU,QAAO;AACtD,aAAO,IAAI,KAAK,MAAM;AAAA,IACxB;AAEA,QAAM,OAAO,uBAAO,MAAM;AAC1B,aAAS,OAAQ;AACf,aAAO,OAAO,iBAAiB,CAAC,GAAG;AAAA,QACjC,CAAC,KAAK,GAAG,EAAC,OAAO,KAAI;AAAA,MACvB,CAAC;AAAA,IACH;AACA,aAAS,OAAQ,KAAK;AACpB,UAAI,QAAQ,QAAQ,OAAQ,QAAS,SAAU,QAAO;AACtD,aAAO,IAAI,KAAK,MAAM;AAAA,IACxB;AAGA,QAAI;AACJ,QAAI;AACF,YAAM,cAAc,KAAK,yBAAyB;AAClD,gBAAU,YAAY;AAAA,IACxB,SAAS,GAAG;AAAA,IAEZ;AAEA,QAAM,WAAW,WAAW;AAE5B,QAAM,cAAN,MAAkB;AAAA,MAChB,YAAa,OAAO;AAClB,YAAI;AACF,eAAK,QAAQ,OAAO,OAAO,OAAO,IAAI,KAAK;AAAA,QAC7C,SAAS,GAAG;AAEV,eAAK,QAAQ;AAAA,QACf;AACA,eAAO,eAAe,MAAM,OAAO,EAAC,OAAO,QAAO,CAAC;AAAA,MACrD;AAAA,MACA,QAAS;AACP,eAAO,KAAK,UAAU;AAAA,MACxB;AAAA;AAAA,MAEA,WAAY;AACV,eAAO,OAAO,KAAK,KAAK;AAAA,MAC1B;AAAA;AAAA,MAEA,CAAC,QAAQ,IAAK;AACZ,eAAO,YAAY,KAAK,SAAS,CAAC;AAAA,MACpC;AAAA,MACA,UAAW;AACT,eAAO,KAAK;AAAA,MACd;AAAA,IACF;AAEA,QAAM,UAAU,uBAAO,SAAS;AAChC,aAAS,QAAS,OAAO;AACvB,UAAI,MAAM,OAAO,KAAK;AAEtB,UAAI,OAAO,GAAG,KAAK,EAAE,EAAG,OAAM;AAE9B,UAAI,OAAO,UAAU,CAAC,OAAO,cAAc,GAAG,GAAG;AAC/C,eAAO,IAAI,YAAY,KAAK;AAAA,MAC9B,OAAO;AAEL,eAAO,OAAO,iBAAiB,IAAI,OAAO,GAAG,GAAG;AAAA,UAC9C,OAAO,EAAC,OAAO,WAAY;AAAE,mBAAO,MAAM,IAAI;AAAA,UAAE,EAAC;AAAA,UACjD,CAAC,KAAK,GAAG,EAAC,OAAO,QAAO;AAAA,UACxB,CAAC,QAAQ,GAAG,EAAC,OAAO,MAAM,aAAa,KAAK,IAAG;AAAA,QACjD,CAAC;AAAA,MACH;AAAA,IACF;AACA,aAAS,UAAW,KAAK;AACvB,UAAI,QAAQ,QAAQ,OAAQ,QAAS,SAAU,QAAO;AACtD,aAAO,IAAI,KAAK,MAAM;AAAA,IACxB;AAEA,QAAM,QAAQ,uBAAO,OAAO;AAC5B,aAAS,MAAO,OAAO;AAErB,aAAO,OAAO,iBAAiB,IAAI,OAAO,KAAK,GAAG;AAAA,QAChD,CAAC,KAAK,GAAG,EAAC,OAAO,MAAK;AAAA,QACtB,CAAC,QAAQ,GAAG,EAAC,OAAO,MAAM,WAAW,KAAK,IAAG;AAAA,MAC/C,CAAC;AAAA,IACH;AACA,aAAS,QAAS,KAAK;AACrB,UAAI,QAAQ,QAAQ,OAAQ,QAAS,SAAU,QAAO;AACtD,aAAO,IAAI,KAAK,MAAM;AAAA,IACxB;AAEA,aAAS,SAAU,OAAO;AACxB,YAAM,OAAO,OAAO;AACpB,UAAI,SAAS,UAAU;AAErB,YAAI,UAAU,KAAM,QAAO;AAC3B,YAAI,iBAAiB,KAAM,QAAO;AAElC,YAAI,SAAS,OAAO;AAClB,kBAAQ,MAAM,KAAK,GAAG;AAAA,YACpB,KAAK;AAAc,qBAAO;AAAA,YAC1B,KAAK;AAAa,qBAAO;AAAA;AAAA,YAEzB,KAAK;AAAO,qBAAO;AAAA;AAAA,YAEnB,KAAK;AAAM,qBAAO;AAAA,YAClB,KAAK;AAAO,qBAAO;AAAA,YACnB,KAAK;AAAS,qBAAO;AAAA,UACvB;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAEA,aAAS,gBAAiB,QAAQ;AAAA,MAChC,MAAM,mBAAmB,OAAO;AAAA,QAC9B,cAAe;AACb,gBAAM;AACN,eAAK,MAAM,KAAK,MAAM,MAAM;AAAA,QAC9B;AAAA;AAAA,QAGA,cAAe;AACb,iBAAO,KAAK,SAAS,YAAY,KAAK,SAAS,UAAU,KAAK,SAAS,WAAW,KAAK,YAAY;AAAA,QACrG;AAAA,QACA,cAAe;AACb,iBAAO,KAAK,SAAS,OAAO,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS;AAAA,QAC3E;AAAA,QAEA,aAAc;AACZ,cAAI,KAAK,SAAS,OAAO,KAAK;AAC5B,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC,WAAW,KAAK,SAAS,UAAU;AACjC,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACxG,mBAAO;AAAA,UACT,WAAW,sBAAsB,KAAK,IAAI,GAAG;AAC3C,mBAAO,KAAK,QAAQ,KAAK,oBAAoB;AAAA,UAC/C,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,sBAAsB,KAAK,IAAI,GAAG,CAAC;AAAA,UACpE;AAAA,QACF;AAAA;AAAA;AAAA,QAIA,uBAAwB;AACtB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACzE,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,UAAU;AACjC,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,KAAK,SAAS,OAAO,OAAO,KAAK,SAAS,QAAQ;AAC3D,mBAAO,KAAK,OAAO;AAAA,UACrB,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,6EAA6E,CAAC;AAAA,UAC/G;AAAA,QACF;AAAA;AAAA,QAGA,uBAAwB;AACtB,iBAAO,KAAK,QAAQ,KAAK,aAAa,KAAK,qBAAqB;AAAA,QAClE;AAAA,QACA,sBAAuB,IAAI;AACzB,cAAI,SAAS,KAAK;AAClB,cAAI,WAAW,GAAG,IAAI,IAAI;AAC1B,mBAAS,MAAM,GAAG,KAAK;AACrB,gBAAI,OAAO,QAAQ,EAAE,MAAM,CAAC,QAAQ,OAAO,EAAE,CAAC,KAAK,OAAO,EAAE,EAAE,SAAS,IAAI;AACzE,oBAAM,KAAK,MAAM,IAAI,UAAU,6BAA6B,CAAC;AAAA,YAC/D;AACA,qBAAS,OAAO,EAAE,IAAI,OAAO,EAAE,KAAK,MAAM;AAAA,UAC5C;AACA,cAAI,OAAO,QAAQ,QAAQ,GAAG;AAC5B,kBAAM,KAAK,MAAM,IAAI,UAAU,6BAA6B,CAAC;AAAA,UAC/D;AAEA,cAAI,UAAU,GAAG,KAAK,KAAK,QAAQ,GAAG,KAAK,GAAG;AAC5C,mBAAO,QAAQ,IAAI,GAAG,MAAM,QAAQ;AAAA,UACtC,OAAO;AACL,mBAAO,QAAQ,IAAI,GAAG;AAAA,UACxB;AACA,iBAAO,KAAK,KAAK,KAAK,oBAAoB;AAAA,QAC5C;AAAA;AAAA,QAGA,cAAe;AACb,iBAAO,KAAK,QAAQ,KAAK,cAAc,KAAK,mBAAmB;AAAA,QACjE;AAAA,QACA,oBAAqB,KAAK;AACxB,cAAI,KAAK,MAAM,aAAa;AAC1B,iBAAK,MAAM,YAAY,KAAK,GAAG;AAAA,UACjC,OAAO;AACL,iBAAK,MAAM,cAAc,CAAC,GAAG;AAAA,UAC/B;AACA,iBAAO,KAAK,KAAK,KAAK,wBAAwB;AAAA,QAChD;AAAA,QACA,2BAA4B;AAC1B,cAAI,KAAK,SAAS,aAAa;AAC7B,mBAAO,KAAK,KAAK,KAAK,yBAAyB;AAAA,UACjD,WAAW,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACxD,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC;AAAA,QACF;AAAA,QACA,4BAA6B;AAC3B,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO,KAAK,QAAQ,KAAK,cAAc,KAAK,mBAAmB;AAAA,UACjE;AAAA,QACF;AAAA,QAEA,mBAAoB;AAClB,cAAI,KAAK,SAAS,aAAa;AAC7B,mBAAO,KAAK,KAAK,KAAK,mBAAmB;AAAA,UAC3C,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iCAAiC,CAAC;AAAA,UACnE;AAAA,QACF;AAAA,QACA,sBAAuB;AACrB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,OAAO;AACL,mBAAO,KAAK,QAAQ,KAAK,YAAY,KAAK,iBAAiB;AAAA,UAC7D;AAAA,QACF;AAAA,QACA,kBAAmB,OAAO;AACxB,iBAAO,KAAK,UAAU,EAAC,KAAK,KAAK,MAAM,aAAa,MAAY,CAAC;AAAA,QACnE;AAAA;AAAA,QAGA,eAAgB;AACd,aAAG;AACD,gBAAI,KAAK,SAAS,OAAO,OAAO,KAAK,SAAS,QAAQ;AACpD,qBAAO,KAAK,OAAO;AAAA,YACrB;AAAA,UACF,SAAS,KAAK,SAAS;AAAA,QACzB;AAAA;AAAA,QAGA,mBAAoB;AAClB,cAAI,KAAK,SAAS,WAAW;AAC3B,iBAAK,KAAK,KAAK,SAAS;AAAA,UAC1B,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,UAAU;AAAA,UAClC;AAAA,QACF;AAAA;AAAA,QAGA,aAAc;AACZ,eAAK,MAAM,KAAK;AAChB,iBAAO,KAAK,KAAK,KAAK,cAAc;AAAA,QACtC;AAAA,QACA,iBAAkB;AAChB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,OAAO;AACL,mBAAO,KAAK,QAAQ,KAAK,cAAc,KAAK,cAAc;AAAA,UAC5D;AAAA,QACF;AAAA,QACA,eAAgB,SAAS;AACvB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,WAAW;AAClC,gBAAI,OAAO,KAAK,KAAK,OAAO,MAAM,CAAC,QAAQ,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,OAAO,EAAE,SAAS,IAAI;AAC9F,oBAAM,KAAK,MAAM,IAAI,UAAU,6BAA6B,CAAC;AAAA,YAC/D,OAAO;AACL,mBAAK,MAAM,KAAK,IAAI,OAAO,IAAI,KAAK,IAAI,OAAO,KAAK,MAAM;AAC1D,mBAAK,IAAI,SAAS,IAAI;AAAA,YACxB;AACA,mBAAO,KAAK,KAAK,KAAK,oBAAoB;AAAA,UAC5C,WAAW,KAAK,SAAS,aAAa;AACpC,gBAAI,CAAC,OAAO,KAAK,KAAK,OAAO,GAAG;AAC9B,mBAAK,MAAM,KAAK,IAAI,OAAO,IAAI,MAAM;AAAA,YACvC,WAAW,QAAQ,KAAK,IAAI,OAAO,CAAC,GAAG;AACrC,mBAAK,MAAM,KAAK,IAAI,OAAO;AAAA,YAC7B,WAAW,OAAO,KAAK,IAAI,OAAO,CAAC,GAAG;AACpC,mBAAK,MAAM,KAAK,IAAI,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,SAAS,CAAC;AAAA,YAC3D,OAAO;AACL,oBAAM,KAAK,MAAM,IAAI,UAAU,6BAA6B,CAAC;AAAA,YAC/D;AACA,mBAAO,KAAK,KAAK,KAAK,cAAc;AAAA,UACtC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,mDAAmD,CAAC;AAAA,UACrF;AAAA,QACF;AAAA;AAAA,QAGA,YAAa;AACX,eAAK,MAAM,KAAK;AAChB,iBAAO,KAAK,KAAK,KAAK,aAAa;AAAA,QACrC;AAAA,QACA,gBAAiB;AACf,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,OAAO;AACL,mBAAO,KAAK,QAAQ,KAAK,cAAc,KAAK,aAAa;AAAA,UAC3D;AAAA,QACF;AAAA,QACA,cAAe,SAAS;AACtB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,WAAW;AAClC,gBAAI,CAAC,OAAO,KAAK,KAAK,OAAO,GAAG;AAC9B,mBAAK,IAAI,OAAO,IAAI,KAAK;AAAA,YAC3B;AACA,gBAAI,aAAa,KAAK,IAAI,OAAO,CAAC,GAAG;AACnC,oBAAM,KAAK,MAAM,IAAI,UAAU,8BAA8B,CAAC;AAAA,YAChE,WAAW,OAAO,KAAK,IAAI,OAAO,CAAC,GAAG;AACpC,oBAAM,OAAO,MAAM;AACnB,mBAAK,IAAI,OAAO,EAAE,KAAK,IAAI;AAC3B,mBAAK,MAAM;AAAA,YACb,OAAO;AACL,oBAAM,KAAK,MAAM,IAAI,UAAU,gCAAgC,CAAC;AAAA,YAClE;AACA,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,KAAK,SAAS,aAAa;AACpC,gBAAI,CAAC,OAAO,KAAK,KAAK,OAAO,GAAG;AAC9B,mBAAK,MAAM,KAAK,IAAI,OAAO,IAAI,MAAM;AAAA,YACvC,WAAW,aAAa,KAAK,IAAI,OAAO,CAAC,GAAG;AAC1C,oBAAM,KAAK,MAAM,IAAI,UAAU,8BAA8B,CAAC;AAAA,YAChE,WAAW,cAAc,KAAK,IAAI,OAAO,CAAC,GAAG;AAC3C,oBAAM,KAAK,MAAM,IAAI,UAAU,8BAA8B,CAAC;AAAA,YAChE,WAAW,OAAO,KAAK,IAAI,OAAO,CAAC,GAAG;AACpC,mBAAK,MAAM,KAAK,IAAI,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,SAAS,CAAC;AAAA,YAC3D,WAAW,QAAQ,KAAK,IAAI,OAAO,CAAC,GAAG;AACrC,mBAAK,MAAM,KAAK,IAAI,OAAO;AAAA,YAC7B,OAAO;AACL,oBAAM,KAAK,MAAM,IAAI,UAAU,gCAAgC,CAAC;AAAA,YAClE;AACA,mBAAO,KAAK,KAAK,KAAK,aAAa;AAAA,UACrC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,mDAAmD,CAAC;AAAA,UACrF;AAAA,QACF;AAAA,QACA,aAAc,SAAS;AACrB,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,oBAAoB;AAAA,UAC5C,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,mDAAmD,CAAC;AAAA,UACrF;AAAA,QACF;AAAA;AAAA,QAGA,aAAc;AACZ,cAAI,KAAK,SAAS,OAAO,KAAK;AAC5B,kBAAM,KAAK,MAAM,IAAI,UAAU,mBAAmB,CAAC;AAAA,UACrD,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,KAAK,KAAK,iBAAiB;AAAA,UACzC;AAAE,cAAI,KAAK,SAAS,WAAW;AAC7B,mBAAO,KAAK,KAAK,KAAK,iBAAiB;AAAA,UACzC,WAAW,KAAK,SAAS,eAAe,KAAK,SAAS,WAAW;AAC/D,mBAAO,KAAK,KAAK,KAAK,eAAe;AAAA,UACvC,WAAW,KAAK,SAAS,QAAQ;AAC/B,mBAAO,KAAK,KAAK,KAAK,QAAQ;AAAA,UAChC,WAAW,KAAK,SAAS,QAAQ;AAC/B,mBAAO,KAAK,KAAK,KAAK,QAAQ;AAAA,UAChC,WAAW,QAAQ,KAAK,IAAI,GAAG;AAC7B,mBAAO,KAAK,KAAK,KAAK,qBAAqB;AAAA,UAC7C,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACvD,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,KAAK,KAAK,iBAAiB,KAAK,WAAW;AAAA,UACzD,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,KAAK,KAAK,kBAAkB,KAAK,WAAW;AAAA,UAC1D,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iGAAiG,CAAC;AAAA,UACnI;AAAA,QACF;AAAA,QACA,YAAa,OAAO;AAClB,iBAAO,KAAK,UAAU,KAAK;AAAA,QAC7B;AAAA,QAEA,WAAY;AACV,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO,KAAK,KAAK,KAAK,SAAS;AAAA,UACjC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,wDAAwD,CAAC;AAAA,UAC1F;AAAA,QACF;AAAA,QACA,YAAa;AACX,cAAI,KAAK,SAAS,QAAQ;AACxB,gBAAI,KAAK,MAAM,QAAQ,KAAK;AAC1B,qBAAO,KAAK,OAAO,SAAS;AAAA,YAC9B,OAAO;AACL,qBAAO,KAAK,OAAO,QAAQ;AAAA,YAC7B;AAAA,UACF,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,wDAAwD,CAAC;AAAA,UAC1F;AAAA,QACF;AAAA,QAEA,WAAY;AACV,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO,KAAK,KAAK,KAAK,SAAS;AAAA,UACjC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,sCAAsC,CAAC;AAAA,UACxE;AAAA,QACF;AAAA,QACA,YAAa;AACX,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO,KAAK,OAAO,GAAG;AAAA,UACxB,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,sCAAsC,CAAC;AAAA,UACxE;AAAA,QACF;AAAA;AAAA,QAGA,eAAgB;AACd,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,KAAK,KAAK,kBAAkB;AAAA,UAC1C,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC;AAAA,QACF;AAAA;AAAA,QAGA,eAAgB;AACd,aAAG;AACD,gBAAI,KAAK,SAAS,OAAO,KAAK;AAC5B,oBAAM,KAAK,MAAM,IAAI,UAAU,yBAAyB,CAAC;AAAA,YAC3D,WAAW,iBAAiB,KAAK,IAAI,GAAG;AACtC,mBAAK,QAAQ;AAAA,YACf,WAAW,KAAK,MAAM,IAAI,WAAW,GAAG;AACtC,oBAAM,KAAK,MAAM,IAAI,UAAU,iCAAiC,CAAC;AAAA,YACnE,OAAO;AACL,qBAAO,KAAK,UAAU;AAAA,YACxB;AAAA,UACF,SAAS,KAAK,SAAS;AAAA,QACzB;AAAA;AAAA,QAGA,oBAAqB;AACnB,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,4BAA4B;AAAA,UACpD,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,kBAAkB;AAAA,UAC1C;AAAA,QACF;AAAA,QACA,qBAAsB;AACpB,aAAG;AACD,gBAAI,KAAK,SAAS,WAAW;AAC3B,qBAAO,KAAK,OAAO;AAAA,YACrB,WAAW,KAAK,YAAY,GAAG;AAC7B,oBAAM,KAAK,MAAM,IAAI,UAAU,qBAAqB,CAAC;AAAA,YACvD,WAAW,KAAK,SAAS,YAAa,KAAK,QAAQ,sBAAsB,KAAK,SAAS,QAAS;AAC9F,oBAAM,KAAK,yBAAyB;AAAA,YACtC,OAAO;AACL,mBAAK,QAAQ;AAAA,YACf;AAAA,UACF,SAAS,KAAK,SAAS;AAAA,QACzB;AAAA,QACA,+BAAgC;AAC9B,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C,OAAO;AACL,mBAAO,KAAK,UAAU;AAAA,UACxB;AAAA,QACF;AAAA,QACA,0BAA2B;AACzB,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,QAAQ;AAC/B,mBAAO,KAAK,KAAK,KAAK,8BAA8B;AAAA,UACtD,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,8BAA8B;AAAA,UACtD;AAAA,QACF;AAAA,QACA,iCAAkC;AAChC,aAAG;AACD,gBAAI,KAAK,SAAS,WAAW;AAC3B,qBAAO,KAAK,KAAK,KAAK,oBAAoB;AAAA,YAC5C,WAAW,KAAK,SAAS,OAAO,KAAK;AACnC,oBAAM,KAAK,MAAM,IAAI,UAAU,gCAAgC,CAAC;AAAA,YAClE,WAAW,KAAK,SAAS,YAAa,KAAK,QAAQ,sBAAsB,KAAK,SAAS,UAAU,KAAK,SAAS,UAAU,KAAK,SAAS,QAAS;AAC9I,oBAAM,KAAK,yBAAyB;AAAA,YACtC,OAAO;AACL,mBAAK,QAAQ;AAAA,YACf;AAAA,UACF,SAAS,KAAK,SAAS;AAAA,QACzB;AAAA,QACA,uBAAwB;AACtB,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,qBAAqB;AAAA,UAC7C,OAAO;AACL,iBAAK,MAAM,OAAO;AAClB,mBAAO,KAAK,KAAK,KAAK,8BAA8B;AAAA,UACtD;AAAA,QACF;AAAA,QACA,wBAAyB;AACvB,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,OAAO;AAAA,UACrB,OAAO;AACL,iBAAK,MAAM,OAAO;AAClB,mBAAO,KAAK,KAAK,KAAK,8BAA8B;AAAA,UACtD;AAAA,QACF;AAAA;AAAA,QAGA,oBAAqB;AACnB,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,qBAAqB;AAAA,UAC7C,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC;AAAA,QACF;AAAA,QACA,mBAAoB;AAClB,aAAG;AACD,gBAAI,KAAK,SAAS,WAAW;AAC3B,qBAAO,KAAK,KAAK,KAAK,aAAa,KAAK,uBAAuB;AAAA,YACjE,WAAW,KAAK,SAAS,WAAW;AAClC,qBAAO,KAAK,OAAO;AAAA,YACrB,WAAW,KAAK,YAAY,GAAG;AAC7B,oBAAM,KAAK,MAAM,IAAI,UAAU,qBAAqB,CAAC;AAAA,YACvD,WAAW,KAAK,SAAS,YAAa,KAAK,QAAQ,sBAAsB,KAAK,SAAS,QAAS;AAC9F,oBAAM,KAAK,yBAAyB;AAAA,YACtC,OAAO;AACL,mBAAK,QAAQ;AAAA,YACf;AAAA,UACF,SAAS,KAAK,SAAS;AAAA,QACzB;AAAA,QACA,wBAAyB,aAAa;AACpC,eAAK,MAAM,OAAO;AAClB,iBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,QACxC;AAAA,QACA,wBAAyB;AACvB,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC,OAAO;AACL,mBAAO,KAAK,UAAU;AAAA,UACxB;AAAA,QACF;AAAA,QACA,mBAAoB;AAClB,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,QAAQ;AAC/B,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C;AAAA,QACF;AAAA,QACA,0BAA2B;AACzB,aAAG;AACD,gBAAI,KAAK,SAAS,WAAW;AAC3B,qBAAO,KAAK,KAAK,KAAK,kBAAkB,KAAK,4BAA4B;AAAA,YAC3E,WAAW,KAAK,SAAS,WAAW;AAClC,qBAAO,KAAK,KAAK,KAAK,aAAa;AAAA,YACrC,WAAW,KAAK,SAAS,OAAO,KAAK;AACnC,oBAAM,KAAK,MAAM,IAAI,UAAU,gCAAgC,CAAC;AAAA,YAClE,WAAW,KAAK,SAAS,YAAa,KAAK,QAAQ,sBAAsB,KAAK,SAAS,UAAU,KAAK,SAAS,UAAU,KAAK,SAAS,QAAS;AAC9I,oBAAM,KAAK,yBAAyB;AAAA,YACtC,OAAO;AACL,mBAAK,QAAQ;AAAA,YACf;AAAA,UACF,SAAS,KAAK,SAAS;AAAA,QACzB;AAAA,QACA,2BAA4B;AAC1B,cAAI,cAAc;AAClB,cAAI,KAAK,OAAO,IAAI;AAClB,2BAAe;AAAA,UACjB;AACA,yBAAe,KAAK,KAAK,SAAS,EAAE;AAEpC,iBAAO,KAAK,MAAM,IAAI,UAAU,8EAA8E,WAAW,UAAU,CAAC;AAAA,QACtI;AAAA,QACA,6BAA8B,aAAa;AACzC,eAAK,MAAM,OAAO;AAClB,iBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,QAC/C;AAAA,QACA,gBAAiB;AACf,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,KAAK,KAAK,cAAc;AAAA,UACtC,OAAO;AACL,iBAAK,MAAM,OAAO;AAClB,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C;AAAA,QACF;AAAA,QACA,iBAAkB;AAChB,cAAI,KAAK,SAAS,WAAW;AAC3B,mBAAO,KAAK,OAAO;AAAA,UACrB,OAAO;AACL,iBAAK,MAAM,OAAO;AAClB,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C;AAAA,QACF;AAAA,QACA,mBAAoB;AAClB,cAAI,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AAChD,mBAAO,KAAK,KAAK,KAAK,cAAc;AAAA,UACtC,WAAW,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACxD,mBAAO,KAAK,KAAK,KAAK,iBAAiB;AAAA,UACzC,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,WAAW;AAAA,UACnC;AAAA,QACF;AAAA,QACA,oBAAqB;AACnB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACvD,mBAAO,KAAK,KAAK,KAAK,cAAc;AAAA,UACtC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yBAAyB,CAAC;AAAA,UAC3D;AAAA,QACF;AAAA,QACA,iBAAkB;AAEhB,cAAI,KAAK,SAAS,UAAU,KAAK,SAAS,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACjG,mBAAO;AAAA,UACT,OAAO;AACL,mBAAO,KAAK,UAAU;AAAA,UACxB;AAAA,QACF;AAAA,QACA,cAAe;AACb,cAAI,KAAK,QAAQ,SAAS;AACxB,mBAAO,KAAK,OAAO,QAAQ,KAAK,IAAI,CAAC;AAAA,UACvC,WAAW,KAAK,SAAS,QAAQ;AAC/B,mBAAO,KAAK,KAAK,KAAK,mBAAmB,KAAK,kBAAkB;AAAA,UAClE,WAAW,KAAK,SAAS,QAAQ;AAC/B,mBAAO,KAAK,KAAK,KAAK,mBAAmB,KAAK,kBAAkB;AAAA,UAClE,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,+BAA+B,KAAK,IAAI,CAAC;AAAA,UAC1E;AAAA,QACF;AAAA,QACA,mBAAoB,MAAM;AACxB,cAAI;AACF,kBAAM,YAAY,SAAS,MAAM,EAAE;AACnC,gBAAI,aAAa,mBAAmB,aAAa,gBAAgB;AAC/D,oBAAM,KAAK,MAAM,IAAI,UAAU,iEAAiE,CAAC;AAAA,YACnG;AACA,mBAAO,KAAK,UAAU,OAAO,cAAc,SAAS,CAAC;AAAA,UACvD,SAAS,KAAK;AACZ,kBAAM,KAAK,MAAM,UAAU,KAAK,GAAG,CAAC;AAAA,UACtC;AAAA,QACF;AAAA,QACA,oBAAqB;AACnB,cAAI,CAAC,QAAQ,KAAK,IAAI,GAAG;AACvB,kBAAM,KAAK,MAAM,IAAI,UAAU,qDAAqD,CAAC;AAAA,UACvF,OAAO;AACL,iBAAK,QAAQ;AACb,gBAAI,KAAK,MAAM,IAAI,UAAU,EAAG,QAAO,KAAK,OAAO;AAAA,UACrD;AAAA,QACF;AAAA,QACA,oBAAqB;AACnB,cAAI,CAAC,QAAQ,KAAK,IAAI,GAAG;AACvB,kBAAM,KAAK,MAAM,IAAI,UAAU,qDAAqD,CAAC;AAAA,UACvF,OAAO;AACL,iBAAK,QAAQ;AACb,gBAAI,KAAK,MAAM,IAAI,UAAU,EAAG,QAAO,KAAK,OAAO;AAAA,UACrD;AAAA,QACF;AAAA;AAAA,QAGA,kBAAmB;AACjB,eAAK,QAAQ;AACb,iBAAO,KAAK,KAAK,KAAK,wBAAwB;AAAA,QAChD;AAAA,QACA,2BAA4B;AAC1B,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO,KAAK,KAAK,KAAK,QAAQ;AAAA,UAChC,WAAW,KAAK,SAAS,QAAQ;AAC/B,mBAAO,KAAK,KAAK,KAAK,QAAQ;AAAA,UAChC,OAAO;AACL,mBAAO,KAAK,QAAQ,KAAK,cAAc,KAAK,uBAAuB;AAAA,UACrE;AAAA,QACF;AAAA,QACA,0BAA2B;AACzB,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,mCAAmC;AAAA,UAC3D,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,kBAAkB;AAAA,UAC1C;AAAA,QACF;AAAA,QACA,sCAAuC;AACrC,cAAI,KAAK,SAAS,aAAa;AAC7B,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,cAAc,KAAK,gBAAgB;AAAA,UAC3D,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACvD,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C,OAAO;AACL,mBAAO,KAAK,UAAU,QAAQ,KAAK,MAAM,GAAG,CAAC;AAAA,UAC/C;AAAA,QACF;AAAA,QACA,qBAAsB;AACpB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,SAAS,aAAa;AACpC,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACvD,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C,WAAW,KAAK,SAAS,aAAa;AACpC,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,cAAc,KAAK,gBAAgB;AAAA,UAC3D,OAAO;AACL,kBAAM,SAAS,QAAQ,KAAK,MAAM,GAAG;AAErC,gBAAI,OAAO,MAAM,GAAG;AAClB,oBAAM,KAAK,MAAM,IAAI,UAAU,gBAAgB,CAAC;AAAA,YAClD,OAAO;AACL,qBAAO,KAAK,UAAU,MAAM;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAAA,QACA,eAAgB;AACd,cAAI,KAAK,SAAS,eAAe,KAAK,SAAS,eAAe,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AAC1G,kBAAM,KAAK,MAAM,IAAI,UAAU,sCAAsC,CAAC;AAAA,UACxE,WAAW,KAAK,YAAY,GAAG;AAC7B,kBAAM,KAAK,MAAM,IAAI,UAAU,mBAAmB,CAAC;AAAA,UACrD;AACA,iBAAO,KAAK,UAAU;AAAA,QACxB;AAAA,QACA,+BAAgC;AAC9B,cAAI,KAAK,SAAS,eAAe,KAAK,SAAS,aAAa;AAC1D,kBAAM,KAAK,MAAM,IAAI,UAAU,sCAAsC,CAAC;AAAA,UACxE,WAAW,KAAK,YAAY,GAAG;AAC7B,kBAAM,KAAK,MAAM,IAAI,UAAU,mBAAmB,CAAC;AAAA,UACrD;AACA,iBAAO,KAAK,UAAU;AAAA,QACxB;AAAA,QACA,mBAAoB;AAClB,cAAI,KAAK,SAAS,aAAa;AAC7B,mBAAO,KAAK,KAAK,KAAK,cAAc,KAAK,gBAAgB;AAAA,UAC3D,WAAW,QAAQ,KAAK,IAAI,GAAG;AAC7B,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACvD,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C,OAAO;AACL,mBAAO,KAAK,UAAU,MAAM,KAAK,MAAM,GAAG,CAAC;AAAA,UAC7C;AAAA,QACF;AAAA,QACA,0BAA2B;AACzB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,mBAAO,KAAK,KAAK,KAAK,mBAAmB;AAAA,UAC3C,WAAW,KAAK,SAAS,eAAe,KAAK,SAAS,WAAW;AAC/D,iBAAK,QAAQ;AACb,iBAAK,KAAK,KAAK,cAAc,KAAK,mBAAmB;AAAA,UACvD,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,8CAA8C,CAAC;AAAA,UAChF;AAAA,QACF;AAAA,QACA,sBAAuB;AACrB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,SAAS,aAAa;AACpC,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,OAAO;AACL,mBAAO,KAAK,UAAU,MAAM,KAAK,MAAM,GAAG,CAAC;AAAA,UAC7C;AAAA,QACF;AAAA;AAAA,QAGA,wBAAyB;AACvB,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,yBAAyB;AAAA,UACjD,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,yBAAyB;AAAA,UACjD;AAAA,QACF;AAAA,QACA,4BAA6B;AAE3B,cAAI,KAAK,SAAS,aAAa;AAC7B,mBAAO,KAAK,KAAK,KAAK,cAAc,KAAK,kBAAkB;AAAA,UAC7D,WAAW,QAAQ,KAAK,IAAI,GAAG;AAC7B,iBAAK,QAAQ;AACb,gBAAI,KAAK,MAAM,IAAI,SAAS,EAAG,MAAK,KAAK,KAAK,kBAAkB;AAAA,UAClE,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACvD,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,UAC/C,WAAW,KAAK,SAAS,aAAa;AACpC,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,cAAc,KAAK,gBAAgB;AAAA,UAC3D,WAAW,KAAK,SAAS,aAAa;AACpC,mBAAO,KAAK,KAAK,KAAK,aAAa;AAAA,UACrC,WAAW,KAAK,SAAS,YAAY;AACnC,mBAAO,KAAK,KAAK,KAAK,iBAAiB;AAAA,UACzC,OAAO;AACL,mBAAO,KAAK,UAAU,QAAQ,KAAK,MAAM,GAAG,CAAC;AAAA,UAC/C;AAAA,QACF;AAAA,QACA,oBAAqB;AACnB,cAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC7B,gBAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,qBAAO,KAAK,QAAQ;AAAA,YACtB,WAAW,KAAK,SAAS,YAAY;AACnC,qBAAO,KAAK,KAAK,KAAK,iBAAiB;AAAA,YACzC,OAAO;AACL,oBAAM,KAAK,MAAM,IAAI,UAAU,kDAAkD,CAAC;AAAA,YACpF;AAAA,UACF,OAAO;AACL,gBAAI,KAAK,SAAS,aAAa;AAC7B,qBAAO,KAAK,KAAK,KAAK,aAAa;AAAA,YACrC,OAAO;AACL,oBAAM,KAAK,MAAM,IAAI,UAAU,qDAAqD,CAAC;AAAA,YACvF;AAAA,UACF;AAAA,QACF;AAAA,QACA,4BAA6B;AAC3B,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,8BAA8B,KAAK,eAAe;AAAA,UAC1E,WAAW,KAAK,SAAS,QAAQ;AAC/B,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,8BAA8B,KAAK,eAAe;AAAA,UAC1E,WAAW,KAAK,SAAS,QAAQ;AAC/B,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,8BAA8B,KAAK,eAAe;AAAA,UAC1E,WAAW,KAAK,SAAS,aAAa;AACpC,mBAAO,KAAK,KAAK,KAAK,kBAAkB;AAAA,UAC1C,WAAW,QAAQ,KAAK,IAAI,GAAG;AAC7B,mBAAO,KAAK,KAAK,KAAK,iBAAiB;AAAA,UACzC,OAAO;AACL,mBAAO,KAAK,UAAU,QAAQ,KAAK,MAAM,GAAG,CAAC;AAAA,UAC/C;AAAA,QACF;AAAA,QACA,kBAAmB;AACjB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,SAAS,aAAa;AACpC,mBAAO,KAAK,KAAK,KAAK,4BAA4B;AAAA,UACpD,OAAO;AACL,kBAAM,SAAS,QAAQ,KAAK,MAAM,GAAG;AAErC,gBAAI,OAAO,MAAM,GAAG;AAClB,oBAAM,KAAK,MAAM,IAAI,UAAU,gBAAgB,CAAC;AAAA,YAClD,OAAO;AACL,qBAAO,KAAK,UAAU,MAAM;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAAA,QACA,kBAAmB;AACjB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,SAAS,aAAa;AACpC,mBAAO,KAAK,KAAK,KAAK,4BAA4B;AAAA,UACpD,OAAO;AACL,kBAAM,SAAS,QAAQ,KAAK,MAAM,GAAG;AAErC,gBAAI,OAAO,MAAM,GAAG;AAClB,oBAAM,KAAK,MAAM,IAAI,UAAU,gBAAgB,CAAC;AAAA,YAClD,OAAO;AACL,qBAAO,KAAK,UAAU,MAAM;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAAA,QACA,kBAAmB;AACjB,cAAI,MAAM,KAAK,IAAI,GAAG;AACpB,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,SAAS,aAAa;AACpC,mBAAO,KAAK,KAAK,KAAK,4BAA4B;AAAA,UACpD,OAAO;AACL,kBAAM,SAAS,QAAQ,KAAK,MAAM,GAAG;AAErC,gBAAI,OAAO,MAAM,GAAG;AAClB,oBAAM,KAAK,MAAM,IAAI,UAAU,gBAAgB,CAAC;AAAA,YAClD,OAAO;AACL,qBAAO,KAAK,UAAU,MAAM;AAAA,YAC9B;AAAA,UACF;AAAA,QACF;AAAA;AAAA,QAGA,gBAAiB;AAEf,cAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC7B,kBAAM,KAAK,MAAM,IAAI,UAAU,6DAA6D,CAAC;AAAA,UAC/F;AACA,eAAK,MAAM,SAAS,KAAK,MAAM;AAC/B,eAAK,MAAM,MAAM;AACjB,iBAAO,KAAK,KAAK,KAAK,cAAc;AAAA,QACtC;AAAA,QACA,iBAAkB;AAChB,cAAI,KAAK,SAAS,aAAa;AAC7B,gBAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC7B,oBAAM,KAAK,MAAM,IAAI,UAAU,2DAA2D,CAAC;AAAA,YAC7F;AACA,iBAAK,MAAM,UAAU,MAAM,KAAK,MAAM;AACtC,iBAAK,MAAM,MAAM;AACjB,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,QAAQ,KAAK,IAAI,GAAG;AAC7B,iBAAK,QAAQ;AAAA,UACf,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,qBAAqB,CAAC;AAAA,UACvD;AAAA,QACF;AAAA,QACA,eAAgB;AACd,cAAI,KAAK,SAAS,UAAU,KAAK,SAAS,SAAS;AACjD,gBAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC7B,oBAAM,KAAK,MAAM,IAAI,UAAU,yDAAyD,CAAC;AAAA,YAC3F;AACA,iBAAK,MAAM,UAAU,MAAM,KAAK,MAAM;AACtC,iBAAK,MAAM,MAAM;AACjB,mBAAO,KAAK,KAAK,KAAK,kBAAkB;AAAA,UAC1C,WAAW,KAAK,YAAY,GAAG;AAC7B,mBAAO,KAAK,UAAU,WAAW,KAAK,MAAM,SAAS,MAAM,KAAK,MAAM,GAAG,CAAC;AAAA,UAC5E,WAAW,QAAQ,KAAK,IAAI,GAAG;AAC7B,iBAAK,QAAQ;AAAA,UACf,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,qBAAqB,CAAC;AAAA,UACvD;AAAA,QACF;AAAA,QACA,qBAAsB;AACpB,cAAI,KAAK,YAAY,GAAG;AACtB,mBAAO,KAAK,UAAU,WAAW,KAAK,MAAM,MAAM,CAAC;AAAA,UACrD,OAAO;AACL,mBAAO,KAAK,KAAK,KAAK,aAAa;AAAA,UACrC;AAAA,QACF;AAAA,QACA,gBAAiB;AACf,cAAI,KAAK,SAAS,YAAY;AAC5B,gBAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC7B,oBAAM,KAAK,MAAM,IAAI,UAAU,0DAA0D,CAAC;AAAA,YAC5F;AACA,iBAAK,MAAM,UAAU,MAAM,KAAK,MAAM;AACtC,iBAAK,MAAM,MAAM;AACjB,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,QAAQ,KAAK,IAAI,GAAG;AAC7B,iBAAK,QAAQ;AAAA,UACf,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,qBAAqB,CAAC;AAAA,UACvD;AAAA,QACF;AAAA,QACA,eAAgB;AACd,cAAI,KAAK,MAAM,IAAI,SAAS,KAAK,QAAQ,KAAK,IAAI,GAAG;AACnD,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,KAAK,SAAS,YAAY;AAClE,iBAAK,MAAM,UAAU,MAAM,KAAK,MAAM;AACtC,iBAAK,MAAM,MAAM;AACjB,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,qBAAqB,CAAC;AAAA,UACvD;AAAA,QACF;AAAA,QACA,eAAgB;AACd,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AACb,gBAAI,KAAK,MAAM,IAAI,WAAW,GAAG;AAC/B,mBAAK,MAAM,UAAU,MAAM,KAAK,MAAM;AACtC,mBAAK,MAAM,MAAM;AACjB,qBAAO,KAAK,KAAK,KAAK,uBAAuB;AAAA,YAC/C;AAAA,UACF,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,qBAAqB,CAAC;AAAA,UACvD;AAAA,QACF;AAAA,QAEA,oBAAqB;AAEnB,cAAI,KAAK,SAAS,YAAY;AAC5B,gBAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC7B,oBAAM,KAAK,MAAM,IAAI,UAAU,0DAA0D,CAAC;AAAA,YAC5F;AACA,iBAAK,MAAM,SAAS,KAAK,MAAM;AAC/B,iBAAK,MAAM,MAAM;AACjB,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iBAAiB,CAAC;AAAA,UACnD;AAAA,QACF;AAAA,QACA,mBAAoB;AAClB,cAAI,KAAK,MAAM,IAAI,SAAS,KAAK,QAAQ,KAAK,IAAI,GAAG;AACnD,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,KAAK,SAAS,YAAY;AAClE,iBAAK,MAAM,UAAU,MAAM,KAAK,MAAM;AACtC,iBAAK,MAAM,MAAM;AACjB,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iBAAiB,CAAC;AAAA,UACnD;AAAA,QACF;AAAA,QACA,mBAAoB;AAClB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AACb,gBAAI,KAAK,MAAM,IAAI,WAAW,GAAG;AAC/B,qBAAO,KAAK,KAAK,KAAK,0BAA0B;AAAA,YAClD;AAAA,UACF,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iBAAiB,CAAC;AAAA,UACnD;AAAA,QACF;AAAA,QACA,6BAA8B;AAC5B,eAAK,MAAM,UAAU,MAAM,KAAK,MAAM;AACtC,cAAI,KAAK,SAAS,aAAa;AAC7B,iBAAK,MAAM,MAAM;AACjB,iBAAK,KAAK,KAAK,qBAAqB;AAAA,UACtC,OAAO;AACL,mBAAO,KAAK,OAAO,WAAW,KAAK,MAAM,MAAM,CAAC;AAAA,UAClD;AAAA,QACF;AAAA,QACA,wBAAyB;AACvB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,YAAY,GAAG;AAC7B,gBAAI,KAAK,MAAM,IAAI,WAAW,EAAG,OAAM,KAAK,MAAM,IAAI,UAAU,gCAAgC,CAAC;AACjG,mBAAO,KAAK,UAAU,WAAW,KAAK,MAAM,SAAS,MAAM,KAAK,MAAM,GAAG,CAAC;AAAA,UAC5E,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iFAAiF,CAAC;AAAA,UACnH;AAAA,QACF;AAAA,QAEA,0BAA2B;AACzB,cAAI,KAAK,SAAS,aAAa;AAC7B,iBAAK,QAAQ;AACb,iBAAK,KAAK,KAAK,qBAAqB;AAAA,UACtC,WAAW,KAAK,SAAS,eAAe,KAAK,SAAS,WAAW;AAC/D,iBAAK,QAAQ;AACb,iBAAK,KAAK,KAAK,iBAAiB;AAAA,UAClC,WAAW,KAAK,SAAS,QAAQ;AAC/B,iBAAK,QAAQ;AACb,mBAAO,KAAK,OAAO,eAAe,KAAK,MAAM,SAAS,KAAK,MAAM,GAAG,CAAC;AAAA,UACvE,WAAW,KAAK,YAAY,GAAG;AAC7B,mBAAO,KAAK,UAAU,oBAAoB,KAAK,MAAM,SAAS,KAAK,MAAM,GAAG,CAAC;AAAA,UAC/E,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iFAAiF,CAAC;AAAA,UACnH;AAAA,QACF;AAAA,QACA,wBAAyB;AACvB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AAAA,UACf,WAAW,KAAK,MAAM,IAAI,WAAW,GAAG;AACtC,kBAAM,KAAK,MAAM,IAAI,UAAU,gCAAgC,CAAC;AAAA,UAClE,WAAW,KAAK,SAAS,eAAe,KAAK,SAAS,WAAW;AAC/D,iBAAK,QAAQ;AACb,iBAAK,KAAK,KAAK,iBAAiB;AAAA,UAClC,WAAW,KAAK,SAAS,QAAQ;AAC/B,iBAAK,QAAQ;AACb,mBAAO,KAAK,OAAO,eAAe,KAAK,MAAM,SAAS,KAAK,MAAM,GAAG,CAAC;AAAA,UACvE,WAAW,KAAK,YAAY,GAAG;AAC7B,mBAAO,KAAK,UAAU,oBAAoB,KAAK,MAAM,SAAS,KAAK,MAAM,GAAG,CAAC;AAAA,UAC/E,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,iFAAiF,CAAC;AAAA,UACnH;AAAA,QACF;AAAA,QACA,oBAAqB;AACnB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AAEb,gBAAI,QAAQ,KAAK,KAAK,MAAM,GAAG,EAAG,QAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UAC1E,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,kDAAkD,CAAC;AAAA,UACpF;AAAA,QACF;AAAA,QACA,mBAAoB;AAClB,cAAI,KAAK,SAAS,YAAY;AAC5B,iBAAK,QAAQ;AACb,iBAAK,KAAK,KAAK,gBAAgB;AAAA,UACjC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,kDAAkD,CAAC;AAAA,UACpF;AAAA,QACF;AAAA,QACA,mBAAoB;AAClB,cAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,iBAAK,QAAQ;AACb,gBAAI,QAAQ,KAAK,KAAK,MAAM,GAAG,EAAG,QAAO,KAAK,OAAO,eAAe,KAAK,MAAM,SAAS,KAAK,MAAM,GAAG,CAAC;AAAA,UACzG,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,kDAAkD,CAAC;AAAA,UACpF;AAAA,QACF;AAAA;AAAA,QAGA,eAAgB;AAEd,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,WAAW;AAAA,UACnC,WAAW,KAAK,SAAS,QAAQ;AAC/B,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC;AAAA,QACF;AAAA,QACA,cAAe;AACb,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,WAAW;AAAA,UACnC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yCAAyC,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA,QACA,cAAe;AACb,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,WAAW;AAAA,UACnC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yCAAyC,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA,QACA,cAAe;AACb,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO,KAAK,OAAO,IAAI;AAAA,UACzB,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yCAAyC,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA,QAEA,eAAgB;AACd,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yCAAyC,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA,QAEA,eAAgB;AACd,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yCAAyC,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA,QAEA,eAAgB;AACd,cAAI,KAAK,SAAS,QAAQ;AACxB,iBAAK,QAAQ;AACb,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yCAAyC,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA,QAEA,eAAgB;AACd,cAAI,KAAK,SAAS,QAAQ;AACxB,mBAAO,KAAK,OAAO,KAAK;AAAA,UAC1B,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,yCAAyC,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA;AAAA,QAGA,kBAAmB;AACjB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACjG,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,OAAO,KAAK;AACnC,kBAAM,KAAK,MAAM,IAAI,UAAU,2BAA2B,CAAC;AAAA,UAC7D,WAAW,KAAK,SAAS,UAAU;AACjC,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,OAAO,KAAK,MAAM,aAAa,WAAW,CAAC;AAAA,UACzD,OAAO;AACL,mBAAO,KAAK,QAAQ,KAAK,YAAY,KAAK,qBAAqB;AAAA,UACjE;AAAA,QACF;AAAA,QACA,sBAAuB,OAAO;AAC5B,cAAI,KAAK,MAAM,WAAW;AACxB,kBAAM,WAAW,KAAK,MAAM,UAAU,YAAY;AAClD,kBAAM,YAAY,SAAS,KAAK;AAChC,gBAAI,aAAa,WAAW;AAC1B,oBAAM,KAAK,MAAM,IAAI,UAAU,oDAAoD,QAAQ,QAAQ,SAAS,EAAE,CAAC;AAAA,YACjH;AAAA,UACF,OAAO;AACL,iBAAK,MAAM,YAAY,WAAW,SAAS,KAAK,CAAC;AAAA,UACnD;AACA,cAAI,QAAQ,KAAK,KAAK,UAAU,KAAK,GAAG;AAEtC,iBAAK,MAAM,UAAU,KAAK,MAAM,QAAQ,CAAC;AAAA,UAC3C,OAAO;AACL,iBAAK,MAAM,UAAU,KAAK,KAAK;AAAA,UACjC;AACA,iBAAO,KAAK,KAAK,KAAK,mBAAmB;AAAA,QAC3C;AAAA,QACA,sBAAuB;AACrB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,UAAU,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AACjG,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,UAAU;AACjC,mBAAO,KAAK,KAAK,KAAK,YAAY;AAAA,UACpC,WAAW,KAAK,SAAS,YAAY;AACnC,mBAAO,KAAK,KAAK,KAAK,eAAe;AAAA,UACvC,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,KAAK,KAAK,eAAe;AAAA,UACvC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,wEAAwE,CAAC;AAAA,UAC1G;AAAA,QACF;AAAA;AAAA,QAGA,mBAAoB;AAClB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,OAAO,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AAC7G,kBAAM,KAAK,MAAM,IAAI,UAAU,2BAA2B,CAAC;AAAA,UAC7D,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,OAAO,KAAK,MAAM,eAAe,YAAY,CAAC;AAAA,UAC5D,OAAO;AACL,gBAAI,CAAC,KAAK,MAAM,YAAa,MAAK,MAAM,cAAc,YAAY;AAClE,mBAAO,KAAK,QAAQ,KAAK,aAAa,KAAK,sBAAsB;AAAA,UACnE;AAAA,QACF;AAAA,QACA,uBAAwB,IAAI;AAC1B,cAAI,SAAS,KAAK,MAAM;AACxB,cAAI,WAAW,GAAG,IAAI,IAAI;AAC1B,mBAAS,MAAM,GAAG,KAAK;AACrB,gBAAI,OAAO,QAAQ,EAAE,MAAM,CAAC,QAAQ,OAAO,EAAE,CAAC,KAAK,OAAO,EAAE,EAAE,SAAS,IAAI;AACzE,oBAAM,KAAK,MAAM,IAAI,UAAU,6BAA6B,CAAC;AAAA,YAC/D;AACA,qBAAS,OAAO,EAAE,IAAI,OAAO,EAAE,KAAK,MAAM;AAAA,UAC5C;AACA,cAAI,OAAO,QAAQ,QAAQ,GAAG;AAC5B,kBAAM,KAAK,MAAM,IAAI,UAAU,6BAA6B,CAAC;AAAA,UAC/D;AACA,cAAI,UAAU,GAAG,KAAK,KAAK,QAAQ,GAAG,KAAK,GAAG;AAC5C,mBAAO,QAAQ,IAAI,GAAG,MAAM,QAAQ;AAAA,UACtC,OAAO;AACL,mBAAO,QAAQ,IAAI,GAAG;AAAA,UACxB;AACA,iBAAO,KAAK,KAAK,KAAK,oBAAoB;AAAA,QAC5C;AAAA,QACA,uBAAwB;AACtB,cAAI,KAAK,SAAS,WAAW,KAAK,SAAS,QAAQ;AACjD,mBAAO;AAAA,UACT,WAAW,KAAK,SAAS,OAAO,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,UAAU,KAAK,SAAS,QAAQ;AAC7G,kBAAM,KAAK,MAAM,IAAI,UAAU,2BAA2B,CAAC;AAAA,UAC7D,WAAW,KAAK,SAAS,YAAY;AACnC,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC,WAAW,KAAK,SAAS,WAAW;AAClC,mBAAO,KAAK,KAAK,KAAK,gBAAgB;AAAA,UACxC,OAAO;AACL,kBAAM,KAAK,MAAM,IAAI,UAAU,wEAAwE,CAAC;AAAA,UAC1G;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA;AAAA;;;ACl2CA;AAAA,8FAAAC,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU;AAEjB,aAAS,YAAa,KAAK,KAAK;AAE9B,UAAI,IAAI,OAAO,QAAQ,IAAI,QAAQ,KAAM,QAAO;AAChD,UAAI,MAAM,IAAI;AACd,aAAO,WAAW,IAAI,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;AAAA;AAGlE,UAAI,OAAO,IAAI,OAAO;AACpB,cAAM,QAAQ,IAAI,MAAM,IAAI;AAC5B,cAAM,eAAe,OAAO,KAAK,IAAI,MAAM,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE;AAClE,YAAI,cAAc;AAClB,eAAO,YAAY,SAAS,aAAc,gBAAe;AACzD,iBAAS,KAAK,KAAK,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI;AACxF,cAAI,UAAU,OAAO,KAAK,CAAC;AAC3B,cAAI,QAAQ,SAAS,aAAc,WAAU,MAAM;AACnD,cAAI,IAAI,SAAS,IAAI;AACnB,mBAAO,UAAU,OAAO,MAAM,EAAE,IAAI;AACpC,mBAAO,cAAc;AACrB,qBAAS,KAAK,GAAG,KAAK,IAAI,KAAK,EAAE,IAAI;AACnC,qBAAO;AAAA,YACT;AACA,mBAAO;AAAA,UACT,OAAO;AACL,mBAAO,UAAU,OAAO,MAAM,EAAE,IAAI;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AACA,UAAI,UAAU,MAAM;AACpB,aAAO;AAAA,IACT;AAAA;AAAA;;;AChCA;AAAA,wFAAAC,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU;AAEjB,QAAM,aAAa;AACnB,QAAM,cAAc;AAEpB,aAAS,YAAa,KAAK;AACzB,UAAI,OAAO,UAAU,OAAO,OAAO,SAAS,GAAG,GAAG;AAChD,cAAM,IAAI,SAAS,MAAM;AAAA,MAC3B;AACA,YAAM,SAAS,IAAI,WAAW;AAC9B,UAAI;AACF,eAAO,MAAM,GAAG;AAChB,eAAO,OAAO,OAAO;AAAA,MACvB,SAAS,KAAK;AACZ,cAAM,YAAY,KAAK,GAAG;AAAA,MAC5B;AAAA,IACF;AAAA;AAAA;;;ACjBA;AAAA,uFAAAC,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU;AAEjB,QAAM,aAAa;AACnB,QAAM,cAAc;AAEpB,aAAS,WAAY,KAAK,MAAM;AAC9B,UAAI,CAAC,KAAM,QAAO,CAAC;AACnB,YAAM,QAAQ;AACd,YAAM,YAAY,KAAK,aAAa;AACpC,YAAM,SAAS,IAAI,WAAW;AAC9B,aAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,qBAAa,gBAAgB,OAAO,WAAWA,UAAS,MAAM;AAAA,MAChE,CAAC;AACD,eAAS,eAAgBC,QAAOC,YAAWF,UAAS,QAAQ;AAC1D,YAAIC,UAAS,IAAI,QAAQ;AACvB,cAAI;AACF,mBAAOD,SAAQ,OAAO,OAAO,CAAC;AAAA,UAChC,SAAS,KAAK;AACZ,mBAAO,OAAO,YAAY,KAAK,GAAG,CAAC;AAAA,UACrC;AAAA,QACF;AACA,YAAI;AACF,iBAAO,MAAM,IAAI,MAAMC,QAAOA,SAAQC,UAAS,CAAC;AAChD,uBAAa,gBAAgBD,SAAQC,YAAWA,YAAWF,UAAS,MAAM;AAAA,QAC5E,SAAS,KAAK;AACZ,iBAAO,YAAY,KAAK,GAAG,CAAC;AAAA,QAC9B;AAAA,MACF;AAAA,IACF;AAAA;AAAA;;;AC7BA;AAAA,wFAAAG,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU;AAEjB,QAAM,SAAS,QAAQ,QAAQ;AAC/B,QAAM,aAAa;AAEnB,aAAS,YAAa,KAAK;AACzB,UAAI,KAAK;AACP,eAAO,cAAc,GAAG;AAAA,MAC1B,OAAO;AACL,eAAO,eAAe,GAAG;AAAA,MAC3B;AAAA,IACF;AAEA,aAAS,cAAe,KAAK;AAC3B,YAAM,SAAS,IAAI,WAAW;AAC9B,UAAI,YAAY,MAAM;AACtB,aAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,YAAI;AACJ,YAAI,QAAQ;AACZ,YAAI,UAAU;AACd,iBAAS,SAAU;AACjB,kBAAQ;AACR,cAAI,SAAU;AACd,cAAI;AACF,YAAAA,SAAQ,OAAO,OAAO,CAAC;AAAA,UACzB,SAAS,KAAK;AACZ,mBAAO,GAAG;AAAA,UACZ;AAAA,QACF;AACA,iBAAS,MAAO,KAAK;AACnB,oBAAU;AACV,iBAAO,GAAG;AAAA,QACZ;AACA,YAAI,KAAK,OAAO,MAAM;AACtB,YAAI,KAAK,SAAS,KAAK;AACvB,iBAAS;AAET,iBAAS,WAAY;AACnB,qBAAW;AACX,cAAI;AACJ,kBAAQ,OAAO,IAAI,KAAK,OAAO,MAAM;AACnC,gBAAI;AACF,qBAAO,MAAM,IAAI;AAAA,YACnB,SAAS,KAAK;AACZ,qBAAO,MAAM,GAAG;AAAA,YAClB;AAAA,UACF;AACA,qBAAW;AAEX,cAAI,MAAO,QAAO,OAAO;AAEzB,cAAI,QAAS;AACb,cAAI,KAAK,YAAY,QAAQ;AAAA,QAC/B;AAAA,MACF,CAAC;AAAA,IACH;AAEA,aAAS,iBAAkB;AACzB,YAAM,SAAS,IAAI,WAAW;AAC9B,aAAO,IAAI,OAAO,UAAU;AAAA,QAC1B,YAAY;AAAA,QACZ,UAAW,OAAO,UAAU,IAAI;AAC9B,cAAI;AACF,mBAAO,MAAM,MAAM,SAAS,QAAQ,CAAC;AAAA,UACvC,SAAS,KAAK;AACZ,iBAAK,KAAK,SAAS,GAAG;AAAA,UACxB;AACA,aAAG;AAAA,QACL;AAAA,QACA,MAAO,IAAI;AACT,cAAI;AACF,iBAAK,KAAK,OAAO,OAAO,CAAC;AAAA,UAC3B,SAAS,KAAK;AACZ,iBAAK,KAAK,SAAS,GAAG;AAAA,UACxB;AACA,aAAG;AAAA,QACL;AAAA,MACF,CAAC;AAAA,IACH;AAAA;AAAA;;;AC/EA;AAAA,iFAAAC,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU;AACjB,IAAAA,QAAO,QAAQ,QAAQ;AACvB,IAAAA,QAAO,QAAQ,SAAS;AACxB,IAAAA,QAAO,QAAQ,cAAc;AAAA;AAAA;;;ACJ7B;AAAA,qFAAAC,UAAAC,SAAA;AAAA;AACA,IAAAA,QAAO,UAAU;AACjB,IAAAA,QAAO,QAAQ,QAAQ;AAEvB,aAAS,UAAW,KAAK;AACvB,UAAI,QAAQ,KAAM,OAAM,UAAU,MAAM;AACxC,UAAI,QAAQ,OAAU,OAAM,UAAU,WAAW;AACjD,UAAI,OAAO,QAAQ,SAAU,OAAM,UAAU,OAAO,GAAG;AAEvD,UAAI,OAAO,IAAI,WAAW,WAAY,OAAM,IAAI,OAAO;AACvD,UAAI,OAAO,KAAM,QAAO;AACxB,YAAM,OAAOC,UAAS,GAAG;AACzB,UAAI,SAAS,QAAS,OAAM,UAAU,IAAI;AAC1C,aAAO,gBAAgB,IAAI,IAAI,GAAG;AAAA,IACpC;AAEA,aAAS,UAAW,MAAM;AACxB,aAAO,IAAI,MAAM,qCAAqC,IAAI;AAAA,IAC5D;AAEA,aAAS,oBAAqB;AAC5B,aAAO,IAAI,MAAM,qCAAqC;AAAA,IACxD;AAEA,aAAS,cAAe,KAAK;AAC3B,aAAO,OAAO,KAAK,GAAG,EAAE,OAAO,SAAO,SAAS,IAAI,GAAG,CAAC,CAAC;AAAA,IAC1D;AACA,aAAS,eAAgB,KAAK;AAC5B,aAAO,OAAO,KAAK,GAAG,EAAE,OAAO,SAAO,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;AAAA,IAC3D;AAEA,aAAS,OAAQ,KAAK;AACpB,UAAI,OAAO,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,OAAO,UAAU,eAAe,KAAK,KAAK,WAAW,IAAI,EAAC,CAAC,WAAW,GAAG,OAAS,IAAI,CAAC;AAC5H,eAAS,QAAQ,OAAO,KAAK,GAAG,GAAG;AACjC,YAAI,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,EAAE,WAAW,cAAc,EAAE,iBAAiB,IAAI,IAAI,IAAI;AACxF,eAAK,IAAI,IAAI,IAAI,IAAI,EAAE,OAAO;AAAA,QAChC,OAAO;AACL,eAAK,IAAI,IAAI,IAAI,IAAI;AAAA,QACvB;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAEA,aAAS,gBAAiB,QAAQ,QAAQ,KAAK;AAC7C,YAAM,OAAO,GAAG;AAChB,UAAI;AACJ,UAAI;AACJ,mBAAa,cAAc,GAAG;AAC9B,oBAAc,eAAe,GAAG;AAChC,UAAI,SAAS,CAAC;AACd,UAAI,eAAe,UAAU;AAC7B,iBAAW,QAAQ,SAAO;AACxB,YAAI,OAAOA,UAAS,IAAI,GAAG,CAAC;AAC5B,YAAI,SAAS,eAAe,SAAS,QAAQ;AAC3C,iBAAO,KAAK,eAAe,aAAa,GAAG,IAAI,QAAQ,mBAAmB,IAAI,GAAG,GAAG,IAAI,CAAC;AAAA,QAC3F;AAAA,MACF,CAAC;AACD,UAAI,OAAO,SAAS,EAAG,QAAO,KAAK,EAAE;AACrC,UAAI,gBAAgB,UAAU,WAAW,SAAS,IAAI,SAAS,OAAO;AACtE,kBAAY,QAAQ,SAAO;AACzB,eAAO,KAAK,iBAAiB,QAAQ,eAAe,KAAK,IAAI,GAAG,CAAC,CAAC;AAAA,MACpE,CAAC;AACD,aAAO,OAAO,KAAK,IAAI;AAAA,IACzB;AAEA,aAAS,SAAU,OAAO;AACxB,cAAQA,UAAS,KAAK,GAAG;AAAA,QACvB,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AACH,iBAAO;AAAA,QACT,KAAK;AACH,iBAAO,MAAM,WAAW,KAAKA,UAAS,MAAM,CAAC,CAAC,MAAM;AAAA,QACtD,KAAK;AACH,iBAAO,OAAO,KAAK,KAAK,EAAE,WAAW;AAAA;AAAA,QAEvC;AACE,iBAAO;AAAA,MACX;AAAA,IACF;AAEA,aAASA,UAAU,OAAO;AACxB,UAAI,UAAU,QAAW;AACvB,eAAO;AAAA,MACT,WAAW,UAAU,MAAM;AACzB,eAAO;AAAA,MAET,WAAW,OAAO,UAAU,YAAa,OAAO,UAAU,KAAK,KAAK,CAAC,OAAO,GAAG,OAAO,EAAE,GAAI;AAC1F,eAAO;AAAA,MACT,WAAW,OAAO,UAAU,UAAU;AACpC,eAAO;AAAA,MACT,WAAW,OAAO,UAAU,WAAW;AACrC,eAAO;AAAA,MACT,WAAW,OAAO,UAAU,UAAU;AACpC,eAAO;AAAA,MACT,WAAW,iBAAiB,OAAO;AACjC,eAAO,MAAM,KAAK,IAAI,cAAc;AAAA,MACtC,WAAW,MAAM,QAAQ,KAAK,GAAG;AAC/B,eAAO;AAAA,MACT,OAAO;AACL,eAAO;AAAA,MACT;AAAA,IACF;AAEA,aAAS,aAAc,KAAK;AAC1B,UAAI,SAAS,OAAO,GAAG;AACvB,UAAI,mBAAmB,KAAK,MAAM,GAAG;AACnC,eAAO;AAAA,MACT,OAAO;AACL,eAAO,qBAAqB,MAAM;AAAA,MACpC;AAAA,IACF;AAEA,aAAS,qBAAsB,KAAK;AAClC,aAAO,MAAM,aAAa,GAAG,EAAE,QAAQ,MAAM,KAAK,IAAI;AAAA,IACxD;AAEA,aAAS,uBAAwB,KAAK;AACpC,aAAO,MAAM,MAAM;AAAA,IACrB;AAEA,aAAS,OAAQ,KAAK,KAAK;AACzB,aAAO,IAAI,SAAS,IAAK,OAAM,MAAM;AACrC,aAAO;AAAA,IACT;AAEA,aAAS,aAAc,KAAK;AAC1B,aAAO,IAAI,QAAQ,OAAO,MAAM,EAC7B,QAAQ,SAAS,KAAK,EACtB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EAEpB,QAAQ,2BAA2B,OAAK,QAAQ,OAAO,GAAG,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AAAA,IAE7F;AAEA,aAAS,yBAA0B,KAAK;AACtC,UAAI,UAAU,IAAI,MAAM,IAAI,EAAE,IAAI,CAAAC,SAAO;AACvC,eAAO,aAAaA,IAAG,EAAE,QAAQ,YAAY,KAAK;AAAA,MACpD,CAAC,EAAE,KAAK,IAAI;AACZ,UAAI,QAAQ,MAAM,EAAE,MAAM,IAAK,YAAW;AAC1C,aAAO,UAAU,UAAU;AAAA,IAC7B;AAEA,aAAS,mBAAoB,OAAO,aAAa;AAC/C,UAAI,OAAOD,UAAS,KAAK;AACzB,UAAI,SAAS,UAAU;AACrB,YAAI,eAAe,KAAK,KAAK,KAAK,GAAG;AACnC,iBAAO;AAAA,QACT,WAAW,CAAC,gBAAgB,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,GAAG;AAC1D,iBAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO,gBAAgB,OAAO,IAAI;AAAA,IACpC;AAEA,aAAS,gBAAiB,OAAO,MAAM;AAErC,UAAI,CAAC,KAAM,QAAOA,UAAS,KAAK;AAChC,cAAQ,MAAM;AAAA,QACZ,KAAK;AACH,iBAAO,yBAAyB,KAAK;AAAA,QACvC,KAAK;AACH,iBAAO,qBAAqB,KAAK;AAAA,QACnC,KAAK;AACH,iBAAO,uBAAuB,KAAK;AAAA,QACrC,KAAK;AACH,iBAAO,iBAAiB,KAAK;AAAA,QAC/B,KAAK;AACH,iBAAO,eAAe,KAAK;AAAA,QAC7B,KAAK;AACH,iBAAO,iBAAiB,KAAK;AAAA,QAC/B,KAAK;AACH,iBAAO,kBAAkB,KAAK;AAAA,QAChC,KAAK;AACH,iBAAO,qBAAqB,MAAM,OAAO,OAAKA,UAAS,CAAC,MAAM,UAAUA,UAAS,CAAC,MAAM,eAAeA,UAAS,CAAC,MAAM,KAAK,CAAC;AAAA,QAC/H,KAAK;AACH,iBAAO,qBAAqB,KAAK;AAAA;AAAA,QAEnC;AACE,gBAAM,UAAU,IAAI;AAAA,MACxB;AAAA,IACF;AAEA,aAAS,iBAAkB,OAAO;AAEhC,aAAO,OAAO,KAAK,EAAE,QAAQ,yBAAyB,GAAG;AAAA,IAC3D;AAEA,aAAS,eAAgB,OAAO;AAC9B,UAAI,UAAU,UAAU;AACtB,eAAO;AAAA,MACT,WAAW,UAAU,WAAW;AAC9B,eAAO;AAAA,MACT,WAAW,OAAO,GAAG,OAAO,GAAG,GAAG;AAChC,eAAO;AAAA,MACT,WAAW,OAAO,GAAG,OAAO,EAAE,GAAG;AAC/B,eAAO;AAAA,MACT;AACA,UAAI,SAAS,OAAO,KAAK,EAAE,MAAM,GAAG;AACpC,UAAI,MAAM,OAAO,CAAC;AAClB,UAAI,MAAM,OAAO,CAAC,KAAK;AACvB,aAAO,iBAAiB,GAAG,IAAI,MAAM;AAAA,IACvC;AAEA,aAAS,iBAAkB,OAAO;AAChC,aAAO,OAAO,KAAK;AAAA,IACrB;AAEA,aAAS,kBAAmB,OAAO;AACjC,aAAO,MAAM,YAAY;AAAA,IAC3B;AAEA,aAAS,SAAU,MAAM;AACvB,aAAO,SAAS,WAAW,SAAS;AAAA,IACtC;AACA,aAAS,UAAW,QAAQ;AAC1B,UAAI,cAAcA,UAAS,OAAO,CAAC,CAAC;AACpC,UAAI,OAAO,MAAM,OAAKA,UAAS,CAAC,MAAM,WAAW,EAAG,QAAO;AAE3D,UAAI,OAAO,MAAM,OAAK,SAASA,UAAS,CAAC,CAAC,CAAC,EAAG,QAAO;AACrD,aAAO;AAAA,IACT;AACA,aAAS,cAAe,QAAQ;AAC9B,YAAM,OAAO,UAAU,MAAM;AAC7B,UAAI,SAAS,SAAS;AACpB,cAAM,kBAAkB;AAAA,MAC1B;AACA,aAAO;AAAA,IACT;AAEA,aAAS,qBAAsB,QAAQ;AACrC,eAAS,OAAO,MAAM;AACtB,YAAM,OAAO,cAAc,MAAM;AACjC,UAAI,SAAS;AACb,UAAI,cAAc,OAAO,IAAI,OAAK,gBAAgB,GAAG,IAAI,CAAC;AAC1D,UAAI,YAAY,KAAK,IAAI,EAAE,SAAS,MAAM,KAAK,KAAK,WAAW,GAAG;AAChE,kBAAU,SAAS,YAAY,KAAK,OAAO,IAAI;AAAA,MACjD,OAAO;AACL,kBAAU,MAAM,YAAY,KAAK,IAAI,KAAK,YAAY,SAAS,IAAI,MAAM;AAAA,MAC3E;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,aAAS,qBAAsB,OAAO;AACpC,cAAQ,OAAO,KAAK;AACpB,UAAI,SAAS,CAAC;AACd,aAAO,KAAK,KAAK,EAAE,QAAQ,SAAO;AAChC,eAAO,KAAK,aAAa,GAAG,IAAI,QAAQ,mBAAmB,MAAM,GAAG,GAAG,KAAK,CAAC;AAAA,MAC/E,CAAC;AACD,aAAO,OAAO,OAAO,KAAK,IAAI,KAAK,OAAO,SAAS,IAAI,MAAM,MAAM;AAAA,IACrE;AAEA,aAAS,iBAAkB,QAAQ,QAAQ,KAAK,OAAO;AACrD,UAAI,YAAYA,UAAS,KAAK;AAE9B,UAAI,cAAc,SAAS;AACzB,eAAO,uBAAuB,QAAQ,QAAQ,KAAK,KAAK;AAAA,MAC1D,WAAW,cAAc,SAAS;AAChC,eAAO,sBAAsB,QAAQ,QAAQ,KAAK,KAAK;AAAA,MACzD,OAAO;AACL,cAAM,UAAU,SAAS;AAAA,MAC3B;AAAA,IACF;AAEA,aAAS,uBAAwB,QAAQ,QAAQ,KAAK,QAAQ;AAC5D,eAAS,OAAO,MAAM;AACtB,oBAAc,MAAM;AACpB,UAAI,iBAAiBA,UAAS,OAAO,CAAC,CAAC;AAEvC,UAAI,mBAAmB,QAAS,OAAM,UAAU,cAAc;AAC9D,UAAI,UAAU,SAAS,aAAa,GAAG;AACvC,UAAI,SAAS;AACb,aAAO,QAAQ,WAAS;AACtB,YAAI,OAAO,SAAS,EAAG,WAAU;AACjC,kBAAU,SAAS,OAAO,UAAU;AACpC,kBAAU,gBAAgB,UAAU,KAAK,QAAQ,KAAK;AAAA,MACxD,CAAC;AACD,aAAO;AAAA,IACT;AAEA,aAAS,sBAAuB,QAAQ,QAAQ,KAAK,OAAO;AAC1D,UAAI,UAAU,SAAS,aAAa,GAAG;AACvC,UAAI,SAAS;AACb,UAAI,cAAc,KAAK,EAAE,SAAS,GAAG;AACnC,kBAAU,SAAS,MAAM,UAAU;AAAA,MACrC;AACA,aAAO,SAAS,gBAAgB,UAAU,KAAK,QAAQ,KAAK;AAAA,IAC9D;AAAA;AAAA;;;ACvSA;AAAA,gFAAAE,UAAA;AAAA;AACA,IAAAA,SAAQ,QAAQ;AAChB,IAAAA,SAAQ,YAAY;AAAA;AAAA;;;ACFpB,IAAAC,mBAAyD;AACzD,IAAAC,qBAAqB;;;ACDrB,qBAAsC;AACtC,qBAAwB;AACxB,uBAAqB;AAErB,SAAS,SAAkB;AACzB,SACE,QAAQ,aAAa,WACrB,OAAO,QAAQ,WAAW,cAC1B,QAAQ,OAAO,MAAM;AAEzB;AAEA,IAAM,eAAW,2BAAK,wBAAQ,GAAG,cAAc;AAE/C,IAAM,eAAe;AAAA,EACnB,MAAM;AAAA,EACN,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AACV;AAEA,IAAM,aAAa;AAAA,EACjB,MAAM;AAAA,EACN,WAAW;AAAA,EACX,gBAAY,uBAAK,UAAU,mBAAmB;AAAA,EAC9C,WAAO,uBAAK,UAAU,qBAAqB;AAAA,EAC3C,eAAW,uBAAK,UAAU,SAAS;AAAA,EACnC,YAAQ,uBAAK,UAAU,MAAM;AAAA,EAC7B,aAAS,uBAAK,UAAU,QAAQ,kBAAkB;AAAA,EAClD,cAAU,uBAAK,UAAU,OAAO;AAAA,EAChC,aAAS,uBAAK,UAAU,SAAS,UAAU;AAAA,EAC3C,YAAQ,uBAAK,UAAU,KAAK;AAAA,EAC5B,aAAS,uBAAK,UAAU,OAAO,kBAAkB;AAAA,EACjD,YAAQ,uBAAK,UAAU,OAAO,mBAAmB;AACnD;AAQO,IAAM,QAAQ,OAAO,IAAI,eAAe;AAYxC,SAAS,oBAA0B;AACxC,aAAW,OAAO,CAAC,MAAM,WAAW,MAAM,OAAO,MAAM,WAAW,MAAM,QAAQ,MAAM,UAAU,MAAM,MAAM,GAAG;AAC7G,QAAI;AACF,oCAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,IACpC,QAAQ;AAAA,IAER;AAAA,EACF;AACF;;;ACtEA,IAAAC,kBAAoE;AAG7D,SAAS,eAAqB;AACnC,oBAAkB;AAClB,qCAAc,MAAM,SAAS,OAAO,QAAQ,GAAG,GAAG,OAAO;AAC3D;AAEO,SAAS,cAA6B;AAC3C,MAAI,KAAC,4BAAW,MAAM,OAAO,EAAG,QAAO;AACvC,QAAM,UAAM,8BAAa,MAAM,SAAS,OAAO,EAAE,KAAK;AACtD,QAAM,MAAM,SAAS,KAAK,EAAE;AAC5B,SAAO,OAAO,SAAS,GAAG,IAAI,MAAM;AACtC;AAEO,SAAS,gBAAsB;AACpC,MAAI;AACF,YAAI,4BAAW,MAAM,OAAO,EAAG,iCAAW,MAAM,OAAO;AAAA,EACzD,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,eAAe,KAAsB;AACnD,MAAI;AACF,YAAQ,KAAK,KAAK,CAAC;AACnB,WAAO;AAAA,EACT,SAAS,KAAK;AAIZ,UAAM,OAAQ,IAA8B;AAC5C,WAAO,SAAS;AAAA,EAClB;AACF;AAEO,SAAS,oBAAmC;AACjD,QAAM,MAAM,YAAY;AACxB,MAAI,OAAO,eAAe,GAAG,EAAG,QAAO;AACvC,MAAI,IAAK,eAAc;AACvB,SAAO;AACT;;;ACzCA,sBAA6C;AAC7C,IAAAC,kBAAuC;;;ACDvC,yBAA6C;AAC7C,IAAAC,kBAAmE;AACnE,IAAAC,oBAAqB;AAgBd,IAAM,yBAAqB,wBAAK,MAAM,QAAQ,eAAe;AAG7D,SAAS,oBAA4B;AAC1C,QAAM,YAAQ,gCAAY,EAAE,EAAE,SAAS,KAAK;AAC5C,qCAAc,oBAAoB,OAAO,EAAE,MAAM,IAAM,CAAC;AACxD,MAAI;AACF,mCAAU,oBAAoB,GAAK;AAAA,EACrC,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAcO,SAAS,YAAY,UAAkB,UAA4B;AACxE,MAAI,OAAO,aAAa,YAAY,CAAC,SAAU,QAAO;AACtD,QAAM,IAAI,OAAO,KAAK,QAAQ;AAC9B,QAAM,IAAI,OAAO,KAAK,QAAQ;AAC9B,SAAO,EAAE,WAAW,EAAE,cAAU,oCAAgB,GAAG,CAAC;AACtD;;;ACjDA,yBAA6B;AAStB,IAAM,WAAN,cAAuB,gCAAa;AAAA,EACzC,QAAQ,OAA0B;AAChC,SAAK,KAAK,SAAS,KAAK;AACxB,QAAI,MAAM,aAAa,UAAU,MAAM,aAAa,YAAY;AAC9D,WAAK,KAAK,SAAS,KAAK;AAAA,IAC1B;AAAA,EACF;AAAA,EAEA,eAAe,MAAc,QAAgB,QAAuB;AAClE,SAAK,KAAK,UAAU,EAAE,MAAM,QAAQ,OAAO,CAAC;AAAA,EAC9C;AACF;AAEO,IAAM,MAAM,IAAI,SAAS;AAChC,IAAI,gBAAgB,EAAE;;;ACvBtB,4BAAqB;AAGrB,IAAI,KAA+B;AACnC,IAAI,gBAAgB;AAEb,SAAS,qBAA8B;AAC5C,SAAO,OAAO;AAChB;AAEO,SAAS,YAAY,SAAiB,iCAAoD;AAC/F,MAAI,GAAI,QAAO;AACf,MAAI,eAAe;AACjB,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,MAAI;AACF,QAAI;AACF,WAAK,IAAI,sBAAAC,QAAS,MAAM;AAAA,IAC1B,QAAQ;AAEN,WAAK,IAAI,sBAAAA,QAAS,UAAU;AAAA,IAC9B;AAAA,EACF,SAAS,KAAK;AAGZ,oBAAgB;AAChB,UAAM;AAAA,EACR;AAEA,KAAG,OAAO,oBAAoB;AAE9B,KAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GA6BP;AAED,SAAO;AACT;AAEO,SAAS,YAAY,OAA4B;AACtD,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,OAAO,SAAS,QAAQ;AAAA;AAAA;AAAA,GAG7B;AACD,QAAM,SAAS,KAAK;AAAA,IAClB,MAAM,UAAU,YAAY;AAAA,IAC5B,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM,aAAa;AAAA,IACnB,MAAM,UAAU,KAAK,UAAU,MAAM,OAAO,IAAI;AAAA,EAClD;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,QAAkC;AACzC,MAAI,GAAI,QAAO;AACf,MAAI,cAAe,QAAO;AAC1B,MAAI;AACF,WAAO,YAAY;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,QAAgB,IAAmB;AACjE,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,SAAU,QAAO,CAAC;AACvB,QAAM,OAAO,SAAS,QAAQ;AAAA;AAAA,GAE7B,EAAE,IAAI,KAAK;AACZ,SAAO,KAAK,IAAI,UAAU;AAC5B;AAEO,SAAS,cAAc,OAAsB;AAClD,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,OAAO;AACT,WAAQ,SAAS,QAAQ,2DAA2D,EACjF,IAAI,MAAM,YAAY,CAAC,EAAU;AAAA,EACtC;AACA,SAAQ,SAAS,QAAQ,sCAAsC,EAAE,IAAI,EAAU;AACjF;AAEO,SAAS,eAAe,OAAsB;AACnD,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,aAAa;AACnB,MAAI,OAAO;AACT,WAAQ,SAAS;AAAA,MACf,0DAA0D,UAAU;AAAA,IACtE,EAAE,IAAI,MAAM,YAAY,CAAC,EAAU;AAAA,EACrC;AACA,SAAQ,SAAS;AAAA,IACf,0DAA0D,UAAU;AAAA,EACtE,EAAE,IAAI,EAAU;AAClB;AAEO,SAAS,cAAc,QAAgB,IAA0C;AACtF,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,SAAU,QAAO,CAAC;AACvB,SAAO,SAAS,QAAQ;AAAA;AAAA;AAAA;AAAA,GAIvB,EAAE,IAAI,KAAK;AACd;AAEO,SAAS,eAAeC,SAAgB,KAAsB;AACnE,QAAM,WAAW,MAAM,YAAY;AACnC,QAAM,MAAM,SAAS,QAAQ,6DAA6D,EACvF,IAAIA,SAAQ,GAAG;AAClB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,WAAO,KAAK,MAAM,IAAI,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO,IAAI;AAAA,EACb;AACF;AAEO,SAAS,eAAeA,SAAgB,KAAa,OAAsB;AAChF,QAAM,WAAW,MAAM,YAAY;AACnC,WAAS,QAAQ;AAAA;AAAA,GAEhB,EAAE,IAAIA,SAAQ,KAAK,KAAK,UAAU,KAAK,CAAC;AAC3C;AAEA,SAAS,WAAW,KAAuB;AACzC,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,WAAW,IAAI,KAAK,IAAI,SAAS;AAAA,IACjC,QAAQ,IAAI;AAAA,IACZ,UAAU,IAAI;AAAA,IACd,UAAU,IAAI;AAAA,IACd,SAAS,IAAI;AAAA,IACb,WAAW,IAAI;AAAA,IACf,SAAS,IAAI,UAAU,KAAK,MAAM,IAAI,OAAO,IAAI;AAAA,EACnD;AACF;AAEO,SAAS,UAAgB;AAC9B,MAAI,IAAI;AACN,OAAG,MAAM;AACT,SAAK;AAAA,EACP;AACF;;;AHzJO,IAAM,YAAN,MAAgB;AAAA,EAQrB,YACU,SACA,YACR;AAFQ;AACA;AAER,QAAI,GAAG,SAAS,CAAC,UAAuB;AACtC,WAAK,SAAS;AACd,UAAI,MAAM,aAAa,YAAY,MAAM,aAAa,UAAU,MAAM,aAAa,YAAY;AAC7F,aAAK,SAAS;AAAA,MAChB;AACA,WAAK,UAAU,EAAE,MAAM,SAAS,SAAS,MAAM,GAAG,OAAO;AAAA,IAC3D,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AACpB,WAAK,SAAS;AAAA,IAChB,CAAC;AACD,QAAI,GAAG,UAAU,CAAC,SAAS;AACzB,WAAK,UAAU,EAAE,MAAM,UAAU,SAAS,KAAK,GAAG,QAAQ;AAAA,IAC5D,CAAC;AAAA,EACH;AAAA,EAhBU;AAAA,EACA;AAAA,EATF,SAAwB;AAAA,EACxB,UAAU,oBAAI,IAAyB;AAAA,EACvC,eAAe;AAAA,EACf,YAAY,oBAAI,KAAK;AAAA,EACrB,WAAW,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EAAE;AAAA,EAC9C,eAAe;AAAA,EAqBvB,MAAM,QAAuB;AAE3B,SAAK,eAAe,kBAAkB;AAEtC,YAAI,4BAAW,MAAM,MAAM,GAAG;AAC5B,UAAI;AAAE,wCAAW,MAAM,MAAM;AAAA,MAAG,QAAQ;AAAA,MAAC;AAAA,IAC3C;AACA,WAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,WAAK,aAAS,8BAAa,CAAC,SAAS,KAAK,aAAa,IAAI,CAAC;AAC5D,WAAK,OAAO,GAAG,SAAS,MAAM;AAC9B,WAAK,OAAO,OAAO,MAAM,QAAQ,MAAM;AACrC,cAAM,SAAS,QAAQ,IAAS;AAChC,YAAI;AAAE,iBAAO,UAAU,MAAM,QAAQ,GAAK;AAAA,QAAG,QAAQ;AAAA,QAAC;AAOtD,cAAMC,UAAS,QAAQ,aAAa,WAC/B,OAAO,QAAQ,WAAW,cAC1B,QAAQ,OAAO,MAAM;AAC1B,YAAIA,SAAQ;AACV,cAAI;AACF,kBAAM,EAAE,IAAI,IAAI,OAAO,SAAS,mBAAmB;AACnD,mBAAO,UAAU,MAAM,QAAQ,GAAG,GAAG;AAAA,UACvC,QAAQ;AAAA,UAER;AAAA,QACF;AACA,QAAAD,SAAQ;AAAA,MACV,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,OAAsB;AAC1B,eAAW,KAAK,KAAK,QAAQ,OAAO,GAAG;AACrC,UAAI;AAAE,UAAE,OAAO,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAAC;AAAA,IACrC;AACA,SAAK,QAAQ,MAAM;AACnB,WAAO,IAAI,QAAQ,CAACA,aAAY;AAC9B,UAAI,CAAC,KAAK,QAAQ;AAChB,YAAI;AAAE,kBAAI,4BAAW,MAAM,MAAM,EAAG,iCAAW,MAAM,MAAM;AAAA,QAAG,QAAQ;AAAA,QAAC;AACvE,eAAOA,SAAQ;AAAA,MACjB;AACA,WAAK,OAAO,MAAM,MAAM;AACtB,YAAI;AAAE,kBAAI,4BAAW,MAAM,MAAM,EAAG,iCAAW,MAAM,MAAM;AAAA,QAAG,QAAQ;AAAA,QAAC;AACvE,QAAAA,SAAQ;AAAA,MACV,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEQ,aAAa,QAAsB;AACzC,UAAM,KAAK,KAAK;AAChB,UAAM,QAAqB,EAAE,IAAI,QAAQ,QAAQ,IAAI,eAAe,oBAAI,IAAI,EAAE;AAC9E,SAAK,QAAQ,IAAI,IAAI,KAAK;AAE1B,WAAO,YAAY,OAAO;AAC1B,WAAO,GAAG,QAAQ,CAAC,UAAU;AAC3B,YAAM,UAAU,MAAM,SAAS;AAC/B,UAAI;AACJ,cAAQ,MAAM,MAAM,OAAO,QAAQ,IAAI,MAAM,GAAG;AAC9C,cAAM,OAAO,MAAM,OAAO,MAAM,GAAG,GAAG;AACtC,cAAM,SAAS,MAAM,OAAO,MAAM,MAAM,CAAC;AACzC,YAAI,CAAC,KAAK,KAAK,EAAG;AAClB,aAAK,WAAW,OAAO,IAAI,EAAE,MAAM,CAAC,QAAQ;AAC1C,eAAK,KAAK,OAAO,EAAE,IAAI,GAAG,IAAI,OAAO,OAAO,OAAO,KAAK,WAAW,GAAG,EAAE,CAAC;AAAA,QAC3E,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAED,WAAO,GAAG,SAAS,MAAM;AAAE,WAAK,QAAQ,OAAO,EAAE;AAAA,IAAG,CAAC;AACrD,WAAO,GAAG,SAAS,MAAM;AAAE,WAAK,QAAQ,OAAO,EAAE;AAAA,IAAG,CAAC;AAAA,EACvD;AAAA,EAEA,MAAc,WAAW,QAAqB,MAA6B;AACzE,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,MAAM,IAAI;AAAA,IACvB,QAAQ;AACN,aAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,GAAG,IAAI,OAAO,OAAO,eAAe,CAAC;AAAA,IACtE;AAEA,YAAQ,IAAI,QAAQ;AAAA,MAClB,KAAK;AACH,eAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ,OAAO,CAAC;AAAA,MAEnE,KAAK,UAAU;AACb,cAAM,SAA4B;AAAA,UAChC,KAAK,QAAQ;AAAA,UACb,WAAW,KAAK,UAAU,YAAY;AAAA,UACtC,eAAe,KAAK,OAAO,KAAK,IAAI,IAAI,KAAK,UAAU,QAAQ,KAAK,GAAI;AAAA,UACxE,SAAS,KAAK;AAAA,UACd,MAAM,MAAM;AAAA,UACZ,OAAO;AAAA,YACL,QAAQ,MAAM;AAAA,YACd,KAAK,MAAM;AAAA,YACX,OAAO,MAAM;AAAA,YACb,QAAQ,MAAM;AAAA,UAChB;AAAA,UACA,SAAS,KAAK,WAAW,QAAQ;AAAA,UACjC,UAAU,EAAE,GAAG,KAAK,SAAS;AAAA,UAC7B,SAAS,mBAAmB;AAAA,QAC9B;AACA,eAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ,OAAO,CAAC;AAAA,MACnE;AAAA,MAEA,KAAK,iBAAiB;AACpB,cAAM,QAAQ,IAAI,QAAQ,SAAS;AACnC,cAAM,SAAS,gBAAgB,KAAK;AACpC,eAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ,OAAO,CAAC;AAAA,MACnE;AAAA,MAEA,KAAK,eAAe;AAClB,cAAM,QAAQ,IAAI,QAAQ,SAAS;AACnC,eAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ,cAAc,KAAK,EAAE,CAAC;AAAA,MACjF;AAAA,MAEA,KAAK,YAAY;AACf,eAAO,KAAK,KAAK,QAAQ;AAAA,UACvB,IAAI,IAAI;AAAA,UACR,IAAI;AAAA,UACJ,QAAQ;AAAA,YACN,OAAO,cAAc;AAAA,YACrB,SAAS,eAAe;AAAA,YACxB,SAAS,cAAc,IAAI,KAAK,KAAK,IAAI,IAAI,KAAQ,CAAC;AAAA,YACtD,YAAY,eAAe,IAAI,KAAK,KAAK,IAAI,IAAI,KAAQ,CAAC;AAAA,UAC5D;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MAEA,KAAK;AACH,eAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ,KAAK,WAAW,QAAQ,EAAE,CAAC;AAAA,MAEtF,KAAK;AACH,mBAAW,MAAM,IAAI,OAAO,SAAU,QAAO,cAAc,IAAI,EAAE;AACjE,eAAO,KAAK,KAAK,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ,EAAE,YAAY,CAAC,GAAG,OAAO,aAAa,EAAE,EAAE,CAAC;AAAA,MAEtG,KAAK;AAGH,YAAI,CAAC,YAAY,KAAK,cAAe,IAAyC,QAAQ,KAAK,GAAG;AAC5F,iBAAO,KAAK,KAAK,QAAQ;AAAA,YACvB,IAAI,IAAI;AAAA,YACR,IAAI;AAAA,YACJ,OAAO;AAAA,UACT,CAAC;AAAA,QACH;AACA,aAAK,KAAK,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,MAAM,QAAQ,gBAAgB,CAAC;AACnE,mBAAW,MAAM,QAAQ,KAAK,SAA2B,GAAG,EAAE;AAC9D;AAAA,IACJ;AAAA,EACF;AAAA,EAEQ,KAAK,QAAqB,KAAkC;AAClE,QAAI;AACF,aAAO,OAAO,MAAM,KAAK,UAAU,GAAG,IAAI,IAAI;AAAA,IAChD,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEQ,UAAU,KAAc,SAAmC;AACjE,eAAW,UAAU,KAAK,QAAQ,OAAO,GAAG;AAC1C,UAAI,CAAC,OAAO,cAAc,IAAI,OAAO,EAAG;AACxC,WAAK,KAAK,QAAQ,GAAG;AAAA,IACvB;AAAA,EACF;AACF;;;AIzNA,IAAAE,mBAAsD;AACtD,IAAAC,oBAAqB;AACrB,sBAA8B;AAC9B,IAAAC,eAAiB;;;ACHjB,IAAAC,sBAAsD;AACtD,IAAAC,kBAOO;AACP,IAAAC,oBAAoC;AAmBpC,IAAM,iBAAa,wBAAK,MAAM,WAAW,sBAAsB;AAC/D,IAAM,0BAAsB,wBAAK,MAAM,WAAW,qBAAqB;AAGvE,IAAM,uBAAuB,oBAAI,IAAI,CAAC,MAAM,CAAC;AAuB7C,SAAS,aAAa,MAAc,MAAM,MAAM,MAAqB,CAAC,GAAkB;AACtF,aAAW,aAAS,6BAAY,KAAK,EAAE,eAAe,KAAK,CAAC,EAAE;AAAA,IAAK,CAAC,GAAG,MACrE,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI;AAAA,EAC/C,GAAG;AACD,UAAM,WAAO,wBAAK,KAAK,MAAM,IAAI;AACjC,QAAI,MAAM,eAAe,GAAG;AAE1B,UAAI,KAAK,EAAE,MAAM,MAAM,WAAW,KAAK,CAAC;AAAA,IAC1C,WAAW,MAAM,YAAY,GAAG;AAC9B,UAAI,qBAAqB,IAAI,MAAM,IAAI,EAAG;AAC1C,mBAAa,MAAM,MAAM,GAAG;AAAA,IAC9B,WAAW,MAAM,OAAO,GAAG;AACzB,UAAI,KAAK,EAAE,MAAM,MAAM,WAAW,MAAM,CAAC;AAAA,IAC3C;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,oBAAoB,YAA4B;AAC9D,QAAM,WAAO,gCAAW,QAAQ;AAEhC,aAAW,SAAS,aAAa,UAAU,GAAG;AAE5C,UAAM,cAAU,4BAAS,YAAY,MAAM,IAAI,EAAE,MAAM,qBAAG,EAAE,KAAK,GAAG;AACpE,SAAK,OAAO,OAAO;AACnB,SAAK,OAAO,IAAI;AAEhB,QAAI,MAAM,WAAW;AACnB,WAAK,OAAO,UAAU;AACtB,WAAK,WAAO,8BAAa,MAAM,IAAI,CAAC;AAAA,IACtC,OAAO;AACL,WAAK,OAAO,OAAO;AACnB,WAAK,WAAO,8BAAa,MAAM,IAAI,CAAC;AAAA,IACtC;AACA,SAAK,OAAO,IAAI;AAAA,EAClB;AAEA,SAAO,KAAK,OAAO,KAAK;AAC1B;AAEA,SAAS,gBAA2B;AAClC,MAAI,KAAC,4BAAW,UAAU,EAAG,QAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAC9D,MAAI;AACF,UAAM,SAAS,KAAK,UAAM,8BAAa,YAAY,OAAO,CAAC;AAC3D,QAAI,OAAO,YAAY,KAAK,OAAO,OAAO,YAAY,YAAY,CAAC,OAAO,SAAS;AACjF,aAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAAA,IACnC;AACA,WAAO,EAAE,SAAS,GAAG,SAAS,OAAO,QAAQ;AAAA,EAC/C,QAAQ;AAEN,WAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAAA,EACnC;AACF;AAoCA,SAAS,oBAA4C;AACnD,MAAI,KAAC,4BAAW,mBAAmB,EAAG,QAAO,CAAC;AAC9C,MAAI;AACF,UAAM,SAAS,KAAK,UAAM,8BAAa,qBAAqB,OAAO,CAAC;AACpE,WAAO,UAAU,OAAO,WAAW,WAAW,SAAS,CAAC;AAAA,EAC1D,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAOO,SAAS,sBAAsB,YAAoB,QAA8B;AACtF,QAAM,OAAO,kBAAkB;AAC/B,QAAM,eAAe,OAAO,KAAK,IAAI;AACrC,QAAM,cAAU,wBAAK,YAAY,SAAS;AAE1C,MAAI,aAAa,WAAW,GAAG;AAC7B,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB;AAEA,MAAI,KAAC,4BAAW,OAAO,GAAG;AACxB,WAAO,EAAE,IAAI,OAAO,QAAQ,4DAA4D;AAAA,EAC1F;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,UAAM,8BAAa,SAAS,OAAO,CAAC;AAAA,EACpD,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,4BAA4B;AAAA,EAC1D;AAEA,MAAI,CAAC,OAAO,SAAS,CAAC,OAAO,WAAW;AACtC,WAAO,EAAE,IAAI,OAAO,QAAQ,wCAAwC;AAAA,EACtE;AAEA,QAAM,YAAY,KAAK,OAAO,KAAK;AACnC,MAAI,CAAC,WAAW;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,oCAAoC,OAAO,KAAK,IAAI;AAAA,EAClF;AAEA,MAAI;AAEF,UAAM,YAAQ,oBAAAC;AAAA,MACZ;AAAA,MACA,OAAO,KAAK,QAAQ,KAAK;AAAA,MACzB;AAAA,MACA,OAAO,KAAK,OAAO,WAAW,QAAQ;AAAA,IACxC;AACA,WAAO,QAAQ,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,QAAQ,mCAAmC;AAAA,EACxF,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,2BAA2B,OAAQ,IAAc,WAAW,GAAG,CAAC,GAAG;AAAA,EACjG;AACF;AAKO,SAAS,kBAAkB,MAAc,YAAkC;AAChF,MAAI;AACJ,MAAI;AACF,aAAS,oBAAoB,UAAU;AAAA,EACzC,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,0BAA0B,OAAQ,IAAc,WAAW,GAAG,CAAC,GAAG;AAAA,EAChG;AAEA,QAAM,YAAY,sBAAsB,YAAY,MAAM;AAC1D,MAAI,CAAC,UAAU,GAAI,QAAO;AAE1B,QAAM,SAAS,cAAc,EAAE,QAAQ,IAAI;AAC3C,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,qEAAgE,IAAI;AAAA,IAC9E;AAAA,EACF;AAEA,MAAI,OAAO,WAAW,QAAQ;AAC5B,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QACE,4CAA4C,OAAO,SAAS,6DACP,IAAI;AAAA,IAC7D;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,KAAK;AACpB;;;AChPA,IAAAC,kBAA8E;AAC9E,2BAAgC;;;ACGhC,IAAM,cAAc;AAIpB,IAAM,aAAa;AAInB,IAAM,eAAe;AAGrB,IAAM,WAAW;AACjB,IAAM,qBAAqB;AAC3B,IAAM,aAAa;AAGZ,IAAM,kBAAkB;AAAA,EAC7B,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,KAAK;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,KAAK;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,cAAc,MAAoC;AAChE,QAAM,QAAQ,KAAK,MAAM,WAAW;AACpC,MAAI,CAAC,MAAO,QAAO;AAEnB,SAAO;AAAA,IACL,WAAW,oBAAoB,MAAM,CAAC,CAAC;AAAA,IACvC,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,MACN,IAAI,MAAM,CAAC;AAAA,MACX,QAAQ,MAAM,CAAC;AAAA,MACf,MAAM,MAAM,CAAC;AAAA,MACb,QAAQ,MAAM,CAAC;AAAA,MACf,MAAM,MAAM,CAAC;AAAA,MACb,YAAY,MAAM,CAAC;AAAA,IACrB;AAAA,EACF;AACF;AAEO,SAAS,aAAa,MAAmC;AAC9D,QAAM,QAAQ,KAAK,MAAM,UAAU;AACnC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,MAAM,CAAC,EAAE,MAAM,QAAQ;AACvC,QAAM,YAAY,MAAM,CAAC,EAAE,MAAM,kBAAkB,KAAK,MAAM,CAAC,EAAE,MAAM,UAAU;AAEjF,SAAO;AAAA,IACL,WAAW,qBAAqB,MAAM,CAAC,CAAC;AAAA,IACxC,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,MACN,SAAS,MAAM,CAAC;AAAA,MAChB,SAAS,MAAM,CAAC;AAAA,MAChB,IAAI,UAAU,CAAC;AAAA,MACf,MAAM,YAAY,CAAC;AAAA,IACrB;AAAA,EACF;AACF;AAEO,SAAS,YAAY,MAAkC;AAC5D,QAAM,QAAQ,KAAK,MAAM,YAAY;AACrC,MAAI,CAAC,MAAO,QAAO;AAEnB,SAAO;AAAA,IACL,WAAW,qBAAqB,MAAM,CAAC,CAAC;AAAA,IACxC,KAAK;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,MACN,UAAU;AAAA,MACV,SAAS,MAAM,CAAC;AAAA,MAChB,SAAS,MAAM,CAAC;AAAA,IAClB;AAAA,EACF;AACF;AAEO,SAAS,oBAAoB,MAA6B;AAM/D,QAAM,aAAa,oBAAI,IAAY,CAAC,IAAI,CAAC;AACzC,MAAI,UAAU;AACd,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,QAAI,UAAyB;AAC7B,QAAI;AACF,gBAAU,mBAAmB,OAAO;AAAA,IACtC,QAAQ;AACN,gBAAU;AAAA,IACZ;AACA,QAAI,YAAY,QAAQ,YAAY,QAAS;AAC7C,eAAW,IAAI,OAAO;AACtB,cAAU;AAAA,EACZ;AAEA,aAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,eAAe,GAAG;AAC9D,eAAW,WAAW,UAAU;AAC9B,iBAAW,aAAa,YAAY;AAClC,YAAI,QAAQ,KAAK,SAAS,GAAG;AAC3B,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,MAAoC;AAEnE,QAAM,QAAQ,cAAc,IAAI;AAChC,MAAI,MAAO,QAAO;AAGlB,QAAM,OAAO,aAAa,IAAI;AAC9B,MAAI,KAAM,QAAO;AAGjB,SAAO,YAAY,IAAI;AACzB;AAEA,SAAS,oBAAoB,GAAiB;AAK5C,QAAM,UAAU,EAAE,QAAQ,8BAA8B,YAAY;AACpE,QAAM,IAAI,IAAI,KAAK,OAAO;AAC1B,SAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,IAAI,oBAAI,KAAK,IAAI;AAClD;AAEA,SAAS,qBAAqB,GAAiB;AAI7C,QAAM,MAAM,oBAAI,KAAK;AACrB,MAAI,IAAI,oBAAI,KAAK,GAAG,CAAC,IAAI,IAAI,YAAY,CAAC,EAAE;AAC5C,MAAI,OAAO,MAAM,EAAE,QAAQ,CAAC,EAAG,QAAO;AACtC,MAAI,EAAE,QAAQ,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,OAAO,oBAAI,KAAK,GAAG,CAAC,IAAI,IAAI,YAAY,IAAI,CAAC,EAAE;AACrD,QAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,KAAI;AAAA,EACzC;AACA,SAAO;AACT;;;ADjKO,IAAM,kBAA+B;AAAA,EAC1C,EAAE,MAAM,qBAAqB,QAAQ,aAAa,UAAU,OAAO;AAAA,EACnE,EAAE,MAAM,mBAAmB,QAAQ,aAAa,UAAU,OAAO;AAAA,EACjE,EAAE,MAAM,6BAA6B,QAAQ,eAAe,UAAU,MAAM;AAAA,EAC5E,EAAE,MAAM,mBAAmB,QAAQ,eAAe,UAAU,SAAS;AACvE;AAEO,IAAM,aAAN,MAAiB;AAAA,EAKtB,YAAoBC,MAAuB,UAAuB,iBAAiB;AAA/D,eAAAA;AAAuB;AAAA,EAAyC;AAAA,EAAhE;AAAA,EAAuB;AAAA,EAJnC,SAAS,oBAAI,IAA4B;AAAA,EACzC,YAAY,oBAAI,IAAoB;AAAA,EACpC,SAAS,oBAAI,IAAY;AAAA,EAIjC,QAAkB;AAChB,UAAM,UAAoB,CAAC;AAC3B,eAAW,OAAO,KAAK,SAAS;AAC9B,UAAI,KAAC,4BAAW,IAAI,IAAI,EAAG;AAC3B,UAAI;AAAE,wCAAW,IAAI,MAAM,0BAAU,IAAI;AAAA,MAAG,QACtC;AAAE;AAAA,MAAU;AAClB,WAAK,KAAK,GAAG;AACb,cAAQ,KAAK,IAAI,IAAI;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AAAA,EAEA,OAAa;AACX,eAAW,KAAK,KAAK,OAAO,OAAO,EAAG,eAAc,CAAC;AACrD,SAAK,OAAO,MAAM;AAClB,SAAK,UAAU,MAAM;AACrB,SAAK,OAAO,MAAM;AAAA,EACpB;AAAA,EAEA,gBAA0B;AACxB,WAAO,CAAC,GAAG,KAAK,MAAM;AAAA,EACxB;AAAA,EAEQ,KAAK,KAAsB;AACjC,QAAI;AACF,WAAK,UAAU,IAAI,IAAI,UAAM,0BAAS,IAAI,IAAI,EAAE,IAAI;AAAA,IACtD,QAAQ;AACN,WAAK,UAAU,IAAI,IAAI,MAAM,CAAC;AAAA,IAChC;AAEA,UAAM,QAAQ,YAAY,MAAM,KAAK,KAAK,GAAG,GAAG,GAAI;AACpD,SAAK,OAAO,IAAI,IAAI,MAAM,KAAK;AAC/B,SAAK,OAAO,IAAI,IAAI,MAAM;AAAA,EAC5B;AAAA,EAEQ,KAAK,KAAsB;AACjC,QAAI;AACJ,QAAI;AAAE,iBAAO,0BAAS,IAAI,IAAI;AAAA,IAAG,QAAQ;AAAE;AAAA,IAAQ;AACnD,UAAM,OAAO,KAAK,UAAU,IAAI,IAAI,IAAI,KAAK;AAE7C,QAAI,KAAK,OAAO,MAAM;AACpB,WAAK,UAAU,IAAI,IAAI,MAAM,CAAC;AAC9B;AAAA,IACF;AACA,QAAI,KAAK,SAAS,KAAM;AAExB,UAAM,aAAS,kCAAiB,IAAI,MAAM,EAAE,OAAO,MAAM,UAAU,QAAQ,CAAC;AAC5E,WAAO,GAAG,SAAS,MAAM,KAAK,UAAU,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC;AAChE,UAAM,SAAK,sCAAgB,EAAE,OAAO,OAAO,CAAC;AAC5C,OAAG,GAAG,SAAS,MAAM;AAAA,IAAC,CAAC;AACvB,OAAG,GAAG,QAAQ,CAAC,SAAS;AACtB,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,WAAK,QAAQ,MAAM,GAAG;AAAA,IACxB,CAAC;AACD,OAAG,GAAG,SAAS,MAAM,KAAK,UAAU,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC;AAAA,EAC9D;AAAA,EAEQ,QAAQ,MAAc,KAAsB;AAClD,UAAM,SAAS,iBAAiB,IAAI;AACpC,QAAI,CAAC,OAAQ;AAEb,QAAI,WAA0B;AAC9B,QAAI,UAAU;AACd,QAAI;AAEJ,QAAI,OAAO,WAAW,QAAQ;AAC5B,YAAM,QAAQ,aAAa,IAAI;AAC/B,UAAI,CAAC,MAAO;AACZ,iBAAW,MAAM,OAAO;AACxB,YAAM,MAAM,MAAM,OAAO;AACzB,UAAI,mBAAmB,KAAK,GAAG,GAAG;AAChC,mBAAW;AACX,kBAAU,wBAAwB,MAAM,OAAO,QAAQ,SAAS,SAAS,MAAM,OAAO,MAAM,SAAS;AAAA,MACvG,WAAW,gBAAgB,KAAK,GAAG,GAAG;AACpC,mBAAW;AACX,kBAAU,qBAAqB,MAAM,OAAO,QAAQ,SAAS,SAAS,MAAM,OAAO,MAAM,SAAS;AAAA,MACpG,WAAW,YAAY,KAAK,GAAG,GAAG;AAChC,mBAAW;AACX,kBAAU,0BAA0B,MAAM,OAAO,QAAQ,SAAS;AAAA,MACpE,OAAO;AACL;AAAA,MACF;AAAA,IACF,WAAW,OAAO,WAAW,SAAS;AACpC,YAAM,QAAQ,cAAc,IAAI;AAChC,UAAI,CAAC,MAAO;AACZ,iBAAW,MAAM,OAAO;AACxB,YAAM,SAAS,SAAS,MAAM,OAAO,QAAQ,EAAE;AAC/C,YAAM,SAAS,oBAAoB,MAAM,OAAO,IAAI;AACpD,UAAI,QAAQ;AACV,mBAAW;AACX,kBAAU,WAAW,OAAO,YAAY,CAAC,MAAM,MAAM,OAAO,MAAM,IAAI,MAAM,OAAO,IAAI;AAAA,MACzF,WAAW,UAAU,KAAK;AACxB,mBAAW;AACX,kBAAU,gBAAgB,MAAM,KAAK,MAAM,OAAO,MAAM,IAAI,MAAM,OAAO,IAAI;AAAA,MAC/E,WAAW,UAAU,KAAK;AACxB,mBAAW;AACX,kBAAU,gBAAgB,MAAM,KAAK,MAAM,OAAO,MAAM,IAAI,MAAM,OAAO,IAAI;AAAA,MAC/E,OAAO;AACL;AAAA,MACF;AAAA,IACF,OAAO;AACL;AAAA,IACF;AAEA,UAAM,QAAqB;AAAA,MACzB,WAAW,oBAAI,KAAK;AAAA,MACpB,QAAQ,IAAI;AAAA,MACZ,UAAU,IAAI;AAAA,MACd;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb;AAEA,QAAI;AAAE,kBAAY,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAoB;AACtD,SAAK,IAAI,QAAQ,KAAK;AAAA,EACxB;AACF;;;AE/IA,gCAAoD;AAQ7C,IAAM,iBAAN,MAAM,gBAAe;AAAA,EAM1B,YAAoBC,MAAe;AAAf,eAAAA;AAAA,EAAgB;AAAA,EAAhB;AAAA,EALZ,OAA4B;AAAA,EAC5B,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjB,OAAO,YAAsB;AAC3B,UAAMC,UAAS,QAAQ,aAAa,WAC/B,OAAO,QAAQ,WAAW,cAC1B,QAAQ,OAAO,MAAM;AAC1B,WAAOA,UAAS,CAAC,IAAI,CAAC,QAAQ;AAAA,EAChC;AAAA,EAEA,OAAO,cAAuB;AAC5B,UAAM,YAAQ,qCAAU,cAAc,CAAC,GAAG,KAAK,UAAU,GAAG,MAAM,KAAK,YAAY,GAAG;AAAA,MACpF,OAAO,CAAC,UAAU,UAAU,QAAQ;AAAA,IACtC,CAAC;AACD,WAAO,MAAM,WAAW;AAAA,EAC1B;AAAA,EAEA,QAAiB;AACf,QAAI,CAAC,gBAAe,YAAY,EAAG,QAAO;AAE1C,UAAM,YAAQ;AAAA,MACZ;AAAA,MACA,CAAC,GAAG,gBAAe,UAAU,GAAG,MAAM,QAAQ,MAAM,WAAW,KAAK;AAAA,MACpE,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE;AAAA,IACtC;AACA,QAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,UAAM,OAAO,YAAY,OAAO;AAChC,UAAM,OAAO,GAAG,QAAQ,CAAC,UAAkB,KAAK,OAAO,KAAK,CAAC;AAC7D,UAAM,GAAG,QAAQ,MAAM;AACrB,WAAK,OAAO;AACZ,WAAK,SAAS;AAAA,IAChB,CAAC;AACD,SAAK,OAAO;AAEZ,SAAK,SAAS;AACd,WAAO;AAAA,EACT;AAAA,EAEA,OAAa;AACX,QAAI,KAAK,MAAM;AACb,UAAI;AAAE,aAAK,KAAK,KAAK,SAAS;AAAA,MAAG,QAAQ;AAAA,MAAC;AAC1C,WAAK,OAAO;AAAA,IACd;AACA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,WAAoB;AAClB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,kBAA0B;AACxB,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,OAAO,OAAqB;AAClC,SAAK,UAAU;AACf,QAAI;AACJ,YAAQ,MAAM,KAAK,OAAO,QAAQ,IAAI,MAAM,GAAG;AAC7C,YAAM,OAAO,KAAK,OAAO,MAAM,GAAG,GAAG;AACrC,WAAK,SAAS,KAAK,OAAO,MAAM,MAAM,CAAC;AACvC,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,WAAK,WAAW,IAAI;AAAA,IACtB;AAAA,EACF;AAAA,EAEQ,WAAW,MAAoB;AACrC,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,IAAI;AAAA,IACzB,QAAQ;AACN;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AACtB,QAAI,CAAC,QAAS;AAEd,UAAM,WAAW,SAAS,MAAM,YAAY,KAAK,EAAE;AACnD,UAAM,WAAW,mBAAmB,QAAQ;AAI5C,UAAM,QAAQ,MAAM,qBAAqB,MAAM,SAAS;AACxD,UAAM,iBAAiB,aAAa,OAAO,SAAS,QAAQ;AAE5D,UAAM,QAAqB;AAAA,MACzB,WAAW,eAAe,MAAM,oBAAoB,KAAK,oBAAI,KAAK;AAAA,MAClE,QAAQ,KAAK;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,MACV,SAAS,IAAI,KAAK,KAAK,OAAO,GAAG,MAAM,GAAG,GAAG;AAAA,IAC/C;AAEA,QAAI;AAAE,kBAAY,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAoB;AACtD,SAAK,IAAI,QAAQ,KAAK;AAAA,EACxB;AACF;AAEA,SAAS,mBAAmB,UAAiC;AAE3D,MAAI,YAAY,EAAG,QAAO;AAC1B,MAAI,aAAa,EAAG,QAAO;AAC3B,MAAI,aAAa,EAAG,QAAO;AAC3B,MAAI,aAAa,EAAG,QAAO;AAC3B,SAAO;AACT;AAEA,SAAS,aAAa,OAAe,SAAiB,MAAoC;AACxF,MAAI,QAAQ,KAAK,KAAK,KAAK,oDAAoD,KAAK,OAAO,GAAG;AAC5F,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,KAAK,KAAK,KAAK,gCAAgC,KAAK,OAAO,GAAG;AACxE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,eAAe,IAAqC;AAC3D,MAAI,CAAC,GAAI,QAAO;AAChB,QAAM,KAAK,SAAS,IAAI,EAAE;AAC1B,MAAI,CAAC,OAAO,SAAS,EAAE,EAAG,QAAO;AACjC,SAAO,IAAI,KAAK,KAAK,MAAM,KAAK,GAAI,CAAC;AACvC;;;AClIA,IAAAC,6BAA0B;AAC1B,IAAAC,kBAA2B;AAkBpB,IAAM,iBAAN,MAAqB;AAAA,EAc1B,YAAoBC,MAAe;AAAf,eAAAA;AAAA,EAAgB;AAAA,EAAhB;AAAA,EAbZ,SAAS;AAAA,EACT,YAAmC;AAAA,EACnC,eAAe,oBAAI,IAAyB;AAAA,EAC5C,mBAAmB,oBAAI,IAAkD;AAAA,EACzE,kBAAkB,oBAAI,IAAY;AAAA;AAAA,EAGlC,iBAAiB;AAAA,EACjB,oBAAoB;AAAA;AAAA,EACpB,mBAAmB;AAAA,EACnB,oBAAoB;AAAA;AAAA,EACpB,mBAAmB;AAAA,EAI3B,QAAiB;AACf,QAAI,CAAC,KAAK,iBAAiB,GAAG;AAC5B,aAAO;AAAA,IACT;AACA,SAAK,SAAS;AACd,SAAK,YAAY,YAAY,MAAM,KAAK,KAAK,GAAG,KAAK,cAAc;AACnE,WAAO;AAAA,EACT;AAAA,EAEA,OAAa;AACX,QAAI,KAAK,UAAW,eAAc,KAAK,SAAS;AAChD,SAAK,YAAY;AACjB,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,WAAoB;AAAE,WAAO,KAAK;AAAA,EAAQ;AAAA,EAElC,mBAA4B;AAClC,UAAM,SAAK,sCAAU,MAAM,CAAC,WAAW,GAAG,EAAE,OAAO,OAAO,CAAC;AAC3D,QAAI,GAAG,WAAW,EAAG,QAAO;AAE5B,eAAO,4BAAW,eAAe;AAAA,EACnC;AAAA,EAEQ,OAAa;AACnB,QAAI;AACF,YAAM,cAAc,KAAK,eAAe;AACxC,WAAK,iBAAiB,WAAW;AACjC,WAAK,gBAAgB,WAAW;AAChC,WAAK,gBAAgB;AAAA,IACvB,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEQ,iBAAqC;AAC3C,UAAM,UAA8B,CAAC;AACrC,UAAM,MAAM,KAAK,IAAI;AAErB,QAAI;AAEF,YAAM,SAAK,sCAAU,aAAa,CAAC,MAAM,MAAM,OAAO,MAAM,UAAU,GAAG;AAAA,QACvE,UAAU;AAAA,QAAS,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAAG,SAAS;AAAA,MAC/D,CAAC;AACD,UAAI,GAAG,WAAW,KAAK,GAAG,QAAQ;AAChC,mBAAW,QAAQ,GAAG,OAAO,MAAM,IAAI,GAAG;AACxC,gBAAM,WAAW,KAAK,MAAM,0BAA0B;AACtD,gBAAM,aAAa,KAAK,MAAM,aAAa;AAC3C,cAAI,YAAY,YAAY;AAC1B,oBAAQ,KAAK,EAAE,WAAW,SAAS,CAAC,GAAG,WAAW,SAAS,WAAW,CAAC,CAAC,GAAG,WAAW,IAAI,CAAC;AAAA,UAC7F;AAAA,QACF;AACA,YAAI,QAAQ,SAAS,EAAG,QAAO;AAAA,MACjC;AAAA,IACF,QAAQ;AAAA,IAAoB;AAE5B,QAAI;AAEF,YAAM,SAAK,sCAAU,MAAM,CAAC,QAAQ,IAAI,GAAG;AAAA,QACzC,UAAU;AAAA,QAAS,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAAG,SAAS;AAAA,MAC/D,CAAC;AACD,UAAI,GAAG,WAAW,KAAK,GAAG,QAAQ;AAChC,mBAAW,QAAQ,GAAG,OAAO,MAAM,IAAI,GAAG;AAExC,gBAAM,QAAQ,KAAK,KAAK,EAAE,MAAM,KAAK;AACrC,cAAI,MAAM,SAAS,EAAG;AACtB,gBAAM,YAAY,MAAM,CAAC,EAAE,MAAM,GAAG;AACpC,gBAAM,aAAa,MAAM,CAAC,EAAE,MAAM,GAAG;AACrC,cAAI,UAAU,UAAU,KAAK,WAAW,UAAU,GAAG;AACnD,kBAAM,WAAW,UAAU,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;AAChD,kBAAM,WAAW,SAAS,WAAW,WAAW,SAAS,CAAC,CAAC;AAC3D,gBAAI,YAAY,CAAC,MAAM,QAAQ,KAAK,CAAC,KAAK,UAAU,QAAQ,GAAG;AAC7D,sBAAQ,KAAK,EAAE,WAAW,UAAU,WAAW,UAAU,WAAW,IAAI,CAAC;AAAA,YAC3E;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAoB;AAE5B,WAAO;AAAA,EACT;AAAA,EAEQ,iBAAiB,aAAuC;AAC9D,UAAM,MAAM,KAAK,IAAI;AAErB,eAAW,QAAQ,aAAa;AAC9B,YAAM,MAAM,KAAK;AACjB,UAAI,UAAU,KAAK,aAAa,IAAI,GAAG;AAEvC,UAAI,CAAC,SAAS;AACZ,kBAAU,EAAE,OAAO,oBAAI,IAAI,GAAG,WAAW,KAAK,UAAU,KAAK,OAAO,EAAE;AACtE,aAAK,aAAa,IAAI,KAAK,OAAO;AAAA,MACpC;AAEA,cAAQ,MAAM,IAAI,KAAK,SAAS;AAChC,cAAQ,WAAW;AACnB,cAAQ;AAGR,UAAI,QAAQ,MAAM,QAAQ,KAAK,qBAC1B,MAAM,QAAQ,aAAc,KAAK,kBAAkB;AACtD,aAAK;AAAA,UACH;AAAA,UACA,uBAAuB,KAAK,SAAS,WAAW,QAAQ,MAAM,IAAI,aAAa,KAAK,OAAO,MAAM,QAAQ,aAAa,GAAI,CAAC;AAAA,UAC3H,KAAK;AAAA,UACL,EAAE,eAAe,QAAQ,MAAM,MAAM,gBAAgB,KAAK,OAAO,MAAM,QAAQ,aAAa,GAAI,EAAE;AAAA,QACpG;AAEA,aAAK,aAAa,OAAO,GAAG;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,gBAAgB,aAAuC;AAE7D,QAAI;AACF,YAAM,SAAK,sCAAU,MAAM,CAAC,OAAO,SAAS,YAAY,IAAI,GAAG;AAAA,QAC7D,UAAU;AAAA,QAAS,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAAG,SAAS;AAAA,MAC/D,CAAC;AACD,UAAI,GAAG,WAAW,KAAK,CAAC,GAAG,OAAQ;AAEnC,YAAM,YAAY,oBAAI,IAAoB;AAE1C,iBAAW,QAAQ,GAAG,OAAO,MAAM,IAAI,GAAG;AACxC,cAAM,QAAQ,KAAK,KAAK,EAAE,MAAM,KAAK;AACrC,YAAI,MAAM,SAAS,EAAG;AACtB,cAAM,OAAO,MAAM,CAAC,EAAE,MAAM,GAAG;AAC/B,cAAM,KAAK,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;AACrC,YAAI,GAAI,WAAU,IAAI,KAAK,UAAU,IAAI,EAAE,KAAK,KAAK,CAAC;AAAA,MACxD;AAEA,iBAAW,CAAC,IAAI,KAAK,KAAK,WAAW;AACnC,YAAI,SAAS,KAAK,mBAAmB;AACnC,eAAK;AAAA,YACH;AAAA,YACA,yBAAyB,KAAK,+BAA+B,EAAE;AAAA,YAC/D;AAAA,YACA,EAAE,iBAAiB,MAAM;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAiB;AAAA,EAC3B;AAAA,EAEQ,UAAU,UAAyB,SAAiB,UAAmB,SAAyC;AACtH,UAAM,QAAqB;AAAA,MACzB,WAAW,oBAAI,KAAK;AAAA,MACpB,QAAQ;AAAA,MACR,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX;AAAA,IACF;AACA,QAAI;AAAE,kBAAY,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAoB;AACtD,SAAK,IAAI,QAAQ,KAAK;AAAA,EACxB;AAAA,EAEQ,kBAAwB;AAC9B,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,KAAK,OAAO,KAAK,KAAK,cAAc;AAC9C,UAAI,MAAM,QAAQ,WAAW,KAAK,mBAAmB,GAAG;AACtD,aAAK,aAAa,OAAO,GAAG;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,IAAqB;AACrC,WAAO,OAAO,eAAe,OAAO,SAAS,OAAO,aAAa,GAAG,WAAW,aAAa;AAAA,EAC9F;AACF;;;AC9MA,IAAAC,kBAA8E;AAC9E,IAAAC,wBAAgC;AAYhC,IAAM,kBAAkB;AAAA,EACtB;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF;AAEO,IAAM,aAAN,MAAiB;AAAA;AAAA,EAgBtB,YAAoBC,MAAe;AAAf,eAAAA;AAAA,EAAgB;AAAA,EAAhB;AAAA,EAfZ,SAAS;AAAA,EACT,SAAS,oBAAI,IAA4B;AAAA,EACzC,YAAY,oBAAI,IAAoB;AAAA;AAAA,EAGpC,iBAAiB,oBAAI,IAAkD;AAAA,EACvE,eAA2B,CAAC;AAAA;AAAA,EAG5B,mBAAmB;AAAA;AAAA,EACnB,cAAc;AAAA,EACd,oBAAoB;AAAA;AAAA,EACpB,cAAc;AAAA,EACd,mBAAmB;AAAA,EAI3B,QAAiB;AACf,UAAM,UAAU,gBAAgB,OAAO,OAAK;AAC1C,UAAI,KAAC,4BAAW,CAAC,EAAG,QAAO;AAC3B,UAAI;AAAE,wCAAW,GAAG,0BAAU,IAAI;AAAG,eAAO;AAAA,MAAM,QAC5C;AAAE,eAAO;AAAA,MAAO;AAAA,IACxB,CAAC;AAED,QAAI,QAAQ,WAAW,EAAG,QAAO;AAEjC,SAAK,SAAS;AACd,eAAW,OAAO,SAAS;AACzB,WAAK,QAAQ,GAAG;AAAA,IAClB;AAGA,gBAAY,MAAM,KAAK,cAAc,GAAG,GAAM;AAC9C,WAAO;AAAA,EACT;AAAA,EAEA,OAAa;AACX,eAAW,KAAK,KAAK,OAAO,OAAO,EAAG,eAAc,CAAC;AACrD,SAAK,OAAO,MAAM;AAClB,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,WAAoB;AAAE,WAAO,KAAK;AAAA,EAAQ;AAAA,EAElC,QAAQ,MAAoB;AAClC,QAAI;AACF,WAAK,UAAU,IAAI,UAAM,0BAAS,IAAI,EAAE,IAAI;AAAA,IAC9C,QAAQ;AACN,WAAK,UAAU,IAAI,MAAM,CAAC;AAAA,IAC5B;AAEA,UAAM,QAAQ,YAAY,MAAM,KAAK,QAAQ,IAAI,GAAG,GAAI;AACxD,SAAK,OAAO,IAAI,MAAM,KAAK;AAAA,EAC7B;AAAA,EAEQ,QAAQ,MAAoB;AAClC,QAAI;AACJ,QAAI;AAAE,iBAAO,0BAAS,IAAI;AAAA,IAAG,QAAQ;AAAE;AAAA,IAAQ;AAC/C,UAAM,OAAO,KAAK,UAAU,IAAI,IAAI,KAAK;AAEzC,QAAI,KAAK,OAAO,MAAM;AAAE,WAAK,UAAU,IAAI,MAAM,CAAC;AAAG;AAAA,IAAQ;AAC7D,QAAI,KAAK,SAAS,KAAM;AAExB,UAAM,aAAS,kCAAiB,MAAM,EAAE,OAAO,MAAM,UAAU,QAAQ,CAAC;AACxE,WAAO,GAAG,SAAS,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,IAAI,CAAC;AAC5D,UAAM,SAAK,uCAAgB,EAAE,OAAO,OAAO,CAAC;AAC5C,OAAG,GAAG,QAAQ,CAAC,SAAS,KAAK,aAAa,IAAI,CAAC;AAC/C,OAAG,GAAG,SAAS,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1D;AAAA,EAEQ,aAAa,MAAoB;AAEvC,UAAM,gBAAgB,KAAK,MAAM,wCAAwC;AACzE,QAAI,eAAe;AACjB,WAAK,aAAa,KAAK;AAAA,QACrB,MAAM,cAAc,CAAC;AAAA,QACrB,QAAQ,cAAc,CAAC;AAAA,QACvB,WAAW,cAAc,CAAC;AAAA,QAC1B,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AACD;AAAA,IACF;AAGA,UAAM,eAAe,KAAK,MAAM,wCAAwC;AACxE,QAAI,cAAc;AAChB,WAAK,aAAa,KAAK;AAAA,QACrB,MAAM,aAAa,CAAC;AAAA,QACpB,QAAQ,aAAa,CAAC;AAAA,QACtB,WAAW,aAAa,CAAC;AAAA,QACzB,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AACD;AAAA,IACF;AAGA,UAAM,eAAe,KAAK,MAAM,sCAAsC;AACtE,QAAI,cAAc;AAChB,YAAM,YAAY,KAAK,MAAM,kBAAkB;AAC/C,WAAK,aAAa,KAAK;AAAA,QACrB,MAAM,YAAY,CAAC,KAAK;AAAA,QACxB,QAAQ,aAAa,CAAC;AAAA,QACtB,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEQ,gBAAsB;AAC5B,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,SAAS,MAAM,KAAK;AAG1B,SAAK,eAAe,KAAK,aAAa,OAAO,OAAK,EAAE,YAAY,MAAM;AAEtE,SAAK,gBAAgB;AACrB,SAAK,UAAU;AAAA,EACjB;AAAA,EAEQ,kBAAwB;AAE9B,UAAM,cAAc,oBAAI,IAAoB;AAC5C,UAAM,mBAA6B,CAAC;AAEpC,eAAW,KAAK,KAAK,cAAc;AACjC,UAAI,EAAE,SAAS,OAAO;AACpB,cAAM,MAAM,EAAE,aAAa;AAC3B,oBAAY,IAAI,MAAM,YAAY,IAAI,GAAG,KAAK,KAAK,CAAC;AAAA,MACtD;AAGA,YAAM,SAAS,EAAE,OAAO,MAAM,GAAG;AACjC,YAAM,WAAW,KAAK,IAAI,GAAG,OAAO,IAAI,OAAK,EAAE,MAAM,CAAC;AACtD,UAAI,WAAW,IAAI;AACjB,yBAAiB,KAAK,EAAE,MAAM;AAAA,MAChC;AAAA,IACF;AAEA,eAAW,CAAC,QAAQ,KAAK,KAAK,aAAa;AACzC,UAAI,SAAS,KAAK,kBAAkB;AAClC,aAAK;AAAA,UACH;AAAA,UACA,6BAA6B,KAAK,qBAAqB,MAAM,OAAO,KAAK,cAAc,GAAI;AAAA,UAC3F,WAAW,YAAY,SAAS;AAAA,UAChC,EAAE,iBAAiB,OAAO,MAAM,YAAY;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAEA,QAAI,iBAAiB,UAAU,GAAG;AAChC,WAAK;AAAA,QACH;AAAA,QACA,kBAAkB,iBAAiB,MAAM;AAAA,QACzC;AAAA,QACA,EAAE,SAAS,iBAAiB,MAAM,GAAG,CAAC,GAAG,MAAM,mBAAmB;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,YAAkB;AAExB,UAAM,qBAA+B,CAAC;AAEtC,eAAW,KAAK,KAAK,cAAc;AACjC,YAAM,SAAS,EAAE,OAAO,YAAY;AAEpC,YAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,UAAI,MAAM,SAAS,EAAG;AACtB,YAAM,MAAM,MAAM,MAAM,SAAS,CAAC;AAElC,UAAI,IAAI,UAAU,KAAK,KAAK,eAAe,GAAG,KAAK,KAAK,kBAAkB;AACxE,2BAAmB,KAAK,MAAM;AAAA,MAChC;AAAA,IACF;AAGA,UAAM,SAAS,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC;AAC9C,QAAI,OAAO,UAAU,KAAK,mBAAmB;AAC3C,WAAK;AAAA,QACH;AAAA,QACA,0BAA0B,OAAO,MAAM;AAAA,QACvC;AAAA,QACA,EAAE,gBAAgB,OAAO,MAAM,GAAG,EAAE,GAAG,MAAM,OAAO,cAAc,OAAO,OAAO;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,eAAe,KAAqB;AAC1C,UAAM,OAAO,oBAAI,IAAoB;AACrC,eAAW,MAAM,KAAK;AACpB,WAAK,IAAI,KAAK,KAAK,IAAI,EAAE,KAAK,KAAK,CAAC;AAAA,IACtC;AACA,QAAI,UAAU;AACd,eAAW,SAAS,KAAK,OAAO,GAAG;AACjC,YAAM,IAAI,QAAQ,IAAI;AACtB,UAAI,IAAI,EAAG,YAAW,IAAI,KAAK,KAAK,CAAC;AAAA,IACvC;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,UAAyB,SAAiB,UAAmB,SAAyC;AACtH,UAAM,QAAqB;AAAA,MACzB,WAAW,oBAAI,KAAK;AAAA,MACpB,QAAQ;AAAA,MACR,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX;AAAA,IACF;AACA,QAAI;AAAE,kBAAY,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAoB;AACtD,SAAK,IAAI,QAAQ,KAAK;AAAA,EACxB;AACF;;;AChPA,IAAAC,kBAAsD;AACtD,IAAAC,oBAAqB;AACrB,kBAAiB;AAGjB,IAAM,sBAAsB;AAC5B,IAAM,kBAAkB;AAExB,IAAM,iBAAoC;AAAA,EACxC,QAAQ;AAAA,IACN,UAAU;AAAA,IACV,WAAW;AAAA,IACX,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AAAA,EACA,KAAK;AAAA,IACH,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA,EACP;AAAA,EACA,QAAQ,CAAC;AAAA,EACT,SAAS;AAAA,IACP,aAAa;AAAA,IACb,iBAAiB;AAAA,IACjB,YAAY;AAAA,IACZ,YAAY;AAAA,EACd;AACF;AAEO,SAAS,WAAW,YAAwC;AACjE,QAAM,OAAO,cAAc;AAC3B,MAAI,KAAC,4BAAW,IAAI,GAAG;AACrB,WAAO,EAAE,GAAG,eAAe;AAAA,EAC7B;AAEA,MAAI;AACF,UAAM,UAAM,8BAAa,MAAM,OAAO;AACtC,UAAM,SAAS,YAAAC,QAAK,MAAM,GAAG;AAC7B,WAAO;AAAA,MACL,QAAQ,EAAE,GAAG,eAAe,QAAQ,GAAG,OAAO,OAAO;AAAA,MACrD,KAAK,EAAE,GAAG,eAAe,KAAK,GAAG,OAAO,IAAI;AAAA,MAC5C,QAAQ,OAAO,UAAU,CAAC;AAAA,MAC1B,SAAS,EAAE,GAAG,eAAe,SAAS,GAAG,OAAO,QAAQ;AAAA,MACxD,SAAS,OAAO;AAAA,IAClB;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,GAAG,eAAe;AAAA,EAC7B;AACF;AAEO,SAAS,kBAAkB,SAA6C;AAC7E,QAAM,MAAM,WAAW;AACvB,QAAM,UAAU,oBAAI,IAA0B;AAE9C,MAAI,KAAC,4BAAW,GAAG,GAAG;AACpB,WAAO;AAAA,EACT;AAEA,QAAM,YAAQ,6BAAY,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO,CAAC;AAChE,aAAW,QAAQ,OAAO;AACxB,QAAI;AACF,YAAM,UAAM,kCAAa,wBAAK,KAAK,IAAI,GAAG,OAAO;AACjD,YAAM,SAAS,YAAAA,QAAK,MAAM,GAAG;AAC7B,iBAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,MAAM,GAAG;AACnD,gBAAQ,IAAI,MAAM,MAAsB;AAAA,MAC1C;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;;;AP3CO,IAAM,aAAN,MAAiB;AAAA,EAOtB,YAAoBC,MAAe;AAAf,eAAAA;AAClB,IAAAA,KAAI,GAAG,SAAS,CAAC,UAAU;AACzB,YAAM,MAAM,KAAK,QAAQ,IAAI,MAAM,MAAM;AACzC,UAAI,IAAK,KAAI;AACb,iBAAW,UAAU,KAAK,QAAQ,OAAO,GAAG;AAC1C,YAAI,OAAO,WAAW,aAAa,CAAC,OAAO,UAAU,QAAS;AAC9D,aAAK,OAAO,SAAS,QAAQ,KAAK,EAAE,MAAM,CAAC,QAAQ;AACjD,iBAAO,SAAS;AAChB,iBAAO,SAAS,mBAAmB,OAAQ,IAAc,WAAW,GAAG,CAAC;AACxE,eAAK,IAAI,eAAe,OAAO,MAAM,SAAS,OAAO,MAAM;AAAA,QAC7D,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAboB;AAAA,EANZ,UAAU,oBAAI,IAA0B;AAAA,EACxC,aAAgC;AAAA,EAChC,iBAAwC;AAAA,EACxC,iBAAwC;AAAA,EACxC,aAAgC;AAAA,EAiBxC,MAAM,QAAuB;AAC3B,SAAK,iBAAiB;AACtB,UAAM,KAAK,0BAA0B;AAErC,SAAK,aAAa,IAAI,WAAW,KAAK,GAAG;AACzC,UAAM,UAAU,KAAK,WAAW,MAAM;AAEtC,eAAW,WAAW,KAAK,WAAW,cAAc,GAAG;AACrD,YAAM,MAAM,KAAK,QAAQ,IAAI,OAAO;AACpC,UAAI,KAAK;AACP,YAAI,SAAS;AACb,YAAI,SAAS,YAAY,QAAQ,MAAM;AACvC,aAAK,IAAI,eAAe,SAAS,WAAW,IAAI,MAAM;AAAA,MACxD;AAAA,IACF;AAEA,SAAK,iBAAiB,IAAI,eAAe,KAAK,GAAG;AACjD,QAAI,KAAK,eAAe,MAAM,GAAG;AAC/B,YAAM,MAAM,KAAK,QAAQ,IAAI,cAAc;AAC3C,UAAI,KAAK;AACP,YAAI,SAAS;AACb,YAAI,SAAS,WAAW,eAAe,UAAU,EAAE,SAAS,QAAQ,IAAI,iBAAiB,gBAAgB;AACzG,aAAK,IAAI,eAAe,gBAAgB,WAAW,IAAI,MAAM;AAAA,MAC/D;AAAA,IACF;AAGA,SAAK,iBAAiB,IAAI,eAAe,KAAK,GAAG;AACjD,QAAI,KAAK,eAAe,MAAM,GAAG;AAC/B,YAAM,OAAO,KAAK,QAAQ,IAAI,iBAAiB;AAC/C,UAAI,MAAM;AACR,aAAK,SAAS;AACd,aAAK,SAAS;AACd,aAAK,IAAI,eAAe,mBAAmB,WAAW,KAAK,MAAM;AAAA,MACnE;AAAA,IACF;AAGA,SAAK,aAAa,IAAI,WAAW,KAAK,GAAG;AACzC,QAAI,KAAK,WAAW,MAAM,GAAG;AAC3B,YAAM,OAAO,KAAK,QAAQ,IAAI,aAAa;AAC3C,UAAI,MAAM;AACR,aAAK,SAAS;AACd,aAAK,SAAS;AACd,aAAK,IAAI,eAAe,eAAe,WAAW,KAAK,MAAM;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,OAAsB;AAC1B,SAAK,YAAY,KAAK;AACtB,SAAK,gBAAgB,KAAK;AAC1B,SAAK,gBAAgB,KAAK;AAC1B,SAAK,YAAY,KAAK;AACtB,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,UAAI;AACF,YAAI,IAAI,YAAY,IAAI,WAAW,WAAW;AAC5C,gBAAM,IAAI,SAAS,KAAK;AAAA,QAC1B;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,SAAS;AACb,YAAI,SAAS,gBAAgB,OAAQ,IAAc,WAAW,GAAG,CAAC;AAClE,aAAK,IAAI,eAAe,IAAI,MAAM,SAAS,IAAI,MAAM;AACrD;AAAA,MACF;AACA,UAAI,SAAS;AACb,WAAK,IAAI,eAAe,IAAI,MAAM,SAAS;AAAA,IAC7C;AAAA,EACF;AAAA,EAEA,UAAoF;AAClF,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MAC5C,MAAM,EAAE;AAAA,MACR,QAAQ,EAAE;AAAA,MACV,QAAQ,EAAE;AAAA,MACV,QAAQ,EAAE;AAAA,IACZ,EAAE;AAAA,EACJ;AAAA,EAEQ,mBAAyB;AAC/B,UAAM,WAA2B;AAAA,MAC/B,EAAE,MAAM,eAAe,SAAS,SAAS,QAAQ,WAAW,QAAQ,UAAU,QAAQ,EAAE;AAAA,MACxF,EAAE,MAAM,aAAa,SAAS,SAAS,QAAQ,WAAW,QAAQ,UAAU,QAAQ,EAAE;AAAA,MACtF,EAAE,MAAM,gBAAgB,SAAS,SAAS,QAAQ,WAAW,QAAQ,UAAU,QAAQ,EAAE;AAAA,MACzF,EAAE,MAAM,mBAAmB,SAAS,SAAS,QAAQ,WAAW,QAAQ,UAAU,QAAQ,EAAE;AAAA,MAC5F,EAAE,MAAM,eAAe,SAAS,SAAS,QAAQ,WAAW,QAAQ,UAAU,QAAQ,EAAE;AAAA,IAC1F;AACA,eAAW,KAAK,SAAU,MAAK,QAAQ,IAAI,EAAE,MAAM,CAAC;AAAA,EACtD;AAAA,EAEA,MAAc,4BAA2C;AACvD,QAAI,KAAC,6BAAW,MAAM,SAAS,EAAG;AAClC,UAAM,UAAU,kBAAkB,MAAM,KAAK;AAC7C,UAAM,cAAU,8BAAY,MAAM,WAAW,EAAE,eAAe,KAAK,CAAC;AACpE,eAAW,SAAS,SAAS;AAC3B,UAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,YAAM,mBAAe,wBAAK,MAAM,WAAW,MAAM,MAAM,UAAU;AACjE,UAAI,KAAC,6BAAW,YAAY,EAAG;AAC/B,UAAI;AACF,cAAM,WAAW,aAAAC,QAAK,UAAM,+BAAa,cAAc,OAAO,CAAC;AAC/D,cAAM,OAAO,SAAS,QAAQ,QAAQ,MAAM;AAC5C,cAAM,WAAW,SAAS,QAAQ,QAAQ,YAAY,CAAC;AACvD,cAAM,SAAS;AAAA,UACb,SAAS;AAAA,UACT,GAAG;AAAA,UACH,GAAI,QAAQ,IAAI,IAAI,KAAK,CAAC;AAAA,QAC5B;AACA,cAAM,SAAuB;AAAA,UAC3B;AAAA,UACA,SAAS,SAAS,QAAQ,WAAW;AAAA,UACrC,QAAQ;AAAA,UACR,QAAQ,OAAO,YAAY,QAAQ,aAAa;AAAA,UAChD,QAAQ;AAAA,UACR,UAAM,wBAAK,MAAM,WAAW,MAAM,IAAI;AAAA,UACtC;AAAA,QACF;AACA,aAAK,QAAQ,IAAI,MAAM,MAAM;AAC7B,YAAI,OAAO,YAAY,MAAO;AAC9B,cAAM,KAAK,eAAe,MAAM;AAAA,MAClC,SAAS,KAAK;AACZ,cAAM,OAAO,MAAM;AACnB,aAAK,QAAQ,IAAI,MAAM;AAAA,UACrB;AAAA,UACA,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ,yBAAyB,OAAQ,IAAc,WAAW,GAAG,CAAC;AAAA,UACtE,UAAM,wBAAK,MAAM,WAAW,MAAM,IAAI;AAAA,QACxC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,eAAe,QAAqC;AAChE,UAAM,aAAa,KAAK,oBAAoB,OAAO,IAAK;AACxD,QAAI,CAAC,YAAY;AACf,aAAO,SAAS;AAChB,aAAO,SAAS;AAChB;AAAA,IACF;AAKA,UAAM,QAAQ,kBAAkB,OAAO,MAAM,OAAO,IAAK;AACzD,QAAI,CAAC,MAAM,IAAI;AACb,aAAO,SAAS;AAChB,aAAO,SAAS,qBAAqB,MAAM,MAAM;AACjD,WAAK,IAAI,eAAe,OAAO,MAAM,SAAS,OAAO,MAAM;AAC3D;AAAA,IACF;AAEA,QAAI;AACF,YAAM,WAAW,MAAM,WAAO,+BAAc,UAAU,EAAE;AACxD,YAAM,WAAW,SAAS,WAAW,SAAS,UAAU;AACxD,YAAM,WAAW,OAAO,aAAa,aAAa,IAAI,SAAS,IAAI;AACnE,UAAI,CAAC,KAAK,oBAAoB,QAAQ,GAAG;AACvC,cAAM,IAAI,MAAM,iDAAiD;AAAA,MACnE;AAEA,aAAO,WAAW;AAClB,YAAM,SAAS,KAAK,KAAK,WAAW,MAAM,CAAC;AAC3C,YAAM,SAAS,MAAM;AACrB,aAAO,SAAS;AAChB,aAAO,SAAS,gBAAgB,UAAU;AAC1C,WAAK,IAAI,eAAe,OAAO,MAAM,WAAW,OAAO,MAAM;AAAA,IAC/D,SAAS,KAAK;AACZ,aAAO,SAAS;AAChB,aAAO,SAAS,OAAQ,IAAc,WAAW,GAAG;AACpD,WAAK,IAAI,eAAe,OAAO,MAAM,SAAS,OAAO,MAAM;AAAA,IAC7D;AAAA,EACF;AAAA,EAEQ,oBAAoB,YAAmC;AAC7D,UAAM,kBAAc,wBAAK,YAAY,cAAc;AACnD,UAAM,aAAuB,CAAC;AAC9B,YAAI,6BAAW,WAAW,GAAG;AAC3B,UAAI;AACF,cAAM,MAAM,KAAK,UAAM,+BAAa,aAAa,OAAO,CAAC;AACzD,YAAI,IAAI,KAAM,YAAW,SAAK,wBAAK,YAAY,IAAI,IAAI,CAAC;AAAA,MAC1D,QAAQ;AAAA,MAER;AAAA,IACF;AACA,eAAW,SAAK,wBAAK,YAAY,QAAQ,UAAU,OAAG,wBAAK,YAAY,UAAU,CAAC;AAClF,WAAO,WAAW,KAAK,CAAC,kBAAc,6BAAW,SAAS,CAAC,KAAK;AAAA,EAClE;AAAA,EAEQ,oBAAoB,OAA4C;AACtE,WAAO;AAAA,MACL,SACA,OAAO,UAAU,YACjB,OAAQ,MAA4B,SAAS,cAC7C,OAAQ,MAA4B,UAAU,cAC9C,OAAQ,MAA4B,SAAS;AAAA,IAC/C;AAAA,EACF;AAAA,EAEQ,WAAW,QAAsB;AACvC,WAAO;AAAA,MACL,QAAQ,OAAO,UAAU,EAAE,SAAS,KAAK;AAAA,MACzC,QAAQ,KAAK,UAAU,OAAO,IAAI;AAAA,MAClC,MAAM,CAAC,UAAuB,KAAK,IAAI,QAAQ,KAAK;AAAA,MACpD,WAAW,CAAC,WAAmB,YAA0C;AACvE,aAAK,IAAI,GAAG,SAAS,CAAC,UAAU;AAC9B,cAAI,MAAM,aAAa,aAAa,MAAM,WAAW,UAAW,SAAQ,KAAK;AAAA,QAC/E,CAAC;AAAA,MACH;AAAA,MACA,OAAO,CAAC,UAAuB;AAC7B,aAAK,IAAI,KAAK,SAAS,MAAM,SAAS;AAAA,UACpC,WAAW,oBAAI,KAAK;AAAA,UACpB,QAAQ,OAAO;AAAA,UACf,UAAU;AAAA,UACV,UAAU,MAAM;AAAA,UAChB,SAAS,MAAM;AAAA,UACf,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI;AAAA,QAC/C,CAAC;AAAA,MACH;AAAA,MACA,UAAU,CAAC,QAAgB,eAAe,OAAO,MAAM,GAAG;AAAA,MAC1D,UAAU,CAAC,KAAa,UAAmB,eAAe,OAAO,MAAM,KAAK,KAAK;AAAA,IACnF;AAAA,EACF;AAAA,EAEQ,UAAU,YAAoB;AACpC,WAAO;AAAA,MACL,OAAO,CAAC,QAAgB,SAAoB,QAAQ,MAAM,IAAI,UAAU,KAAK,GAAG,IAAI,GAAG,IAAI;AAAA,MAC3F,MAAM,CAAC,QAAgB,SAAoB,QAAQ,KAAK,IAAI,UAAU,KAAK,GAAG,IAAI,GAAG,IAAI;AAAA,MACzF,MAAM,CAAC,QAAgB,SAAoB,QAAQ,KAAK,IAAI,UAAU,KAAK,GAAG,IAAI,GAAG,IAAI;AAAA,MACzF,OAAO,CAAC,QAAgB,SAAoB,QAAQ,MAAM,IAAI,UAAU,KAAK,GAAG,IAAI,GAAG,IAAI;AAAA,IAC7F;AAAA,EACF;AACF;;;AQrRA,IAAI,cAA6B;AAGjC,IAAI,aAAkB;AAatB,IAAM,gBAAwC;AAAA,EAC5C,MAAM;AAAA,EACN,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AACZ;AAEA,eAAe,kBAAkB,QAA4C;AAC3E,MAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,KAAM,QAAO;AACzC,MAAI,YAAa,QAAO;AAExB,MAAI,CAAC,YAAY;AACf,QAAI;AACF,mBAAa,MAAM,OAAO,YAAY;AAAA,IACxC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,gBAAc,WAAW,gBAAgB;AAAA,IACvC,MAAM,OAAO;AAAA,IACb,MAAM,OAAO,QAAQ;AAAA,IACrB,QAAQ,OAAO,UAAU;AAAA,IACzB,MAAM,OAAO,QAAQ,OAAO,OAAO,EAAE,MAAM,OAAO,MAAM,MAAM,OAAO,KAAK,IAAI;AAAA,EAChF,CAAC;AACD,SAAO;AACT;AAEA,SAAS,cAAc,OAAoB,KAA2C;AACpF,MAAI,CAAC,IAAK,QAAO;AACjB,UAAQ,cAAc,MAAM,QAAQ,KAAK,OAAO,cAAc,GAAG,KAAK;AACxE;AAEA,SAAS,WAAW,OAAoD;AACtE,QAAM,KAAK,MAAM,UAAU,YAAY;AACvC,QAAM,KAAK,MAAM,YAAY;AAAA,aAAgB,MAAM,SAAS,KAAK;AACjE,QAAM,OACJ,IAAI,MAAM,SAAS,YAAY,CAAC,KAAK,MAAM,MAAM;AAAA;AAAA,EAC9C,MAAM,OAAO,GAAG,EAAE;AAAA;AAAA,QACZ,EAAE;AAAA,YAAe,MAAM,QAAQ;AAC1C,QAAM,OACJ,mGACgC,MAAM,SAAS,YAAY,CAAC,WAAM,MAAM,MAAM,WACxE,MAAM,OAAO,UAClB,MAAM,YAAY,wCAAwC,MAAM,SAAS,gBAAgB,MAC1F,gDAAgD,EAAE,SAAM,MAAM,QAAQ;AAExE,SAAO,EAAE,MAAM,KAAK;AACtB;AAEO,SAAS,YAAY,QAA2D;AACrF,SAAO,OAAO,UAAU;AACtB,QAAI,CAAC,cAAc,OAAO,OAAO,YAAY,EAAG;AAChD,UAAM,IAAI,MAAM,kBAAkB,MAAM;AACxC,QAAI,CAAC,EAAG;AAER,UAAM,KAAK,MAAM,QAAQ,OAAO,EAAE,IAAI,OAAO,GAAG,KAAK,IAAI,IAAI,OAAO;AACpE,QAAI,CAAC,GAAI;AAET,UAAM,EAAE,MAAM,KAAK,IAAI,WAAW,KAAK;AACvC,UAAM,EAAE,SAAS;AAAA,MACf,MAAM,OAAO;AAAA,MACb;AAAA,MACA,SAAS,gBAAgB,MAAM,QAAQ,KAAK,MAAM,MAAM,WAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,CAAC;AAAA,MACxF;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;ACpFA,IAAMC,iBAAwC;AAAA,EAC5C,MAAM;AAAA,EAAG,KAAK;AAAA,EAAG,QAAQ;AAAA,EAAG,MAAM;AAAA,EAAG,UAAU;AACjD;AAEA,IAAM,kBAA0C;AAAA,EAC9C,MAAM;AAAA;AAAA,EACN,KAAK;AAAA;AAAA,EACL,QAAQ;AAAA;AAAA,EACR,MAAM;AAAA;AAAA,EACN,UAAU;AAAA;AACZ;AAEO,SAAS,eAAe,QAA8D;AAC3F,SAAO,OAAO,UAAU;AACtB,QAAI,OAAO,cAAc;AACvB,YAAM,YAAYA,eAAc,MAAM,QAAQ,KAAK;AACnD,YAAM,UAAUA,eAAc,OAAO,YAAY,KAAK;AACtD,UAAI,YAAY,QAAS;AAAA,IAC3B;AAEA,UAAM,QAAQ;AAAA,MACZ,OAAO,GAAG,MAAM,aAAa,aAAa,cAAO,cAAI,KAAK,MAAM,SAAS,YAAY,CAAC,KAAK,MAAM,MAAM;AAAA,MACvG,aAAa,MAAM;AAAA,MACnB,OAAO,gBAAgB,MAAM,QAAQ,KAAK;AAAA,MAC1C,QAAQ;AAAA,QACN,GAAI,MAAM,YAAY,CAAC,EAAE,MAAM,aAAa,OAAO,KAAK,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,IAAI,CAAC;AAAA,QAChG,EAAE,MAAM,YAAY,OAAO,MAAM,UAAU,QAAQ,KAAK;AAAA,QACxD,EAAE,MAAM,QAAQ,OAAO,MAAM,UAAU,YAAY,GAAG,QAAQ,KAAK;AAAA,MACrE;AAAA,MACA,QAAQ,EAAE,MAAM,6BAA6B;AAAA,IAC/C;AAEA,UAAM,MAAM,OAAO,aAAa;AAAA,MAC9B,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAAA,IAC1C,CAAC;AAAA,EACH;AACF;;;ACtCA,IAAMC,iBAAwC;AAAA,EAC5C,MAAM;AAAA,EAAG,KAAK;AAAA,EAAG,QAAQ;AAAA,EAAG,MAAM;AAAA,EAAG,UAAU;AACjD;AAGA,IAAM,cAAsC;AAAA,EAC1C,MAAM;AAAA,EACN,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AACZ;AAEO,SAAS,iBAAiB,QAAgE;AAC/F,SAAO,OAAO,UAAU;AACtB,QAAI,OAAO,cAAc;AACvB,YAAM,YAAYA,eAAc,MAAM,QAAQ,KAAK;AACnD,YAAM,UAAUA,eAAc,OAAO,YAAY,KAAK;AACtD,UAAI,YAAY,QAAS;AAAA,IAC3B;AAEA,UAAM,UAAU;AAAA,MACd,aAAa,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,SAAS;AAAA,QACP,SAAS,IAAI,MAAM,SAAS,YAAY,CAAC,KAAK,MAAM,MAAM,KAAK,MAAM,OAAO;AAAA,QAC5E,QAAQ;AAAA,QACR,UAAU,YAAY,MAAM,QAAQ,KAAK;AAAA,QACzC,WAAW,MAAM,UAAU,YAAY;AAAA,QACvC,gBAAgB;AAAA,UACd,QAAQ,MAAM;AAAA,UACd,UAAU,MAAM;AAAA,UAChB,WAAW,MAAM;AAAA,UACjB,SAAS,MAAM;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,2CAA2C;AAAA,MACrD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,IAC9B,CAAC;AAAA,EACH;AACF;;;AC1CO,IAAM,kBAAN,MAAsB;AAAA,EAI3B,YAAoBC,MAAuB,QAA2B;AAAlD,eAAAA;AAAuB;AACzC,SAAK,aAAa;AAClB,IAAAA,KAAI,GAAG,SAAS,CAAC,UAAU;AAAE,WAAK,KAAK,SAAS,KAAK;AAAA,IAAG,CAAC;AAAA,EAC3D;AAAA,EAHoB;AAAA,EAAuB;AAAA,EAHnC,WAAsB,CAAC;AAAA,EACvB,aAAa,oBAAI,IAAsB;AAAA,EAOvC,eAAqB;AAC3B,UAAM,SAAS,KAAK,OAAO,UAAU,CAAC;AACtC,eAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,MAAM,GAAG;AAChD,YAAM,MAAM;AACZ,UAAI,CAAC,IAAI,QAAS;AAClB,UAAI,SAAS,aAAa,OAAO,IAAI,QAAQ,UAAU;AACrD,aAAK,SAAS,KAAK,eAAe,IAAI,KAAK,IAAI,MAA4B,CAAC;AAAA,MAC9E;AACA,UAAI,SAAS,WAAW,OAAO,IAAI,gBAAgB,UAAU;AAC3D,aAAK,SAAS,KAAK,aAAa,IAAI,WAAW,CAAC;AAAA,MAClD;AACA,UAAI,SAAS,WAAW,OAAO,IAAI,SAAS,YAAY,OAAO,IAAI,SAAS,UAAU;AACpF,aAAK,SAAS,KAAK,YAAY,GAA4B,CAAC;AAAA,MAC9D;AACA,UAAI,SAAS,aAAa,OAAO,IAAI,gBAAgB,UAAU;AAC7D,aAAK,SAAS,KAAK,eAAe,GAA+B,CAAC;AAAA,MACpE;AACA,UAAI,SAAS,eAAe,OAAO,IAAI,gBAAgB,UAAU;AAC/D,aAAK,SAAS,KAAK,iBAAiB,GAAiC,CAAC;AAAA,MACxE;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,eAAe,YAAoB,aAAqB,IAAa;AAC3E,UAAM,MAAM,OAAO,UAAU;AAC7B,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,OAAO;AACb,QAAI,aAAa,KAAK,WAAW,IAAI,GAAG,KAAK,CAAC;AAC9C,iBAAa,WAAW,OAAO,OAAK,IAAI,MAAM,IAAI;AAClD,QAAI,WAAW,UAAU,WAAY,QAAO;AAC5C,eAAW,KAAK,GAAG;AACnB,SAAK,WAAW,IAAI,KAAK,UAAU;AACnC,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,OAAmC;AACxD,UAAM,QAAQ,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,QAAQ;AAC/C,UAAI,CAAC,KAAK,eAAe,GAAG,EAAG,QAAO,QAAQ,QAAQ;AACtD,aAAO,GAAG,KAAK,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACjC,CAAC,CAAC;AAAA,EACJ;AACF;AAEA,SAAS,eAAe,KAAa,QAA0B;AAC7D,SAAO,OAAO,UAAU;AACtB,UAAM,OAAO,KAAK,UAAU,EAAE,MAAM,CAAC;AACrC,UAAM,UAAkC,EAAE,gBAAgB,mBAAmB;AAC7E,QAAI,OAAQ,SAAQ,yBAAyB,IAAI;AACjD,UAAM,MAAM,KAAK,EAAE,QAAQ,QAAQ,SAAS,KAAK,CAAC;AAAA,EACpD;AACF;AAEA,SAAS,aAAa,YAA6B;AACjD,SAAO,OAAO,UAAU;AACtB,UAAM,QAAQ,MAAM,aAAa,aAAa,qBAAqB;AACnE,UAAM,OAAO,GAAG,KAAK,MAAM,MAAM,SAAS,YAAY,CAAC,QAAQ,MAAM,MAAM,aAAQ,MAAM,OAAO,GAAG,MAAM,YAAY,UAAU,MAAM,SAAS,MAAM,EAAE;AACtJ,UAAM,MAAM,YAAY;AAAA,MACtB,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,KAAK,CAAC;AAAA,IAC/B,CAAC;AAAA,EACH;AACF;;;AChFA,IAAAC,mBAA8E;AAC9E,IAAAC,oBAAqB;AACrB,IAAAC,kBAAwB;AAEjB,IAAM,qBAAiB,4BAAK,yBAAQ,GAAG,cAAc;AACrD,IAAM,sBAAkB,wBAAK,gBAAgB,aAAa;AAa1D,SAAS,gBAA2B;AACzC,MAAI;AACF,WAAO,KAAK,UAAM,+BAAa,iBAAiB,OAAO,CAAC;AAAA,EAC1D,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAyBO,SAAS,aAAsB;AACpC,QAAM,MAAM,cAAc;AAC1B,MAAI,CAAC,IAAI,MAAO,QAAO;AACvB,MAAI,IAAI,cAAc,IAAI,aAAa,MAAO,KAAK,IAAI,EAAG,QAAO;AACjE,SAAO;AACT;AAEO,SAAS,cAAsC;AACpD,QAAM,MAAM,cAAc;AAC1B,QAAM,UAAkC,EAAE,gBAAgB,mBAAmB;AAC7E,MAAI,IAAI,MAAO,SAAQ,eAAe,IAAI,UAAU,IAAI,KAAK;AAC7D,SAAO;AACT;;;AC7DA,IAAAC,mBAAmE;AACnE,IAAAC,qBAAuC;;;ACDvC,IAAM,yBAAyB;AAE/B,IAAM,aAAa,CAAC,SAAS,MAAM,UAAQ,QAAU,OAAO,MAAM;AAElE,IAAM,cAAc,CAAC,SAAS,MAAM,UAAQ,QAAU,KAAK,MAAM,MAAM,IAAI;AAE3E,IAAM,cAAc,CAAC,SAAS,MAAM,CAAC,KAAK,OAAO,SAAS,QAAU,KAAK,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI;AAEzG,IAAM,SAAS;AAAA,EACd,UAAU;AAAA,IACT,OAAO,CAAC,GAAG,CAAC;AAAA;AAAA,IAEZ,MAAM,CAAC,GAAG,EAAE;AAAA,IACZ,KAAK,CAAC,GAAG,EAAE;AAAA,IACX,QAAQ,CAAC,GAAG,EAAE;AAAA,IACd,WAAW,CAAC,GAAG,EAAE;AAAA,IACjB,UAAU,CAAC,IAAI,EAAE;AAAA,IACjB,SAAS,CAAC,GAAG,EAAE;AAAA,IACf,QAAQ,CAAC,GAAG,EAAE;AAAA,IACd,eAAe,CAAC,GAAG,EAAE;AAAA,EACtB;AAAA,EACA,OAAO;AAAA,IACN,OAAO,CAAC,IAAI,EAAE;AAAA,IACd,KAAK,CAAC,IAAI,EAAE;AAAA,IACZ,OAAO,CAAC,IAAI,EAAE;AAAA,IACd,QAAQ,CAAC,IAAI,EAAE;AAAA,IACf,MAAM,CAAC,IAAI,EAAE;AAAA,IACb,SAAS,CAAC,IAAI,EAAE;AAAA,IAChB,MAAM,CAAC,IAAI,EAAE;AAAA,IACb,OAAO,CAAC,IAAI,EAAE;AAAA;AAAA,IAGd,aAAa,CAAC,IAAI,EAAE;AAAA,IACpB,MAAM,CAAC,IAAI,EAAE;AAAA;AAAA,IACb,MAAM,CAAC,IAAI,EAAE;AAAA;AAAA,IACb,WAAW,CAAC,IAAI,EAAE;AAAA,IAClB,aAAa,CAAC,IAAI,EAAE;AAAA,IACpB,cAAc,CAAC,IAAI,EAAE;AAAA,IACrB,YAAY,CAAC,IAAI,EAAE;AAAA,IACnB,eAAe,CAAC,IAAI,EAAE;AAAA,IACtB,YAAY,CAAC,IAAI,EAAE;AAAA,IACnB,aAAa,CAAC,IAAI,EAAE;AAAA,EACrB;AAAA,EACA,SAAS;AAAA,IACR,SAAS,CAAC,IAAI,EAAE;AAAA,IAChB,OAAO,CAAC,IAAI,EAAE;AAAA,IACd,SAAS,CAAC,IAAI,EAAE;AAAA,IAChB,UAAU,CAAC,IAAI,EAAE;AAAA,IACjB,QAAQ,CAAC,IAAI,EAAE;AAAA,IACf,WAAW,CAAC,IAAI,EAAE;AAAA,IAClB,QAAQ,CAAC,IAAI,EAAE;AAAA,IACf,SAAS,CAAC,IAAI,EAAE;AAAA;AAAA,IAGhB,eAAe,CAAC,KAAK,EAAE;AAAA,IACvB,QAAQ,CAAC,KAAK,EAAE;AAAA;AAAA,IAChB,QAAQ,CAAC,KAAK,EAAE;AAAA;AAAA,IAChB,aAAa,CAAC,KAAK,EAAE;AAAA,IACrB,eAAe,CAAC,KAAK,EAAE;AAAA,IACvB,gBAAgB,CAAC,KAAK,EAAE;AAAA,IACxB,cAAc,CAAC,KAAK,EAAE;AAAA,IACtB,iBAAiB,CAAC,KAAK,EAAE;AAAA,IACzB,cAAc,CAAC,KAAK,EAAE;AAAA,IACtB,eAAe,CAAC,KAAK,EAAE;AAAA,EACxB;AACD;AAEO,IAAM,gBAAgB,OAAO,KAAK,OAAO,QAAQ;AACjD,IAAM,uBAAuB,OAAO,KAAK,OAAO,KAAK;AACrD,IAAM,uBAAuB,OAAO,KAAK,OAAO,OAAO;AACvD,IAAM,aAAa,CAAC,GAAG,sBAAsB,GAAG,oBAAoB;AAE3E,SAAS,iBAAiB;AACzB,QAAM,QAAQ,oBAAI,IAAI;AAEtB,aAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACxD,eAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AACvD,aAAO,SAAS,IAAI;AAAA,QACnB,MAAM,QAAU,MAAM,CAAC,CAAC;AAAA,QACxB,OAAO,QAAU,MAAM,CAAC,CAAC;AAAA,MAC1B;AAEA,YAAM,SAAS,IAAI,OAAO,SAAS;AAEnC,YAAM,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAAA,IAC7B;AAEA,WAAO,eAAe,QAAQ,WAAW;AAAA,MACxC,OAAO;AAAA,MACP,YAAY;AAAA,IACb,CAAC;AAAA,EACF;AAEA,SAAO,eAAe,QAAQ,SAAS;AAAA,IACtC,OAAO;AAAA,IACP,YAAY;AAAA,EACb,CAAC;AAED,SAAO,MAAM,QAAQ;AACrB,SAAO,QAAQ,QAAQ;AAEvB,SAAO,MAAM,OAAO,WAAW;AAC/B,SAAO,MAAM,UAAU,YAAY;AACnC,SAAO,MAAM,UAAU,YAAY;AACnC,SAAO,QAAQ,OAAO,WAAW,sBAAsB;AACvD,SAAO,QAAQ,UAAU,YAAY,sBAAsB;AAC3D,SAAO,QAAQ,UAAU,YAAY,sBAAsB;AAG3D,SAAO,iBAAiB,QAAQ;AAAA,IAC/B,cAAc;AAAA,MACb,MAAM,KAAK,OAAO,MAAM;AAGvB,YAAI,QAAQ,SAAS,UAAU,MAAM;AACpC,cAAI,MAAM,GAAG;AACZ,mBAAO;AAAA,UACR;AAEA,cAAI,MAAM,KAAK;AACd,mBAAO;AAAA,UACR;AAEA,iBAAO,KAAK,OAAQ,MAAM,KAAK,MAAO,EAAE,IAAI;AAAA,QAC7C;AAEA,eAAO,KACH,KAAK,KAAK,MAAM,MAAM,MAAM,CAAC,IAC7B,IAAI,KAAK,MAAM,QAAQ,MAAM,CAAC,IAC/B,KAAK,MAAM,OAAO,MAAM,CAAC;AAAA,MAC7B;AAAA,MACA,YAAY;AAAA,IACb;AAAA,IACA,UAAU;AAAA,MACT,MAAM,KAAK;AACV,cAAM,UAAU,yBAAyB,KAAK,IAAI,SAAS,EAAE,CAAC;AAC9D,YAAI,CAAC,SAAS;AACb,iBAAO,CAAC,GAAG,GAAG,CAAC;AAAA,QAChB;AAEA,YAAI,CAAC,WAAW,IAAI;AAEpB,YAAI,YAAY,WAAW,GAAG;AAC7B,wBAAc,CAAC,GAAG,WAAW,EAAE,IAAI,eAAa,YAAY,SAAS,EAAE,KAAK,EAAE;AAAA,QAC/E;AAEA,cAAM,UAAU,OAAO,SAAS,aAAa,EAAE;AAE/C,eAAO;AAAA;AAAA,UAEL,WAAW,KAAM;AAAA,UACjB,WAAW,IAAK;AAAA,UACjB,UAAU;AAAA;AAAA,QAEX;AAAA,MACD;AAAA,MACA,YAAY;AAAA,IACb;AAAA,IACA,cAAc;AAAA,MACb,OAAO,SAAO,OAAO,aAAa,GAAG,OAAO,SAAS,GAAG,CAAC;AAAA,MACzD,YAAY;AAAA,IACb;AAAA,IACA,eAAe;AAAA,MACd,MAAM,MAAM;AACX,YAAI,OAAO,GAAG;AACb,iBAAO,KAAK;AAAA,QACb;AAEA,YAAI,OAAO,IAAI;AACd,iBAAO,MAAM,OAAO;AAAA,QACrB;AAEA,YAAI;AACJ,YAAI;AACJ,YAAI;AAEJ,YAAI,QAAQ,KAAK;AAChB,kBAAS,OAAO,OAAO,KAAM,KAAK;AAClC,kBAAQ;AACR,iBAAO;AAAA,QACR,OAAO;AACN,kBAAQ;AAER,gBAAM,YAAY,OAAO;AAEzB,gBAAM,KAAK,MAAM,OAAO,EAAE,IAAI;AAC9B,kBAAQ,KAAK,MAAM,YAAY,CAAC,IAAI;AACpC,iBAAQ,YAAY,IAAK;AAAA,QAC1B;AAEA,cAAM,QAAQ,KAAK,IAAI,KAAK,OAAO,IAAI,IAAI;AAE3C,YAAI,UAAU,GAAG;AAChB,iBAAO;AAAA,QACR;AAGA,YAAI,SAAS,MAAO,KAAK,MAAM,IAAI,KAAK,IAAM,KAAK,MAAM,KAAK,KAAK,IAAK,KAAK,MAAM,GAAG;AAEtF,YAAI,UAAU,GAAG;AAChB,oBAAU;AAAA,QACX;AAEA,eAAO;AAAA,MACR;AAAA,MACA,YAAY;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACV,OAAO,CAAC,KAAK,OAAO,SAAS,OAAO,cAAc,OAAO,aAAa,KAAK,OAAO,IAAI,CAAC;AAAA,MACvF,YAAY;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACV,OAAO,SAAO,OAAO,cAAc,OAAO,aAAa,GAAG,CAAC;AAAA,MAC3D,YAAY;AAAA,IACb;AAAA,EACD,CAAC;AAED,SAAO;AACR;AAEA,IAAM,aAAa,eAAe;AAElC,IAAO,sBAAQ;;;AC9Nf,0BAAoB;AACpB,IAAAC,kBAAe;AACf,sBAAgB;AAIhB,SAAS,QAAQ,MAAM,OAAO,WAAW,OAAO,WAAW,KAAK,OAAO,oBAAAC,QAAQ,MAAM;AACpF,QAAM,SAAS,KAAK,WAAW,GAAG,IAAI,KAAM,KAAK,WAAW,IAAI,MAAM;AACtE,QAAM,WAAW,KAAK,QAAQ,SAAS,IAAI;AAC3C,QAAM,qBAAqB,KAAK,QAAQ,IAAI;AAC5C,SAAO,aAAa,OAAO,uBAAuB,MAAM,WAAW;AACpE;AAEA,IAAM,EAAC,IAAG,IAAI,oBAAAA;AAEd,IAAI;AACJ,IACC,QAAQ,UAAU,KACf,QAAQ,WAAW,KACnB,QAAQ,aAAa,KACrB,QAAQ,aAAa,GACvB;AACD,mBAAiB;AAClB,WACC,QAAQ,OAAO,KACZ,QAAQ,QAAQ,KAChB,QAAQ,YAAY,KACpB,QAAQ,cAAc,GACxB;AACD,mBAAiB;AAClB;AAEA,SAAS,gBAAgB;AACxB,MAAI,iBAAiB,KAAK;AACzB,QAAI,IAAI,gBAAgB,QAAQ;AAC/B,aAAO;AAAA,IACR;AAEA,QAAI,IAAI,gBAAgB,SAAS;AAChC,aAAO;AAAA,IACR;AAEA,WAAO,IAAI,YAAY,WAAW,IAAI,IAAI,KAAK,IAAI,OAAO,SAAS,IAAI,aAAa,EAAE,GAAG,CAAC;AAAA,EAC3F;AACD;AAEA,SAAS,eAAe,OAAO;AAC9B,MAAI,UAAU,GAAG;AAChB,WAAO;AAAA,EACR;AAEA,SAAO;AAAA,IACN;AAAA,IACA,UAAU;AAAA,IACV,QAAQ,SAAS;AAAA,IACjB,QAAQ,SAAS;AAAA,EAClB;AACD;AAEA,SAAS,eAAe,YAAY,EAAC,aAAa,aAAa,KAAI,IAAI,CAAC,GAAG;AAC1E,QAAM,mBAAmB,cAAc;AACvC,MAAI,qBAAqB,QAAW;AACnC,qBAAiB;AAAA,EAClB;AAEA,QAAM,aAAa,aAAa,iBAAiB;AAEjD,MAAI,eAAe,GAAG;AACrB,WAAO;AAAA,EACR;AAEA,MAAI,YAAY;AACf,QAAI,QAAQ,WAAW,KACnB,QAAQ,YAAY,KACpB,QAAQ,iBAAiB,GAAG;AAC/B,aAAO;AAAA,IACR;AAEA,QAAI,QAAQ,WAAW,GAAG;AACzB,aAAO;AAAA,IACR;AAAA,EACD;AAIA,MAAI,cAAc,OAAO,gBAAgB,KAAK;AAC7C,WAAO;AAAA,EACR;AAEA,MAAI,cAAc,CAAC,eAAe,eAAe,QAAW;AAC3D,WAAO;AAAA,EACR;AAEA,QAAM,MAAM,cAAc;AAE1B,MAAI,IAAI,SAAS,QAAQ;AACxB,WAAO;AAAA,EACR;AAEA,MAAI,oBAAAA,QAAQ,aAAa,SAAS;AAGjC,UAAM,YAAY,gBAAAC,QAAG,QAAQ,EAAE,MAAM,GAAG;AACxC,QACC,OAAO,UAAU,CAAC,CAAC,KAAK,MACrB,OAAO,UAAU,CAAC,CAAC,KAAK,OAC1B;AACD,aAAO,OAAO,UAAU,CAAC,CAAC,KAAK,QAAS,IAAI;AAAA,IAC7C;AAEA,WAAO;AAAA,EACR;AAEA,MAAI,QAAQ,KAAK;AAChB,QAAI,CAAC,kBAAkB,iBAAiB,UAAU,EAAE,KAAK,SAAO,OAAO,GAAG,GAAG;AAC5E,aAAO;AAAA,IACR;AAEA,QAAI,CAAC,UAAU,YAAY,aAAa,aAAa,OAAO,EAAE,KAAK,UAAQ,QAAQ,GAAG,KAAK,IAAI,YAAY,YAAY;AACtH,aAAO;AAAA,IACR;AAEA,WAAO;AAAA,EACR;AAEA,MAAI,sBAAsB,KAAK;AAC9B,WAAO,gCAAgC,KAAK,IAAI,gBAAgB,IAAI,IAAI;AAAA,EACzE;AAEA,MAAI,IAAI,cAAc,aAAa;AAClC,WAAO;AAAA,EACR;AAEA,MAAI,IAAI,SAAS,eAAe;AAC/B,WAAO;AAAA,EACR;AAEA,MAAI,IAAI,SAAS,iBAAiB;AACjC,WAAO;AAAA,EACR;AAEA,MAAI,IAAI,SAAS,WAAW;AAC3B,WAAO;AAAA,EACR;AAEA,MAAI,kBAAkB,KAAK;AAC1B,UAAM,UAAU,OAAO,UAAU,IAAI,wBAAwB,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,EAAE;AAElF,YAAQ,IAAI,cAAc;AAAA,MACzB,KAAK,aAAa;AACjB,eAAO,WAAW,IAAI,IAAI;AAAA,MAC3B;AAAA,MAEA,KAAK,kBAAkB;AACtB,eAAO;AAAA,MACR;AAAA,IAED;AAAA,EACD;AAEA,MAAI,iBAAiB,KAAK,IAAI,IAAI,GAAG;AACpC,WAAO;AAAA,EACR;AAEA,MAAI,8DAA8D,KAAK,IAAI,IAAI,GAAG;AACjF,WAAO;AAAA,EACR;AAEA,MAAI,eAAe,KAAK;AACvB,WAAO;AAAA,EACR;AAEA,SAAO;AACR;AAEO,SAAS,oBAAoB,QAAQ,UAAU,CAAC,GAAG;AACzD,QAAM,QAAQ,eAAe,QAAQ;AAAA,IACpC,aAAa,UAAU,OAAO;AAAA,IAC9B,GAAG;AAAA,EACJ,CAAC;AAED,SAAO,eAAe,KAAK;AAC5B;AAEA,IAAM,gBAAgB;AAAA,EACrB,QAAQ,oBAAoB,EAAC,OAAO,gBAAAC,QAAI,OAAO,CAAC,EAAC,CAAC;AAAA,EAClD,QAAQ,oBAAoB,EAAC,OAAO,gBAAAA,QAAI,OAAO,CAAC,EAAC,CAAC;AACnD;AAEA,IAAO,yBAAQ;;;AC5LR,SAAS,iBAAiB,QAAQ,WAAW,UAAU;AAC7D,MAAI,QAAQ,OAAO,QAAQ,SAAS;AACpC,MAAI,UAAU,IAAI;AACjB,WAAO;AAAA,EACR;AAEA,QAAM,kBAAkB,UAAU;AAClC,MAAI,WAAW;AACf,MAAI,cAAc;AAClB,KAAG;AACF,mBAAe,OAAO,MAAM,UAAU,KAAK,IAAI,YAAY;AAC3D,eAAW,QAAQ;AACnB,YAAQ,OAAO,QAAQ,WAAW,QAAQ;AAAA,EAC3C,SAAS,UAAU;AAEnB,iBAAe,OAAO,MAAM,QAAQ;AACpC,SAAO;AACR;AAEO,SAAS,+BAA+B,QAAQ,QAAQ,SAAS,OAAO;AAC9E,MAAI,WAAW;AACf,MAAI,cAAc;AAClB,KAAG;AACF,UAAM,QAAQ,OAAO,QAAQ,CAAC,MAAM;AACpC,mBAAe,OAAO,MAAM,UAAW,QAAQ,QAAQ,IAAI,KAAM,IAAI,UAAU,QAAQ,SAAS,QAAQ;AACxG,eAAW,QAAQ;AACnB,YAAQ,OAAO,QAAQ,MAAM,QAAQ;AAAA,EACtC,SAAS,UAAU;AAEnB,iBAAe,OAAO,MAAM,QAAQ;AACpC,SAAO;AACR;;;ACzBA,IAAM,EAAC,QAAQ,aAAa,QAAQ,YAAW,IAAI;AAEnD,IAAM,YAAY,uBAAO,WAAW;AACpC,IAAM,SAAS,uBAAO,QAAQ;AAC9B,IAAM,WAAW,uBAAO,UAAU;AAGlC,IAAM,eAAe;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAEA,IAAMC,UAAS,uBAAO,OAAO,IAAI;AAEjC,IAAM,eAAe,CAAC,QAAQ,UAAU,CAAC,MAAM;AAC9C,MAAI,QAAQ,SAAS,EAAE,OAAO,UAAU,QAAQ,KAAK,KAAK,QAAQ,SAAS,KAAK,QAAQ,SAAS,IAAI;AACpG,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACtE;AAGA,QAAM,aAAa,cAAc,YAAY,QAAQ;AACrD,SAAO,QAAQ,QAAQ,UAAU,SAAY,aAAa,QAAQ;AACnE;AASA,IAAM,eAAe,aAAW;AAC/B,QAAMC,SAAQ,IAAI,YAAY,QAAQ,KAAK,GAAG;AAC9C,eAAaA,QAAO,OAAO;AAE3B,SAAO,eAAeA,QAAO,YAAY,SAAS;AAElD,SAAOA;AACR;AAEA,SAAS,YAAY,SAAS;AAC7B,SAAO,aAAa,OAAO;AAC5B;AAEA,OAAO,eAAe,YAAY,WAAW,SAAS,SAAS;AAE/D,WAAW,CAAC,WAAW,KAAK,KAAK,OAAO,QAAQ,mBAAU,GAAG;AAC5D,EAAAC,QAAO,SAAS,IAAI;AAAA,IACnB,MAAM;AACL,YAAM,UAAU,cAAc,MAAM,aAAa,MAAM,MAAM,MAAM,OAAO,KAAK,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC;AACvG,aAAO,eAAe,MAAM,WAAW,EAAC,OAAO,QAAO,CAAC;AACvD,aAAO;AAAA,IACR;AAAA,EACD;AACD;AAEAA,QAAO,UAAU;AAAA,EAChB,MAAM;AACL,UAAM,UAAU,cAAc,MAAM,KAAK,MAAM,GAAG,IAAI;AACtD,WAAO,eAAe,MAAM,WAAW,EAAC,OAAO,QAAO,CAAC;AACvD,WAAO;AAAA,EACR;AACD;AAEA,IAAM,eAAe,CAAC,OAAO,OAAO,SAAS,eAAe;AAC3D,MAAI,UAAU,OAAO;AACpB,QAAI,UAAU,WAAW;AACxB,aAAO,oBAAW,IAAI,EAAE,QAAQ,GAAG,UAAU;AAAA,IAC9C;AAEA,QAAI,UAAU,WAAW;AACxB,aAAO,oBAAW,IAAI,EAAE,QAAQ,oBAAW,aAAa,GAAG,UAAU,CAAC;AAAA,IACvE;AAEA,WAAO,oBAAW,IAAI,EAAE,KAAK,oBAAW,UAAU,GAAG,UAAU,CAAC;AAAA,EACjE;AAEA,MAAI,UAAU,OAAO;AACpB,WAAO,aAAa,OAAO,OAAO,MAAM,GAAG,oBAAW,SAAS,GAAG,UAAU,CAAC;AAAA,EAC9E;AAEA,SAAO,oBAAW,IAAI,EAAE,KAAK,EAAE,GAAG,UAAU;AAC7C;AAEA,IAAM,aAAa,CAAC,OAAO,OAAO,SAAS;AAE3C,WAAW,SAAS,YAAY;AAC/B,EAAAA,QAAO,KAAK,IAAI;AAAA,IACf,MAAM;AACL,YAAM,EAAC,MAAK,IAAI;AAChB,aAAO,YAAa,YAAY;AAC/B,cAAM,SAAS,aAAa,aAAa,OAAO,aAAa,KAAK,GAAG,SAAS,GAAG,UAAU,GAAG,oBAAW,MAAM,OAAO,KAAK,MAAM,CAAC;AAClI,eAAO,cAAc,MAAM,QAAQ,KAAK,QAAQ,CAAC;AAAA,MAClD;AAAA,IACD;AAAA,EACD;AAEA,QAAM,UAAU,OAAO,MAAM,CAAC,EAAE,YAAY,IAAI,MAAM,MAAM,CAAC;AAC7D,EAAAA,QAAO,OAAO,IAAI;AAAA,IACjB,MAAM;AACL,YAAM,EAAC,MAAK,IAAI;AAChB,aAAO,YAAa,YAAY;AAC/B,cAAM,SAAS,aAAa,aAAa,OAAO,aAAa,KAAK,GAAG,WAAW,GAAG,UAAU,GAAG,oBAAW,QAAQ,OAAO,KAAK,MAAM,CAAC;AACtI,eAAO,cAAc,MAAM,QAAQ,KAAK,QAAQ,CAAC;AAAA,MAClD;AAAA,IACD;AAAA,EACD;AACD;AAEA,IAAM,QAAQ,OAAO,iBAAiB,MAAM;AAAC,GAAG;AAAA,EAC/C,GAAGA;AAAA,EACH,OAAO;AAAA,IACN,YAAY;AAAA,IACZ,MAAM;AACL,aAAO,KAAK,SAAS,EAAE;AAAA,IACxB;AAAA,IACA,IAAI,OAAO;AACV,WAAK,SAAS,EAAE,QAAQ;AAAA,IACzB;AAAA,EACD;AACD,CAAC;AAED,IAAM,eAAe,CAAC,MAAM,OAAO,WAAW;AAC7C,MAAI;AACJ,MAAI;AACJ,MAAI,WAAW,QAAW;AACzB,cAAU;AACV,eAAW;AAAA,EACZ,OAAO;AACN,cAAU,OAAO,UAAU;AAC3B,eAAW,QAAQ,OAAO;AAAA,EAC3B;AAEA,SAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AACD;AAEA,IAAM,gBAAgB,CAAC,MAAM,SAAS,aAAa;AAGlD,QAAM,UAAU,IAAI,eAAe,WAAW,SAAU,WAAW,WAAW,IAAM,KAAK,WAAW,CAAC,IAAK,WAAW,KAAK,GAAG,CAAC;AAI9H,SAAO,eAAe,SAAS,KAAK;AAEpC,UAAQ,SAAS,IAAI;AACrB,UAAQ,MAAM,IAAI;AAClB,UAAQ,QAAQ,IAAI;AAEpB,SAAO;AACR;AAEA,IAAM,aAAa,CAAC,MAAM,WAAW;AACpC,MAAI,KAAK,SAAS,KAAK,CAAC,QAAQ;AAC/B,WAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EAC9B;AAEA,MAAI,SAAS,KAAK,MAAM;AAExB,MAAI,WAAW,QAAW;AACzB,WAAO;AAAA,EACR;AAEA,QAAM,EAAC,SAAS,SAAQ,IAAI;AAC5B,MAAI,OAAO,SAAS,MAAQ,GAAG;AAC9B,WAAO,WAAW,QAAW;AAI5B,eAAS,iBAAiB,QAAQ,OAAO,OAAO,OAAO,IAAI;AAE3D,eAAS,OAAO;AAAA,IACjB;AAAA,EACD;AAKA,QAAM,UAAU,OAAO,QAAQ,IAAI;AACnC,MAAI,YAAY,IAAI;AACnB,aAAS,+BAA+B,QAAQ,UAAU,SAAS,OAAO;AAAA,EAC3E;AAEA,SAAO,UAAU,SAAS;AAC3B;AAEA,OAAO,iBAAiB,YAAY,WAAWA,OAAM;AAErD,IAAM,QAAQ,YAAY;AACnB,IAAM,cAAc,YAAY,EAAC,OAAO,cAAc,YAAY,QAAQ,EAAC,CAAC;AAoBnF,IAAO,iBAAQ;;;AC7Nf,IAAMC,mBAAgE;AAAA,EACpE,MAAM,eAAM;AAAA,EACZ,KAAK,eAAM;AAAA,EACX,QAAQ,eAAM;AAAA,EACd,MAAM,eAAM;AAAA,EACZ,UAAU,eAAM,MAAM,MAAM;AAC9B;AAEA,IAAM,eAAsD;AAAA,EAC1D,OAAO,eAAM;AAAA,EACb,MAAM,eAAM;AAAA,EACZ,MAAM,eAAM;AAAA,EACZ,OAAO,eAAM;AACf;;;AChBA,IAAAC,kBAAe;AAqBR,SAAS,cAAwC;AACtD,SAAO,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,EAAE;AAC5D;AAEO,SAAS,UAAU,UAAyD;AACjF,QAAM,SAAS,YAAY;AAC3B,aAAW,KAAK,SAAU,QAAO,EAAE,QAAQ,KAAK,OAAO,EAAE,QAAQ,KAAK,KAAK;AAC3E,SAAO;AACT;AAEO,SAAS,WAAmB;AACjC,SAAO,GAAG,gBAAAC,QAAG,SAAS,CAAC,IAAI,QAAQ,GAAG;AACxC;;;ACiBA,IAAM,yBACJ;AAGF,IAAM,kBACJ;AAGF,IAAM,mBACJ;AAeF,IAAM,yBAAyB;AAG/B,IAAM,wBAAwB;AAgB9B,IAAM,sBAAsB,OAAO;AAKnC,IAAM,wBAAwB;AAEvB,IAAM,aAAkC;AAAA;AAAA,EAE7C;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA;AAAA;AAAA;AAAA,IAIF,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA;AAAA;AAAA,IAGT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA;AAAA;AAAA;AAAA,IAIT,cAAc;AAAA;AAAA;AAAA;AAAA,IAId,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA;AAAA;AAAA;AAAA,IAIF,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS,IAAI;AAAA,MACX,uDAAuD,qBAAqB,IAAI,mBAAmB;AAAA,IACrG;AAAA,IACA,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS,IAAI;AAAA,MACX,gCAAgC,qBAAqB,IAAI,mBAAmB,gCAC3C,qBAAqB,IAAI,mBAAmB;AAAA,IAC/E;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMtC,SAAS,IAAI;AAAA,MACX;AAAA,IAKF;AAAA,IACA,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS,IAAI;AAAA,MACX,iCAAiC,qBAAqB,IAAI,mBAAmB;AAAA,IAC/E;AAAA,IACA,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA,IAGtC,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA,IAGtC,SAAS;AAAA,IACT,WAAW;AAAA,IACX,UAAU;AAAA,EACZ;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,cAAc;AAAA,IACd,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQtC,SACE;AAAA;AAAA;AAAA;AAAA,IAIF,UAAU;AAAA,IACV,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUP,oBAAoB;AAAA,EACtB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,cAAc;AAAA,IACd,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,cAAc;AAAA,IACd,OAAO;AAAA;AAAA;AAAA;AAAA,IAIP,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,IAKtC,SACE;AAAA,IACF,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA;AAAA;AAAA;AAAA,IAIV,sBAAsB;AAAA,EACxB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA,IAGtC,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA;AAAA,IAItC,SACE;AAAA,IACF,UAAU;AAAA,EACZ;AACF;;;AC5aO,IAAM,iBAAsC,CAAC,QAAQ,OAAO,UAAU,QAAQ,UAAU;AAExF,SAAS,aAAa,UAA4B;AACvD,QAAM,QAAQ,eAAe,QAAQ,QAAQ;AAC7C,SAAO,UAAU,KAAK,IAAI;AAC5B;AASO,SAAS,YAAY,UAAoB,YAAkC;AAChF,MAAI,eAAe,UAAW,QAAO;AACrC,SAAO,aAAa,QAAQ,IAAI,aAAa,QAAQ,IAAI,WAAW;AACtE;;;AC+HA,IAAM,eACJ;AAEF,IAAM,eAAe;AAErB,IAAM,eAAe;AAErB,IAAM,eACJ;AAEF,IAAM,iBACJ;AAUF,IAAM,eACJ;AAGF,IAAM,gBACJ;AAEK,SAAS,oBAAoB,UAAgC;AAClE,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAmBO,IAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBX;AAAA;AAGF,IAAM,YACJ;AAUF,IAAM,mBACJ;AAGF,IAAM,YACJ;AAGF,IAAM,aAAa;AAyBnB,IAAM,eACJ;AAqBF,IAAM,gBAAgB,eAAe,YAAY;AACjD,IAAM,gBAAgB,eAAe,YAAY;AACjD,IAAM,aAAa,MAAM,aAAa,IAAI,aAAa;AAEhD,IAAM,aAAkC;AAAA;AAAA,EAE7C;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAeV,SAAS,IAAI;AAAA,MACX,GAAG,UAAU,WACR,UAAU,mBACV,UAAU;AAAA,MAEf;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SAAS,IAAI;AAAA,MACX,iBAAiB,YAAY,uCACR,YAAY,mCACZ,YAAY;AAAA,MACjC;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAmBA,4BAA4B;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM,MAAM;AAAA,IACxB,SAAS,IAAI;AAAA,MACX,8DAA8D,YAAY;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SACE;AAAA,EACJ;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,4BAA4B;AAAA;AAAA;AAAA;AAAA;AAAA,IAK5B,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,IAAI;AAAA,IAChB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAeT,WACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SAAS;AAAA,EACX;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA,IACV,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,IACT,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SAAS;AAAA,EACX;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAqCtC,SACE;AAAA,IACF,oBAAoB;AAAA,EACtB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,IACT,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SACE;AAAA,IACF,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,IAAI;AAAA,IAChB,SAAS;AAAA,IACT,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,cAAc;AAAA,IACd,mBAAmB;AAAA,EACrB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SAAS;AAAA,IACT,WAAW;AAAA;AAAA;AAAA;AAAA,IAIX,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SACE;AAAA,IACF,OAAO;AAAA,IACP,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA;AAAA;AAAA;AAAA,IAIlB,SAAS;AAAA,IACT,cAAc;AAAA,IACd,OAAO;AAAA,IACP,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,IACT,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SACE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA;AAAA;AAAA;AAAA,IAIpB,SACE;AAAA,IACF,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA;AAAA;AAAA;AAAA,IAIT,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOpB,SACE;AAAA,IACF,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAcV,WAAW,CAAC,cAAc,cAAc,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAC7E,SACE;AAAA,EACJ;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,IAKV,SAAS,IAAI;AAAA,MACX,OAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AAAA;AAAA,EAGA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,OAAO;AAAA;AAAA;AAAA,IAGnB,SAAS;AAAA;AAAA;AAAA;AAAA,IAIT,OAAO;AAAA;AAAA;AAAA,IAGP,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAenB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,IAKT,WACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAKnB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,OAAO;AAAA,IACnB,SACE;AAAA;AAAA;AAAA;AAAA;AAAA,IAKF,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,OAAO;AAAA,IACnB,SAAS;AAAA;AAAA,IAET,WACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,OAAO;AAAA,IACnB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,OAAO;AAAA;AAAA;AAAA;AAAA,IAInB,SAAS;AAAA,IACT,OAAO;AAAA,IACP,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA;AAAA;AAAA;AAAA,IAIjB,SAAS,IAAI;AAAA,MACX,sGAAsG,YAAY,kCAAkC,UAAU;AAAA,MAC9J;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA,IACjB,SACE;AAAA;AAAA;AAAA,IAGF,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA,IACjB,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA,IACjB,SACE;AAAA;AAAA;AAAA;AAAA,IAIF,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA,IACjB,SAAS;AAAA;AAAA,IAET,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA,IACjB,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA,IACjB,SACE;AAAA,IACF,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,KAAK;AAAA,IACjB,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA;AAAA;AAAA;AAAA,IAIlB,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SACE;AAAA,IACF,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA,IAClB,SACE;AAAA;AAAA;AAAA,IAGF,OAAO;AAAA,IACP,cAAc;AAAA,IACd,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,MAAM;AAAA;AAAA;AAAA,IAGlB,SACE;AAAA,IACF,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,IAAI;AAAA,IAChB,SACE;AAAA;AAAA;AAAA,IAGF,OAAO;AAAA,IACP,WAAW;AAAA,IACX,cAAc;AAAA,IACd,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,IAAI;AAAA;AAAA;AAAA,IAGhB,SAAS;AAAA,IACT,cAAc;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,IACF,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA;AAAA;AAAA;AAAA,IAIpB,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA;AAAA;AAAA;AAAA,IAIpB,SAAS;AAAA;AAAA;AAAA;AAAA,IAIT,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA;AAAA;AAAA,IAGpB,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SACE;AAAA,IACF,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,QAAQ;AAAA,IACpB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA;AAAA;AAAA;AAAA;AAAA,IAKF,WAAW;AAAA,IACX,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SAAS;AAAA,IACT,cAAc;AAAA,IACd,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,WAAW,CAAC,cAAc,YAAY;AAAA,IACtC,SACE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAmBF,WAAW;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,GAAG;AACL;AA+CA,IAAM,iBAAiB;AAWvB,IAAM,oBACJ;AAUK,SAAS,UAAU,MAAuB;AAC/C,SAAO,eAAe,KAAK,IAAI;AACjC;AAYO,SAAS,WAAW,OAAuC;AAChE,QAAM,SAAS,oBAAI,IAAY;AAC/B,MAAI,YAA2B;AAE/B,QAAM,QAAQ,CAAC,MAAM,UAAU;AAC7B,QAAI,WAAW;AACb,aAAO,IAAI,KAAK;AAChB,UAAI,KAAK,SAAS,SAAS,EAAG,aAAY;AAC1C;AAAA,IACF;AACA,eAAW,aAAa,CAAC,OAAO,KAAK,GAAG;AACtC,YAAM,QAAQ,KAAK,QAAQ,SAAS;AACpC,UAAI,UAAU,GAAI;AAElB,UAAI,KAAK,QAAQ,WAAW,QAAQ,UAAU,MAAM,MAAM,GAAI;AAC9D,kBAAY;AACZ,aAAO,IAAI,KAAK;AAChB;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAEA,SAAS,UAAU,MAAc,OAAe,OAAsC;AACpF,SAAO,UAAU,IAAI,KAAK,kBAAkB,KAAK,IAAI,MAAM,OAAO,IAAI,KAAK,KAAK;AAClF;AAEA,SAAS,WACP,OACA,OACA,MACA,SACA,OACQ;AACR,QAAM,OAAO,KAAK,IAAI,GAAG,QAAQ,IAAI;AACrC,QAAM,KAAK,KAAK,IAAI,MAAM,SAAS,GAAG,QAAQ,OAAO;AACrD,QAAM,YAAsB,CAAC;AAC7B,WAAS,IAAI,MAAM,KAAK,IAAI,KAAK,GAAG;AAClC,UAAM,OAAO,MAAM,CAAC,KAAK;AACzB,QAAI,MAAM,SAAS,UAAU,MAAM,GAAG,KAAK,EAAG;AAC9C,cAAU,KAAK,IAAI;AAAA,EACrB;AACA,SAAO,UAAU,KAAK,IAAI;AAC5B;AAWA,IAAM,YAAY,oBAAI,QAAmC;AAEzD,SAAS,WAAW,OAAkC;AACpD,MAAI,OAAO,UAAU,IAAI,KAAK;AAC9B,MAAI,SAAS,QAAW;AACtB,WAAO,MAAM,KAAK,IAAI;AACtB,cAAU,IAAI,OAAO,IAAI;AAAA,EAC3B;AACA,SAAO;AACT;AA6BA,SAAS,oBAAoB,MAAsB;AACjD,SAAO,KAAK,QAAQ,cAAc,IAAI;AACxC;AAsBA,SAAS,eAAe,MAAc,MAAsB;AAC1D,MAAI,MAAM;AACV,SAAO,MAAM,MAAM,KAAK,MAAM,CAAC,MAAM,OAAO,KAAK,MAAM,CAAC,MAAM,KAAO,QAAO;AAC5E,MAAI,QAAQ;AACZ,SAAO,QAAQ,KAAK,SAAS,KAAK,KAAK,QAAQ,CAAC,CAAE,EAAG,UAAS;AAC9D,SAAO,KAAK,MAAM,OAAO,GAAG;AAC9B;AAEO,SAAS,iBACd,OACA,OACA,MACU;AACV,QAAM,SAAS,MAAM,MAAM,KAAK,IAAI,GAAG,QAAQ,IAAI,GAAG,KAAK,EAAE,KAAK,IAAI;AACtE,QAAM,QAAkB,CAAC;AACzB,MAAI,QAAuB;AAE3B,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,GAAG;AACzC,UAAM,KAAK,OAAO,CAAC;AACnB,QAAI,OAAO;AACT,UAAI,OAAO,KAAM,MAAK;AAAA,eACb,OAAO,MAAO,SAAQ;AAC/B;AAAA,IACF;AACA,QAAI,OAAO,OAAO,OAAO,OAAO,OAAO,IAAK,SAAQ;AAAA,aAC3C,OAAO,IAAK,OAAM,KAAK,eAAe,QAAQ,CAAC,CAAC;AAAA,aAChD,OAAO,IAAK,OAAM,IAAI;AAAA,EACjC;AACA,SAAO;AACT;AAeA,SAAS,eAAe,MAA+B;AACrD,QAAM,QAAkB,CAAC;AACzB,WAAS,IAAI,OAAO;AAClB,UAAM,QAAQ,KAAK,QAAQ,MAAM,CAAC;AAClC,QAAI,UAAU,GAAI;AAClB,UAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ,CAAC;AACvC,QAAI,QAAQ,GAAI,QAAO;AACvB,UAAM,KAAK,KAAK,MAAM,QAAQ,GAAG,GAAG,EAAE,KAAK,CAAC;AAC5C,QAAI,MAAM;AAAA,EACZ;AACA,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAGA,SAAS,iBAAiB,MAAc,UAA2B;AACjE,QAAM,UAAU,KAAK,QAAQ,uBAAuB,MAAM;AAC1D,SAAO,IAAI;AAAA,IACT,eAAe,OAAO;AAAA,EACxB,EAAE,KAAK,QAAQ;AACjB;AAUA,SAAS,sBAAsB,MAAc,UAA2B;AACtE,QAAM,SAAS;AACf,MAAI,OAAO,KAAK,IAAI,EAAG,QAAO;AAE9B,QAAM,QAAQ,sCAAsC,KAAK,IAAI,IAAI,CAAC;AAClE,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,MAAM,QAAQ,uBAAuB,MAAM;AAC3D,SAAO,IAAI;AAAA,IACT,eAAe,OAAO;AAAA,IACtB;AAAA,EACF,EAAE,KAAK,QAAQ;AACjB;AAEA,SAAS,kBAAkB,MAAmC;AAC5D,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,OAAO,KAAK,WAAW,CAAC;AAC9B,SAAO,SAAS,OAAO,SAAS,OAAQ,QAAQ,MAAM,QAAQ,MAAQ,QAAQ,MAAM,QAAQ;AAC9F;AAEA,SAAS,iBAAiB,MAAmC;AAC3D,MAAI,kBAAkB,IAAI,EAAG,QAAO;AACpC,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,OAAO,KAAK,WAAW,CAAC;AAC9B,SAAO,QAAQ,MAAM,QAAQ;AAC/B;AAEA,SAAS,gBAAgB,MAAc,OAA8B;AACnE,MAAI,QAAQ;AACZ,SAAO,KAAK,KAAK,MAAM,OAAO,KAAK,KAAK,MAAM,IAAM,UAAS;AAC7D,MAAI,CAAC,kBAAkB,KAAK,KAAK,CAAC,EAAG,QAAO;AAC5C,QAAM,OAAO;AACb,SAAO,iBAAiB,KAAK,KAAK,CAAC,EAAG,UAAS;AAC/C,SAAO,KAAK,MAAM,MAAM,KAAK;AAC/B;AAGA,SAAS,qBAAqB,MAAc,UAA2B;AACrE,QAAM,WAAW,KAAK,QAAQ,iBAAiB;AAC/C,QAAM,WAAW,KAAK,QAAQ,WAAW;AACzC,QAAM,aAAa,YAAY,IAC3B,KAAK,QAAQ,KAAK,QAAQ,IAAI,IAC9B,YAAY,IACV,KAAK,QAAQ,KAAK,QAAQ,IAAI,IAC9B;AACN,MAAI,eAAe,EAAG,QAAO;AAE7B,QAAM,QAAQ,gBAAgB,MAAM,UAAU;AAC9C,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,cAAc,SAAS,KAAK;AAClC,aAAW,aAAa,SAAS,MAAM,IAAI,GAAG;AAC5C,UAAM,KAAK,UAAU,QAAQ,WAAW;AACxC,QAAI,OAAO,MAAM,iBAAiB,UAAU,KAAK,CAAC,CAAC,KAAK,iBAAiB,UAAU,KAAK,YAAY,MAAM,CAAC,GAAG;AAC5G;AAAA,IACF;AACA,UAAM,SAAS,UAAU,QAAQ,KAAK,KAAK,YAAY,MAAM;AAC7D,UAAM,cAAc,UAAU,MAAM,SAAS,CAAC;AAC9C,QACE,WAAW,MACX,CAAC,qBAAqB,oBAAoB,kBAAkB,EAAE,KAAK,CAAC,SAAS,YAAY,SAAS,IAAI,CAAC,GACvG;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,0BAA0B,MAAc,UAA2B;AACjF,QAAM,QAAQ,eAAe,IAAI;AACjC,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,MAAM;AAAA,IACX,CAAC,SAAS,qBAAqB,KAAK,IAAI,KAAK,iBAAiB,MAAM,QAAQ;AAAA,EAC9E;AACF;AAWA,IAAM,iBAAiB;AAWvB,IAAM,OAAO,OAAO;AAEpB,IAAM,qBAAqB,IAAI;AAAA,EAC7B,GAAG,IAAI;AACT;AASA,SAAS,kBAAkB,MAA6B;AACtD,SAAO,mBAAmB,KAAK,IAAI,IAAI,CAAC,KAAK;AAC/C;AAcA,IAAM,eAAkC;AAAA;AAAA,EAEtC;AAAA;AAAA,EAEA,IAAI,OAAO,GAAG,IAAI,oDAAoD,GAAG;AAAA;AAAA,EAEzE,IAAI,OAAO,GAAG,IAAI,kCAAkC,GAAG;AACzD;AAGA,SAAS,WAAW,MAAc,MAAuB;AACvD,aAAW,SAAS,cAAc;AAGhC,UAAM,YAAY;AAClB,aAAS,QAAQ,MAAM,KAAK,IAAI,GAAG,UAAU,MAAM,QAAQ,MAAM,KAAK,IAAI,GAAG;AAC3E,UAAI,MAAM,CAAC,MAAM,KAAM,QAAO;AAAA,IAChC;AAAA,EACF;AACA,SAAO;AACT;AAQO,SAAS,sBAAsB,KAA4B;AAChE,QAAM,OAAO,IAAI,MAAM,IAAI,KAAK,KAAK;AAIrC,MAAI,wDAAwD,KAAK,IAAI,EAAG,QAAO;AAE/E,QAAM,OAAO,kBAAkB,IAAI;AACnC,MAAI,CAAC,KAAM,QAAO;AAMlB,MAAI,WAAW,KAAK,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC,GAAG,IAAI,EAAG,QAAO;AAEhE,QAAM,OAAO,KAAK,IAAI,IAAI,MAAM,SAAS,GAAG,IAAI,QAAQ,cAAc;AACtE,WAAS,IAAI,IAAI,QAAQ,GAAG,KAAK,MAAM,KAAK,GAAG;AAC7C,UAAM,OAAO,IAAI,MAAM,CAAC,KAAK;AAC7B,QAAI,UAAU,MAAM,GAAG,IAAI,KAAK,EAAG;AACnC,QAAI,WAAW,MAAM,IAAI,EAAG,QAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEO,SAAS,aAAa,MAAgB,KAAqC;AAChF,MAAI,KAAK,aAAa,CAAC,KAAK,UAAU,SAAS,IAAI,QAAQ,EAAG,QAAO;AAErE,QAAM,OAAO,IAAI,MAAM,IAAI,KAAK,KAAK;AACrC,MAAI,UAAU,IAAI,KAAK,IAAI,OAAO,IAAI,IAAI,KAAK,EAAG,QAAO;AACzD,MAAI,CAAC,KAAK,QAAQ,KAAK,IAAI,EAAG,QAAO;AAIrC,MAAI,KAAK,gBAAgB,CAAC,KAAK,aAAa,KAAK,WAAW,IAAI,KAAK,CAAC,EAAG,QAAO;AAEhF,QAAM,OAAO,KAAK,aAAa;AAC/B,QAAM,UAAU,KAAK,gBAAgB;AACrC,QAAM,UAAU,WAAW,IAAI,OAAO,IAAI,OAAO,MAAM,SAAS,IAAI,KAAK;AAEzE,MAAI,KAAK,YAAY,CAAC,KAAK,SAAS,KAAK,OAAO,EAAG,QAAO;AAE1D,MAAI,KAAK,WAAW,KAAK,IAAI,EAAG,QAAO;AAEvC,MAAI,KAAK,oBAAoB;AAC3B,UAAM,UAAU,iBAAiB,IAAI,OAAO,IAAI,OAAO,IAAI;AAC3D,QAAI,QAAQ,KAAK,CAAC,WAAW,KAAK,mBAAoB,KAAK,MAAM,CAAC,EAAG,QAAO;AAAA,EAC9E;AAEA,MAAI,KAAK,8BAA8B,0BAA0B,MAAM,WAAW,IAAI,KAAK,CAAC,GAAG;AAC7F,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,sBAAsB,sBAAsB,MAAM,WAAW,IAAI,KAAK,CAAC,GAAG;AACjF,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,qBAAqB,qBAAqB,MAAM,WAAW,IAAI,KAAK,CAAC,GAAG;AAC/E,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,wBAAwB,sBAAsB,GAAG,EAAG,QAAO;AAEpE,QAAM,QAAQ,KAAK,UAAU,SAAY,gBAAgB,KAAK;AAC9D,MAAI,UAAU,MAAM,KAAK,IAAI,KAAK,MAAM,KAAK,OAAO,GAAI,QAAO;AAE/D,QAAM,YAAY,oBAAoB,IAAI,QAAQ;AAClD,QAAM,YAAY,IAAI,aAAa,UAAU,oBAAoB,IAAI,IAAI;AACzE,QAAM,eAAe,IAAI,aAAa,UAAU,oBAAoB,OAAO,IAAI;AAC/E,QAAM,aAAa,UAAU,KAAK,SAAS,KAAK,UAAU,KAAK,YAAY;AAC3E,MAAI,KAAK,gBAAgB,CAAC,WAAY,QAAO;AAK7C,QAAM,aAAyB,KAAK,WAChC,aACA,aACE,eACA;AACN,SAAO,EAAE,MAAM,YAAY,UAAU,YAAY,KAAK,UAAU,UAAU,EAAE;AAC9E;;;AC1+DA,IAAM,cAAc;AAEpB,IAAM,kBACJ;AAEK,IAAM,iBAA0C;AAAA,EACrD;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC,QAAQ,eAAe,SAAS,aAAa,KAAK;AAAA;AAAA,IAE/D,SAAS;AAAA,IACT,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC,QAAQ,SAAS,MAAM;AAAA,IACpC,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC,QAAQ,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAK5B,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC,QAAQ,MAAM;AAAA;AAAA;AAAA,IAG3B,SAAS;AAAA;AAAA,IAET,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC,SAAS,KAAK;AAAA;AAAA,IAE3B,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC,QAAQ,aAAa,SAAS,UAAU,WAAW,KAAK;AAAA,IACrE,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK;AAAA,IACL,UAAU;AAAA,IACV,YAAY,CAAC,OAAO;AAAA,IACpB,SAAS;AAAA,EACX;AACF;AAGO,IAAM,sBAA2C,IAAI;AAAA,EAC1D,eAAe,QAAQ,CAAC,SAAS,KAAK,UAAU;AAClD;AAcO,SAAS,sBACd,WACA,OACiB;AACjB,QAAM,MAAM,UAAU,YAAY;AAClC,QAAM,aAAa,eAAe,OAAO,CAAC,SAAS,KAAK,WAAW,SAAS,GAAG,CAAC;AAChF,MAAI,WAAW,WAAW,EAAG,QAAO,CAAC;AAErC,QAAM,UAA2B,CAAC;AAClC,QAAM,QAAQ,CAAC,MAAM,UAAU;AAC7B,eAAW,QAAQ,YAAY;AAC7B,UAAI,CAAC,KAAK,QAAQ,KAAK,IAAI,EAAG;AAC9B,UAAI,KAAK,WAAW,KAAK,IAAI,EAAG;AAChC,cAAQ,KAAK;AAAA,QACX;AAAA;AAAA;AAAA,QAGA,UAAU,YAAY,KAAK,UAAU,SAAS;AAAA,QAC9C,MAAM,QAAQ;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACD,SAAO;AACT;;;AClIA,IAAM,mBACJ;AAEK,IAAM,oBAAgD;AAAA,EAC3D;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,UACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA;AAAA;AAAA;AAAA,IAIV,UACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,UACE;AAAA,EACJ;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,KAAK;AAAA,IACL,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AACF;AASO,IAAM,eAAN,MAAmB;AAAA,EACP,OAAO,oBAAI,IAAY;AAAA;AAAA,EAEhC,aAA4B;AAAA,EAEpC,QAAQ,cAAsB,MAAoB;AAChD,QAAI,KAAK,eAAe,QAAQ,iBAAiB,KAAK,IAAI,GAAG;AAC3D,WAAK,aAAa;AAAA,IACpB;AACA,eAAW,WAAW,mBAAmB;AACvC,UAAI,KAAK,KAAK,IAAI,QAAQ,EAAE,EAAG;AAC/B,UAAI,QAAQ,SAAS,KAAK,IAAI,EAAG,MAAK,KAAK,IAAI,QAAQ,EAAE;AAAA,IAC3D;AAAA,EACF;AAAA;AAAA,EAGA,UAAsC;AACpC,QAAI,KAAK,eAAe,KAAM,QAAO,CAAC;AACtC,WAAO,kBAAkB,OAAO,CAAC,YAAY,CAAC,KAAK,KAAK,IAAI,QAAQ,EAAE,CAAC;AAAA,EACzE;AAAA,EAEA,WAA0B;AACxB,UAAM,SAAS,KAAK;AACpB,QAAI,WAAW,KAAM,QAAO,CAAC;AAE7B,WAAO,KAAK,QAAQ,EAAE,IAAI,CAAC,aAAa;AAAA,MACtC,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,MAAM;AAAA,MACN,MAAM;AAAA;AAAA;AAAA;AAAA,MAIN,UAAU,YAAY,QAAQ,UAAU,SAAS;AAAA,MACjD,YAAY;AAAA,MACZ,SAAS,GAAG,QAAQ,KAAK,4DAAuD,QAAQ,GAAG;AAAA,MAC3F,aAAa,QAAQ;AAAA,MACrB,KAAK,QAAQ;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,IACZ,EAAE;AAAA,EACJ;AACF;;;AC1HA,IAAM,cAAc;AAAA,EAClB;AAAA,EAAS;AAAA,EAAa;AAAA,EAAU;AAAA,EAAW;AAAA,EAAS;AAAA,EAAS;AAAA,EAAa;AAAA,EAC1E;AAAA,EAAU;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAc;AAAA,EAAW;AAAA,EAAQ;AAAA,EACtE;AAAA,EAAU;AAAA,EAAY;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAS;AAAA,EAClE;AAAA,EAAc;AAAA,EAAa;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAY;AAAA,EAAS;AAAA,EAClE;AAAA,EAAU;AAAA,EAAO;AAAA,EAAU;AAAA,EAAM;AAAA,EAAa;AAAA,EAAY;AAAA,EAAa;AAAA,EACvE;AAAA,EAAM;AAAA,EAAS;AAAA,EAAU;AAAA,EAAS;AAAA,EAAW;AAAA,EAAgB;AAAA,EAAU;AAAA,EACvE;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAU;AAAA,EAAe;AAAA,EAAU;AAAA,EAAc;AAAA,EACnE;AAAA,EAAc;AAAA,EAAW;AAAA,EAAS;AAAA,EAAU;AAAA,EAAW;AAAA,EAAS;AAAA,EAChE;AAAA,EAAe;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAU;AAAA,EAAW;AAAA,EAAQ;AACrE;AAEA,IAAM,eAAe;AAAA,EACnB;AAAA,EAAY;AAAA,EAAW;AAAA,EAAS;AAAA,EAAU;AAAA,EAAS;AAAA,EAAS;AAAA,EAAU;AAAA,EACtE;AAAA,EAAc;AAAA,EAAY;AAAA,EAAS;AAAA,EAAU;AAAA,EAAU;AAAA,EAAS;AAAA,EAChE;AAAA,EAAc;AAAA,EAAS;AAAA,EAAO;AAAA,EAAO;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAW;AAAA,EACnE;AAAA,EAAmB;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAO;AAAA,EAAS;AAAA,EAAU;AAAA,EAAQ;AAAA,EACvE;AAAA,EAAkB;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAc;AAAA,EAAW;AAAA,EAC7D;AAAA,EAAc;AAAA,EAAS;AAAA,EAAgB;AAAA,EAAU;AAAA,EAAa;AAAA,EAAS;AAAA,EACvE;AAAA,EAAU;AAAA,EAAS;AAAA,EAAY;AAAA,EAAW;AAAA,EAAgB;AAAA,EAAY;AACxE;AASA,IAAM,kBAAkB;AAGxB,SAAS,cAAc,MAAsB;AAC3C,SAAO,KAAK,YAAY,EAAE,QAAQ,MAAM,EAAE,EAAE,QAAQ,YAAY,EAAE;AACpE;AAUO,SAAS,aAAa,GAAW,GAAW,MAAM,GAAW;AAClE,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,KAAK,IAAI,EAAE,SAAS,EAAE,MAAM,IAAI,IAAK,QAAO,MAAM;AAEtD,QAAM,OAAmB,CAAC;AAC1B,WAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,KAAK,GAAG;AACrC,SAAK,KAAK,IAAI,MAAc,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;AACjD,SAAK,CAAC,EAAG,CAAC,IAAI;AAAA,EAChB;AACA,WAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,KAAK,EAAG,MAAK,CAAC,EAAG,CAAC,IAAI;AAErD,WAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,KAAK,GAAG;AACrC,aAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,KAAK,GAAG;AACrC,YAAM,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI;AACzC,UAAI,OAAO,KAAK;AAAA,QACd,KAAK,IAAI,CAAC,EAAG,CAAC,IAAK;AAAA,QACnB,KAAK,CAAC,EAAG,IAAI,CAAC,IAAK;AAAA,QACnB,KAAK,IAAI,CAAC,EAAG,IAAI,CAAC,IAAK;AAAA,MACzB;AACA,UAAI,IAAI,KAAK,IAAI,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG;AACpE,eAAO,KAAK,IAAI,MAAM,KAAK,IAAI,CAAC,EAAG,IAAI,CAAC,IAAK,CAAC;AAAA,MAChD;AACA,WAAK,CAAC,EAAG,CAAC,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,KAAK,EAAE,MAAM,EAAG,EAAE,MAAM;AACjC;AAeO,SAAS,gBAAgB,MAAc,WAAgD;AAC5F,QAAM,UAAU,cAAc,QAAQ,cAAc;AACpD,QAAM,QAAQ,KAAK,YAAY;AAoB/B,MAAI,YAAY,KAAK,KAAK,EAAG,QAAO;AAEpC,MAAI,QAAQ,SAAS,KAAK,EAAG,QAAO;AACpC,MAAI,MAAM,SAAS,EAAG,QAAO;AAE7B,QAAM,aAAa,cAAc,KAAK;AACtC,aAAW,aAAa,SAAS;AAC/B,UAAM,sBAAsB,cAAc,SAAS;AAInD,QAAI,eAAe,oBAAqB,QAAO,EAAE,cAAc,WAAW,MAAM,YAAY;AAC5F,QAAI,aAAa,YAAY,qBAAqB,CAAC,MAAM,GAAG;AAC1D,aAAO,EAAE,cAAc,WAAW,MAAM,OAAO;AAAA,IACjD;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAM,oBAAoB,CAAC,cAAc,WAAW,eAAe,WAAW,YAAY;AAU1F,SAAS,uBAAuB,MAAwB;AACtD,MAAI,OAAO,SAAS,SAAU,QAAO;AACrC,SAAO,6OAA6O,KAAK,IAAI;AAC/P;AASO,SAAS,gBAAgB,MAAiC;AAC/D,QAAM,WAA8B,CAAC;AACrC,QAAM,QAAQ,KAAK,MAAM,IAAI;AAE7B,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,CAAC,WAA2B;AACzC,UAAM,QAAQ,MAAM,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,GAAG,CAAC;AACpE,WAAO,UAAU,KAAK,IAAI,QAAQ;AAAA,EACpC;AAEA,QAAM,aAAa,CAAC,gBAAgB,mBAAmB,wBAAwB,kBAAkB;AACjG,aAAW,UAAU,YAAY;AAC/B,UAAM,OAAO,OAAO,MAAM;AAC1B,QAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,eAAW,QAAQ,OAAO,KAAK,IAA+B,GAAG;AAC/D,YAAM,OAAO,OAAO,IAAI;AAExB,UAAI,gBAAgB,KAAK,IAAI,GAAG;AAC9B,iBAAS,KAAK;AAAA,UACZ,QAAQ;AAAA,UACR,OAAO;AAAA,UACP;AAAA,UACA,UAAU;AAAA,UACV,KAAK;AAAA,UACL,SAAS,IAAI,IAAI;AAAA,UACjB,aACE;AAAA,UACF,UAAU,MAAM,OAAO,CAAC,KAAK,IAAI,KAAK;AAAA,QACxC,CAAC;AACD;AAAA,MACF;AAEA,YAAM,QAAQ,gBAAgB,MAAM,KAAK;AACzC,UAAI,OAAO;AACT,iBAAS,KAAK;AAAA,UACZ,QAAQ;AAAA,UACR,OAAO;AAAA,UACP;AAAA,UACA,UAAU;AAAA,UACV,KAAK;AAAA,UACL,SACE,MAAM,SAAS,cACX,IAAI,IAAI,mBAAmB,MAAM,YAAY,0BAC7C,IAAI,IAAI,uBAAuB,MAAM,YAAY;AAAA,UACvD,aACE;AAAA,UACF,UAAU,MAAM,OAAO,CAAC,KAAK,IAAI,KAAK;AAAA,QACxC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO;AACvB,MAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,eAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,OAAkC,GAAG;AAC7E,UAAI,CAAC,kBAAkB,SAAS,IAAI,EAAG;AACvC,UAAI,CAAC,uBAAuB,IAAI,EAAG;AACnC,eAAS,KAAK;AAAA,QACZ,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,OAAO,IAAI;AAAA,QACjB,UAAU;AAAA,QACV,KAAK;AAAA,QACL,SAAS,IAAI,IAAI,uFAAuF,OAAO,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC;AAAA,QAClI,aACE;AAAA,QACF,UAAU,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK;AAAA,MAChD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAGO,SAAS,oBAAoB,MAAiC;AACnE,QAAM,WAA8B,CAAC;AACrC,QAAM,QAAQ,KAAK,MAAM,IAAI;AAE7B,QAAM,QAAQ,CAAC,KAAK,UAAU;AAC5B,UAAM,OAAO,IAAI,KAAK;AACtB,QAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,EAAG;AAE3D,UAAM,QAAQ,wCAAwC,KAAK,IAAI;AAC/D,UAAM,OAAO,QAAQ,CAAC;AACtB,QAAI,CAAC,KAAM;AAEX,QAAI,gBAAgB,KAAK,IAAI,GAAG;AAC9B,eAAS,KAAK;AAAA,QACZ,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,QAAQ;AAAA,QACd,UAAU;AAAA,QACV,KAAK;AAAA,QACL,SAAS,IAAI,IAAI;AAAA,QACjB,aACE;AAAA,QACF,SAAS;AAAA,MACX,CAAC;AACD;AAAA,IACF;AAEA,UAAM,QAAQ,gBAAgB,MAAM,MAAM;AAC1C,QAAI,OAAO;AACT,eAAS,KAAK;AAAA,QACZ,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,MAAM,QAAQ;AAAA,QACd,UAAU;AAAA,QACV,KAAK;AAAA,QACL,SACE,MAAM,SAAS,cACX,IAAI,IAAI,mBAAmB,MAAM,YAAY,0BAC7C,IAAI,IAAI,uBAAuB,MAAM,YAAY;AAAA,QACvD,aACE;AAAA,QACF,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAED,SAAO;AACT;;;AClQO,IAAM,eAAsC;AAAA,EACjD;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SACE;AAAA,IACF,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA;AAAA,IAGN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA;AAAA;AAAA;AAAA,IAIN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,KAAK;AAAA,IACL,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AACF;AASA,IAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA;AACF;AAWO,SAAS,mBAAmB,MAAuB;AACxD,SAAO,mBAAmB,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AAChE;AAuCO,SAAS,uBAAuB,MAAc,OAAwB;AAC3E,QAAM,KAAK,KAAK,YAAY,KAAK;AACjC,MAAI,OAAO,GAAI,QAAO;AACtB,SAAO,iDAAiD,KAAK,KAAK,MAAM,GAAG,EAAE,CAAC;AAChF;AAsBO,SAAS,oBAAoB,OAAwB;AAC1D,QAAM,UAAU,MAAM,KAAK;AAI3B,QAAM,SAAS,wDAAwD,KAAK,OAAO;AACnF,MAAI,QAAQ;AACV,UAAM,WAAW,OAAO,CAAC;AACzB,QAAI,aAAa,UAAa,SAAS,KAAK,MAAM,GAAI,QAAO;AAC7D,WAAO,4BAA4B,KAAK,SAAS,KAAK,CAAC;AAAA,EACzD;AAEA,SACE,mBAAmB,KAAK,OAAO;AAAA,EAC/B,kBAAkB,KAAK,OAAO;AAAA,EAC9B,mBAAmB,KAAK,OAAO;AAAA,EAC/B,oBAAoB,KAAK,OAAO;AAAA,EAChC,iBAAiB,KAAK,OAAO;AAAA,EAC7B,kBAAkB,KAAK,OAAO;AAElC;AAGA,IAAM,gBAAgB;AAAA,EACpB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAW;AAAA,EAC9D;AAAA,EAAW;AAAA,EAAW;AAAA,EAAW;AAAA,EAAU;AAAA,EAAS;AAAA,EAAW;AAAA,EAC/D;AAAA,EAAY;AAAA,EAAU;AACxB;AASA,IAAM,YAAY,oBAAI,IAAI,CAAC,SAAS,QAAQ,UAAU,SAAS,SAAS,UAAU,OAAO,CAAC;AAG1F,SAAS,MAAM,MAAwB;AACrC,SAAO,KACJ,QAAQ,sBAAsB,OAAO,EACrC,QAAQ,eAAe,GAAG,EAC1B,YAAY,EACZ,MAAM,GAAG,EACT,OAAO,OAAO;AACnB;AA6BO,SAAS,mBAAmB,MAAc,OAAwB;AACvE,QAAM,aAAa,MAAM,KAAK;AAC9B,MAAI,WAAW,KAAK,CAAC,SAAS,cAAc,KAAK,CAAC,SAAS,KAAK,WAAW,IAAI,CAAC,CAAC,EAAG,QAAO;AAE3F,SAAO,mBAAmB,MAAM,KAAK;AACvC;AAiCO,SAAS,mBAAmB,MAAc,OAAwB;AACvE,MAAI,MAAM,SAAS,GAAI,QAAO;AAE9B,QAAM,UAAU,KAAK,YAAY,KAAK;AACtC,QAAM,MAAM,YAAY,KAAK,OAAO,KAAK,MAAM,GAAG,OAAO;AACzD,QAAM,YAAY,MAAM,KAAK,EAAE,KAAK,EAAE;AAEtC,SAAO,MAAM,GAAG,EACb,OAAO,CAAC,SAAS,KAAK,UAAU,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,EACzD,KAAK,CAAC,SAAS,UAAU,SAAS,IAAI,CAAC;AAC5C;AAUO,SAAS,aAAa,MAAsB;AACjD,SAAO,KAAK,QAAQ,6BAA6B,CAAC,UAAU;AAC1D,QAAI,MAAM,UAAU,GAAI,QAAO;AAC/B,WAAO,GAAG,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC;AAAA,EAC1E,CAAC;AACH;AAGO,IAAM,kBAAuF;AAAA,EAClG,EAAE,SAAS,QAAQ,SAAS,gFAA2E,UAAU,OAAO;AAAA,EACxH,EAAE,SAAS,cAAc,SAAS,oCAAoC,UAAU,OAAO;AAAA,EACvF,EAAE,SAAS,mBAAmB,SAAS,yCAAyC,UAAU,WAAW;AAAA,EACrG,EAAE,SAAS,UAAU,SAAS,6BAA6B,UAAU,WAAW;AAAA,EAChF,EAAE,SAAS,cAAc,SAAS,6BAA6B,UAAU,WAAW;AAAA,EACpF,EAAE,SAAS,YAAY,SAAS,6BAA6B,UAAU,WAAW;AAAA,EAClF,EAAE,SAAS,QAAQ,SAAS,yCAAyC,UAAU,OAAO;AAAA,EACtF,EAAE,SAAS,QAAQ,SAAS,8BAA8B,UAAU,OAAO;AAAA,EAC3E,EAAE,SAAS,QAAQ,SAAS,8BAA8B,UAAU,OAAO;AAAA,EAC3E,EAAE,SAAS,aAAa,SAAS,2BAA2B,UAAU,OAAO;AAAA;AAAA;AAAA;AAI/E;;;ACraA,SAAS,WAAW,MAAsB;AACxC,SAAO,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC;AAC7C;AAEA,SAAS,YAAY,MAAsB;AACzC,QAAM,OAAO,WAAW,IAAI;AAC5B,QAAM,MAAM,KAAK,YAAY,GAAG;AAChC,SAAO,OAAO,IAAI,KAAK,KAAK,MAAM,GAAG;AACvC;AAEO,IAAM,YAAY,oBAAI,IAAI;AAAA,EAC/B;AAAA,EAAgB;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAO;AAAA,EAClE;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAc;AAAA,EAAY;AAAA,EAAU;AAAA,EAC/D;AAAA,EAAU;AAAA,EAAW;AAAA,EAAS;AAAA,EAAW;AAAA,EAAoB;AAC/D,CAAC;AAEM,IAAM,kBAAkB,oBAAI,IAAI;AAAA,EACrC;AAAA,EAAO;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EACtD;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAS;AAAA,EAAO;AAAA,EAAU;AAAA,EAAQ;AAAA,EACvD;AAAA,EAAM;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAQ;AAAA,EAAO;AAAA,EAC1C;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAS;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAS;AAAA,EAC5D;AAAA,EAAO;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAe;AAAA,EAC9D;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/C,GAAG;AACL,CAAC;AAED,IAAM,wBAAsD;AAAA,EAC1D,OAAO;AAAA,EAAc,QAAQ;AAAA,EAAc,QAAQ;AAAA,EAAc,QAAQ;AAAA,EACzE,OAAO;AAAA,EAAc,QAAQ;AAAA,EAAc,QAAQ;AAAA,EAAc,QAAQ;AAAA,EACzE,QAAQ;AAAA,EAAc,WAAW;AAAA,EAAc,QAAQ;AAAA,EACvD,OAAO;AAAA,EACP,OAAO;AAAA,EAAQ,QAAQ;AAAA,EACvB,OAAO;AAAA,EACP,SAAS;AAAA,EAAQ,OAAO;AAAA,EAAQ,UAAU;AAAA,EAC1C,QAAQ;AAAA,EACR,OAAO;AAAA,EAAS,SAAS;AAAA,EAAS,QAAQ;AAAA,EAC1C,QAAQ;AAAA,EAAU,SAAS;AAAA,EAAU,SAAS;AAAA,EAAU,SAAS;AAAA,EACjE,QAAQ;AAAA,EAAU,QAAQ;AAAA,EAAU,SAAS;AAAA,EAAU,QAAQ;AAAA,EAC/D,OAAO;AAAA,EAAU,QAAQ;AAAA,EAAU,eAAe;AACpD;AAEO,SAAS,WAAW,UAAgC;AACzD,MAAI,SAAS,WAAW,MAAM,KAAK,SAAS,SAAS,MAAM,EAAG,QAAO;AACrE,SAAO,sBAAsB,YAAY,QAAQ,EAAE,YAAY,CAAC,KAAK;AACvE;AAGA,IAAM,0BAAwD;AAAA,EAC5D,IAAI;AAAA,EAAS,MAAM;AAAA,EAAS,KAAK;AAAA,EAAS,MAAM;AAAA,EAAS,KAAK;AAAA,EAAS,KAAK;AAAA,EAC5E,QAAQ;AAAA,EAAU,SAAS;AAAA,EAAU,SAAS;AAAA,EAC9C,MAAM;AAAA,EACN,MAAM;AAAA,EAAc,QAAQ;AAAA,EAAc,MAAM;AAAA,EAAc,KAAK;AAAA,EACnE,KAAK;AACP;AAcO,SAAS,kBAAkB,WAAwC;AACxE,QAAM,QAAQ,+BAA+B,KAAK,SAAS;AAC3D,MAAI,CAAC,MAAO,QAAO;AAGnB,QAAM,UAAU,WAAW,MAAM,CAAC,CAAE;AACpC,QAAM,OAAO,MAAM,CAAC,GAAG,KAAK,EAAE,MAAM,KAAK,KAAK,CAAC;AAC/C,QAAM,cAAc,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC,MAAM;AACpD,QAAM,OAAO,YAAY,QAAQ,WAAW,KAAK,cAAc,IAAI,CAAC,KAAK,EAAE,IAAI;AAE/E,QAAM,QAAQ,wBAAwB,IAAI;AAC1C,MAAI,MAAO,QAAO;AAGlB,QAAM,WAAW,KAAK,QAAQ,WAAW,EAAE;AAC3C,UAAQ,WAAW,wBAAwB,QAAQ,IAAI,WAAc;AACvE;AAiBA,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AAoCtB,IAAM,mBAAmB;AAElB,SAAS,oBAAoB,MAAuB;AACzD,SAAO,iBAAiB,KAAK,IAAI;AACnC;AAQO,SAAS,oBAAoB,OAAwC;AAC1E,QAAM,SAAS,oBAAI,IAAyB;AAC5C,MAAI,QAAQ;AAEZ,QAAM,MAAM,CAAC,OAAe,WAAqC;AAC/D,UAAM,WAAW,OAAO,IAAI,KAAK,KAAK,oBAAI,IAAY;AACtD,aAAS,IAAI,UAAU,GAAG;AAC1B,WAAO,IAAI,OAAO,QAAQ;AAC1B,aAAS;AAAA,EACX;AAEA,QAAM,QAAQ,CAAC,MAAM,UAAU;AAC7B,UAAM,OAAO,cAAc,KAAK,IAAI;AACpC,QAAI,KAAM,KAAI,QAAQ,GAAG,KAAK,CAAC,CAAC;AAChC,UAAM,OAAO,cAAc,KAAK,IAAI;AAGpC,QAAI,QAAQ,CAAC,KAAM,KAAI,OAAO,KAAK,CAAC,CAAC;AAAA,EACvC,CAAC;AAED,SAAO,EAAE,QAAQ,MAAM;AACzB;AAEA,SAAS,aAAa,cAA4B,OAAe,QAAyB;AACxF,QAAM,QAAQ,aAAa,OAAO,IAAI,KAAK;AAC3C,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,MAAM;AAC3C;AAYO,SAAS,WAAW,cAA+B;AACxD,QAAM,IAAI,aAAa,QAAQ,OAAO,GAAG;AACzC,SACE,wGAAwG,KAAK,CAAC,KAC9G,oCAAoC,KAAK,CAAC,KAC1C,+BAA+B,KAAK,CAAC,KACrC,kBAAkB,KAAK,CAAC;AAE5B;AAwBO,SAAS,UAAU,cAA+B;AACvD,QAAM,IAAI,aAAa,QAAQ,OAAO,GAAG;AACzC,SACE,0CAA0C,KAAK,CAAC,KAChD,mCAAmC,KAAK,CAAC;AAE7C;AAkBA,IAAM,kBAAwC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,UAAU,SAAgE;AACjF,SAAO,gBAAgB,KAAK,CAAC,WAAW,QAAQ,MAAM,CAAC,KAAK;AAC9D;AAGA,IAAM,mBAA8C;AAAA,EAClD,MAAM;AAAA,EACN,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,mBACE;AACJ;AAGA,IAAM,iBAA4C;AAAA,EAChD,MAAM;AAAA,EACN,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,mBAAmB;AACrB;AAGO,SAAS,SACd,cACA,MACA,WAAyB,WAAW,YAAY,GACjC;AACf,QAAM,WAA0B,CAAC;AACjC,QAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,QAAM,eAAe,oBAAoB,KAAK;AAC9C,QAAM,UAAU,WAAW,YAAY;AACvC,QAAM,SAAS,UAAU,YAAY;AAGrC,QAAM,QAAQ,CAAC,MAAM,UAAU;AAC7B,eAAW,QAAQ,cAAc;AAC/B,YAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI;AACpC,UAAI,CAAC,MAAO;AACZ,UAAI,mBAAmB,MAAM,CAAC,CAAC,EAAG;AAClC,UAAI,aAAa,cAAc,OAAO,KAAK,EAAE,EAAG;AAKhD,YAAM,QAAQ,MAAM,CAAC,KAAK,MAAM,CAAC;AAGjC,UAAI,oBAAoB,KAAK,EAAG;AAIhC,UAAI,WAAW,KAAK,iBAAiB,mBAAmB,MAAM,KAAK,EAAG;AActE,YAAM,OAAO,UAAU;AAAA,QACrB,MAAM;AAAA,QACN,YAAY,oBAAoB,IAAI;AAAA,QACpC,aAAa,uBAAuB,MAAM,KAAK;AAAA,QAC/C,mBAAmB,KAAK,kBAAkB,QAAQ,mBAAmB,MAAM,KAAK;AAAA,MAClF,CAAC;AAED,eAAS,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA;AAAA;AAAA,QAGd,UAAU,OAAO,QAAQ,KAAK;AAAA;AAAA,QAE9B,YAAY;AAAA,QACZ,SAAS,OACL,YAAY,KAAK,IAAI,aAAa,iBAAiB,IAAI,CAAC,KACxD,YAAY,KAAK,IAAI;AAAA,QACzB,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK;AAAA,QACV,SAAS,aAAa,KAAK,KAAK,CAAC,EAAE,MAAM,GAAG,GAAG;AAAA,QAC/C,WAAW;AAAA,QACX,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAGD,QAAM,QAAQ,WAAW,KAAK;AAC9B,QAAM,QAAQ,CAAC,OAAO,UAAU;AAC9B,eAAW,QAAQ,YAAY;AAC7B,UAAI,aAAa,cAAc,OAAO,KAAK,EAAE,EAAG;AAChD,YAAM,QAAQ,aAAa,MAAM,EAAE,OAAO,OAAO,UAAU,MAAM,CAAC;AAClE,UAAI,CAAC,MAAO;AAUZ,YAAM,OAAO,UAAU;AAAA,QACrB,MAAM;AAAA,QACN,MAAM;AAAA,QACN,YAAY,oBAAoB,MAAM,KAAK,KAAK,EAAE;AAAA,MACpD,CAAC;AAED,eAAS,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,UAAU,OAAO,QAAQ,MAAM;AAAA,QAC/B,YAAY,MAAM;AAAA,QAClB,SAAS,OAAO,GAAG,KAAK,KAAK,KAAK,KAAK,GAAG,YAAO,eAAe,IAAI,CAAC,KAAK,GAAG,KAAK,KAAK,KAAK,KAAK,GAAG;AAAA,QACpG,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK;AAAA,QACV,UAAU,MAAM,KAAK,KAAK,IAAI,KAAK,EAAE,MAAM,GAAG,GAAG;AAAA,QACjD,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAQD,aAAW,SAAS,sBAAsB,YAAY,YAAY,GAAG,KAAK,GAAG;AAC3E,UAAM,QAAQ,MAAM,OAAO;AAC3B,QAAI,aAAa,cAAc,OAAO,MAAM,KAAK,EAAE,EAAG;AAEtD,UAAM,OAAO,UAAU;AAAA,MACrB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,YAAY,oBAAoB,MAAM,KAAK,KAAK,EAAE;AAAA,IACpD,CAAC;AAED,aAAS,KAAK;AAAA,MACZ,QAAQ,MAAM,KAAK;AAAA,MACnB,OAAO,MAAM,KAAK;AAAA,MAClB,MAAM;AAAA,MACN,MAAM,MAAM;AAAA,MACZ,UAAU,OAAO,QAAQ,MAAM;AAAA,MAC/B,YAAY;AAAA,MACZ,SAAS,OACL,GAAG,MAAM,KAAK,KAAK,KAAK,MAAM,KAAK,GAAG,YAAO,eAAe,IAAI,CAAC,KACjE,GAAG,MAAM,KAAK,KAAK,KAAK,MAAM,KAAK,GAAG;AAAA,MAC1C,aAAa,MAAM,KAAK;AAAA,MACxB,KAAK,MAAM,KAAK;AAAA,MAChB,UAAU,MAAM,KAAK,KAAK,IAAI,KAAK,EAAE,MAAM,GAAG,GAAG;AAAA,MACjD,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEO,SAAS,aAAa,cAAsB,UAAkB,MAA6B;AAChG,QAAM,mBACJ,aAAa,iBACT,gBAAgB,IAAI,IACpB,aAAa,qBACX,oBAAoB,IAAI,IACxB,CAAC;AAET,SAAO,iBAAiB,IAAI,CAAC,aAAa;AAAA,IACxC,QAAQ,QAAQ;AAAA,IAChB,OAAO,QAAQ;AAAA,IACf,MAAM;AAAA,IACN,MAAM,QAAQ;AAAA,IACd,UAAU,QAAQ;AAAA,IAClB,YAAY;AAAA,IACZ,SAAS,QAAQ;AAAA,IACjB,aAAa,QAAQ;AAAA,IACrB,KAAK,QAAQ;AAAA,IACb,SAAS,QAAQ,QAAQ,MAAM,GAAG,GAAG;AAAA,IACrC,UAAU;AAAA,EACZ,EAAE;AACJ;;;ACheA,IAAAC,mBAEO;AACP,IAAAC,oBAAgE;AAuDzD,SAAS,gBAAgB,UAA2D;AACzF,QAAM,WAAW,SACd,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,EAAE,WAAW,GAAG,CAAC,EAChD,IAAI,cAAc;AACrB,MAAI,SAAS,WAAW,EAAG,QAAO,MAAM;AACxC,SAAO,CAAC,YAAY;AAClB,UAAM,OAAO,QAAQ,MAAM,GAAG;AAC9B,WAAO,SAAS,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;AAAA,EACrC;AACF;AAeA,IAAM,WAAW,uBAAO,UAAU;AAGlC,SAAS,eAAe,SAAuD;AAI7E,QAAM,cAAc,QAAQ,QAAQ,UAAU,EAAE;AAChD,MAAI,MAAM,YAAY;AACtB,SAAO,MAAM,KAAK,YAAY,MAAM,CAAC,MAAM,IAAK,QAAO;AACvD,QAAM,IAAI,YAAY,MAAM,GAAG,GAAG;AAIlC,MAAI,CAAC,EAAE,SAAS,GAAG,GAAG;AACpB,QAAI,MAAM,KAAM,QAAO,MAAM;AAC7B,UAAM,KAAK,YAAY,CAAC;AACxB,WAAO,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;AAAA,EAC9C;AAEA,QAAM,MAAM,EAAE,MAAM,GAAG;AAGvB,QAAM,mBAAmB,IAAI,IAAI,SAAS,CAAC,MAAM;AACjD,QAAM,OAAO,mBAAmB,IAAI,MAAM,GAAG,EAAE,IAAI;AACnD,QAAM,QAAsB,KAAK,IAAI,CAAC,MAAO,MAAM,OAAO,WAAW,YAAY,CAAC,CAAE;AAEpF,SAAO,CAAC,SAAS;AACf,UAAMC,OAAM,YAAY,OAAO,IAAI;AACnC,QAAIA,OAAM,EAAG,QAAO;AAIpB,WAAO,mBAAmBA,OAAM,KAAK,SAAS;AAAA,EAChD;AACF;AAGA,SAAS,YAAY,KAAqB;AACxC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,GAAG;AACtC,UAAM,IAAI,IAAI,CAAC;AACf,QAAI,MAAM,KAAK;AAGb,aAAO,IAAI,IAAI,CAAC,MAAM,IAAK,MAAK;AAChC,cAAQ;AAAA,IACV,WAAW,MAAM,KAAK;AACpB,cAAQ;AAAA,IACV,OAAO;AACL,cAAQ,EAAE,QAAQ,qBAAqB,MAAM;AAAA,IAC/C;AAAA,EACF;AACA,SAAO,IAAI,OAAO,IAAI,IAAI,GAAG;AAC/B;AAQA,SAAS,YAAY,OAA8B,MAAiC;AAClF,MAAI,KAAK;AACT,MAAI,KAAK;AACT,MAAI,OAAO;AACX,MAAI,SAAS;AAEb,SAAO,KAAK,MAAM,QAAQ;AACxB,UAAM,OAAO,MAAM,EAAE;AACrB,QAAI,SAAS,UAAU;AACrB,aAAO;AACP,eAAS;AACT,YAAM;AAAA,IACR,WAAW,KAAK,KAAK,UAAU,KAAK,KAAK,KAAK,EAAE,CAAE,GAAG;AACnD,YAAM;AACN,YAAM;AAAA,IACR,WAAW,SAAS,MAAM,SAAS,KAAK,QAAQ;AAC9C,gBAAU;AACV,WAAK;AACL,WAAK,OAAO;AAAA,IACd,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,eAAe,MAAwB;AAC9C,MAAI;AACF,eAAO,mCAAa,wBAAK,MAAM,oBAAoB,GAAG,OAAO,EAAE,MAAM,IAAI;AAAA,EAC3E,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAgCO,SAAS,SAAS,YAAoB,UAAuB,CAAC,GAAe;AAClF,QAAM,eAAe,QAAQ,gBAAgB,OAAO;AACpD,QAAM,UAAU,QAAQ,aAAa,IAAI,IAAI,QAAQ,UAAU,IAAI;AACnE,QAAM,WAA0B,CAAC;AACjC,QAAM,WAAW,IAAI,aAAa;AAClC,QAAM,aAAuB,CAAC;AAC9B,MAAI,eAAe;AACnB,MAAI,aAAa;AACjB,MAAI,WAAW;AAMf,QAAM,mBAAmB,MAAM;AAC7B,QAAI;AACF,iBAAO,2BAAS,UAAU,EAAE,YAAY;AAAA,IAC1C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF,GAAG;AACH,QAAM,WAAW,kBAAkB,iBAAa,2BAAQ,UAAU;AAKlE,QAAM,aAAa,gBAAgB,CAAC,GAAI,QAAQ,WAAW,CAAC,GAAI,GAAG,eAAe,QAAQ,CAAC,CAAC;AAE5F,QAAM,WAAW,CAAC,UAAkB,aAA2B;AAC7D,UAAM,eAAe,WAAW,UAAU,QAAQ;AAClD,UAAM,gBAAY,2BAAQ,QAAQ,EAAE,YAAY;AAChD,UAAM,aAAa,aAAa,kBAAkB,aAAa;AAC/D,UAAM,YAAY,gBAAgB,IAAI,SAAS,KAAK,SAAS,WAAW,MAAM;AAS9E,UAAM,wBAAwB,CAAC,aAAa,CAAC,cAAc,cAAc;AAEzE,QAAI,CAAC,aAAa,CAAC,cAAc,CAAC,uBAAuB;AACvD,0BAAoB,UAAU,cAAc,UAAU,CAAC,CAAC;AACxD;AAAA,IACF;AAaA,QAAI;AACJ,QAAI;AACJ,QAAI,WAAgC;AACpC,QAAI;AACF,mBAAS,2BAAS,UAAU,GAAG;AAAA,IACjC,QAAQ;AACN,iBAAW,KAAK,YAAY;AAC5B;AAAA,IACF;AAEA,QAAI;AACF,cAAI,4BAAU,MAAM,EAAE,OAAO,aAAc;AAK3C,UAAI,uBAAuB;AACzB,cAAM,SAAS,OAAO,MAAM,GAAG;AAC/B,cAAM,WAAO,2BAAS,QAAQ,QAAQ,GAAG,OAAO,QAAQ,CAAC;AACzD,mBAAW,kBAAkB,OAAO,SAAS,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,MAAM,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE;AAC/F,YAAI,CAAC,SAAU;AAAA,MACjB;AAEA,iBAAO,+BAAa,QAAQ,OAAO;AAAA,IACrC,QAAQ;AACN,iBAAW,KAAK,YAAY;AAC5B;AAAA,IACF,UAAE;AACA,UAAI;AACF,wCAAU,MAAM;AAAA,MAClB,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,oBAAgB;AAChB,YAAQ,SAAS,YAAY;AAC7B,kBAAc,oBAAoB,KAAK,MAAM,IAAI,CAAC,EAAE;AAKpD,aAAS,QAAQ,cAAc,IAAI;AAEnC,UAAM,eAAe;AAAA,MACnB,GAAG,SAAS,cAAc,MAAM,YAAY,WAAW,QAAQ,CAAC;AAAA,MAChE,GAAI,aAAa,aAAa,cAAc,UAAU,IAAI,IAAI,CAAC;AAAA,IACjE;AAEA,aAAS,KAAK,GAAG,YAAY;AAC7B,wBAAoB,UAAU,cAAc,UAAU,YAAY;AAAA,EACpE;AAEA,QAAM,OAAO,CAAC,gBAA8B;AAC1C,QAAI;AACJ,QAAI;AACF,oBAAU,8BAAY,aAAa,EAAE,eAAe,KAAK,CAAC;AAAA,IAC5D,QAAQ;AACN,iBAAW,KAAK,WAAW,UAAU,WAAW,CAAC;AACjD;AAAA,IACF;AAEA,eAAW,SAAS,SAAS;AAC3B,YAAM,eAAW,wBAAK,aAAa,MAAM,IAAI;AAC7C,YAAM,eAAe,WAAW,UAAU,QAAQ;AAElD,UAAI,MAAM,YAAY,GAAG;AACvB,YAAI,UAAU,IAAI,MAAM,IAAI,EAAG;AAG/B,YAAI,WAAW,YAAY,GAAG;AAC5B,sBAAY;AACZ;AAAA,QACF;AACA,aAAK,QAAQ;AACb;AAAA,MACF;AACA,UAAI,CAAC,MAAM,OAAO,EAAG;AACrB,UAAI,WAAW,YAAY,GAAG;AAC5B,oBAAY;AACZ;AAAA,MACF;AAEA,eAAS,UAAU,MAAM,IAAI;AAAA,IAC/B;AAAA,EACF;AAEA,MAAI,iBAAiB;AACnB,SAAK,UAAU;AAAA,EACjB,WAAW,WAAW,WAAW,UAAU,UAAU,CAAC,GAAG;AACvD,gBAAY;AAAA,EACd,OAAO;AACL,aAAS,gBAAY,4BAAS,UAAU,CAAC;AAAA,EAC3C;AAIA,MAAI,QAAQ,gBAAiB,UAAS,KAAK,GAAG,SAAS,SAAS,CAAC;AAEjE,QAAM,WAAW,UAAU,SAAS,OAAO,CAAC,MAAM,QAAQ,IAAI,EAAE,QAAQ,CAAC,IAAI;AAC7E,WAAS;AAAA,IACP,CAAC,GAAG,MACF,aAAa,EAAE,QAAQ,IAAI,aAAa,EAAE,QAAQ,KAClD,EAAE,KAAK,cAAc,EAAE,IAAI,KAC3B,EAAE,OAAO,EAAE;AAAA,EACf;AAEA,SAAO,EAAE,UAAU,UAAU,cAAc,YAAY,YAAY,UAAU,MAAM,SAAS;AAC9F;AAWA,SAAS,oBACP,UACA,cACA,MACA,cACM;AACN,MAAI,aAAa,SAAS,EAAG;AAE7B,aAAW,aAAa,iBAAiB;AACvC,UAAM,UAAU,aAAa,UAAU,WAAW,SAAS,SAAS,UAAU,OAAO;AACrF,QAAI,CAAC,QAAS;AACd,SAAK,KAAK;AAAA,MACR,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,MAAM;AAAA,MACN,MAAM;AAAA,MACN,UAAU,UAAU;AAAA,MACpB,YAAY;AAAA,MACZ,SAAS,UAAU;AAAA,MACnB,aAAa;AAAA,MACb,KAAK;AAAA,MACL,SAAS;AAAA,MACT,WAAW;AAAA,MACX,UAAU;AAAA,IACZ,CAAC;AACD;AAAA,EACF;AACF;AAEA,SAAS,WAAW,MAAc,QAAwB;AACxD,QAAM,UAAM,4BAAS,MAAM,MAAM;AACjC,UAAQ,QAAQ,KAAK,SAAS,KAAK,MAAM,qBAAG,EAAE,KAAK,GAAG;AACxD;;;ACxZA,IAAAC,mBAAyC;AACzC,IAAAC,oBAAqB;AAwBrB,IAAM,wBAAwB;AAE9B,eAAsB,iBAAiB,YAA4C;AACjF,QAAM,WAA0B,CAAC;AAEjC,aAAW,EAAE,MAAM,WAAW,MAAM,KAAK,WAAW;AAClD,UAAM,eAAW,wBAAK,YAAY,IAAI;AACtC,QAAI,KAAC,6BAAW,QAAQ,EAAG;AAE3B,QAAI;AACJ,QAAI;AACF,aAAO,OAAO,UAAM,+BAAa,UAAU,OAAO,CAAC,CAAC;AAAA,IACtD,QAAQ;AACN;AAAA,IACF;AAKA,QAAI,KAAK,WAAW,GAAG;AACrB,eAAS,KAAK,kBAAkB,MAAM,mDAAmD,CAAC;AAC1F;AAAA,IACF;AAEA,QAAI,KAAK,SAAS,uBAAuB;AACvC,eAAS;AAAA,QACP;AAAA,UACE;AAAA,UACA,kBAAkB,qBAAqB,OAAO,KAAK,MAAM;AAAA,QAC3D;AAAA,MACF;AAAA,IACF;AAEA,eAAW,OAAO,KAAK,MAAM,GAAG,qBAAqB,GAAG;AACtD,UAAI;AACJ,UAAI;AACF,gBAAQ,MAAM,SAAS,IAAI,MAAM,IAAI,SAAS,SAAS;AAAA,MACzD,QAAQ;AACN;AAAA,MACF;AAEA,iBAAW,QAAQ,OAAO;AACxB,cAAM,OAAO,KAAK,UAAU,KAAK,CAAC,UAAU,MAAM,SAAS,SAAS,GAAG;AACvE,iBAAS,KAAK;AAAA,UACZ,QAAQ;AAAA,UACR,OAAO;AAAA,UACP;AAAA,UACA,MAAM;AAAA,UACN,UAAU,iBAAiB,IAAI;AAAA,UAC/B,YAAY;AAAA,UACZ,SAAS,GAAG,IAAI,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,WAAW,KAAK,EAAE;AAAA,UAC/D,aAAa;AAAA,UACb,SAAS,GAAG,KAAK,EAAE,GAAG,OAAO,WAAW,IAAI,MAAM,EAAE;AAAA,UACpD,UAAU;AAAA,QACZ,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAOA,SAAS,kBAAkB,MAAc,SAA8B;AACrE,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,OAAO;AAAA,IACP;AAAA,IACA,MAAM;AAAA,IACN,UAAU;AAAA,IACV,YAAY;AAAA,IACZ;AAAA,IACA,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AACF;AAEA,SAAS,iBAAiB,OAAqC;AAC7D,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,OAAO,WAAW,KAAK;AACrC,MAAI,OAAO,MAAM,KAAK,EAAG,QAAO;AAChC,MAAI,SAAS,EAAG,QAAO;AACvB,MAAI,SAAS,EAAG,QAAO;AACvB,MAAI,SAAS,EAAG,QAAO;AACvB,SAAO;AACT;AAQA,SAAS,OAAO,MAA8C;AAC5D,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAA6B,CAAC;AACpC,aAAW,OAAO,MAAM;AACtB,UAAM,MAAM,GAAG,IAAI,IAAI,IAAI,IAAI,OAAO;AACtC,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AACZ,WAAO,KAAK,GAAG;AAAA,EACjB;AACA,SAAO;AACT;AASA,SAAS,iBAAiB,MAAuC;AAC/D,QAAM,KAAK,KAAK,YAAY,GAAG;AAC/B,MAAI,MAAM,EAAG,QAAO;AACpB,QAAM,OAAO,KAAK,MAAM,GAAG,EAAE;AAC7B,QAAM,UAAU,KAAK,MAAM,KAAK,CAAC;AACjC,MAAI,CAAC,QAAQ,CAAC,QAAS,QAAO;AAC9B,SAAO,EAAE,MAAM,QAAQ;AACzB;AAUA,SAAS,aAAa,KAA4B;AAChD,QAAM,UAAU,IAAI,KAAK,EAAE,QAAQ,UAAU,EAAE;AAC/C,SAAO,yBAAyB,KAAK,OAAO,IAAI,UAAU;AAC5D;AAEA,SAAS,iBAAiB,SAAqC;AAC7D,QAAM,OAAO,KAAK,MAAM,OAAO;AAI/B,QAAM,WAAW,KAAK,YAAY,KAAK,gBAAgB,CAAC;AACxD,QAAM,OAA2B,CAAC;AAClC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAGnD,UAAM,OAAO,IAAI,QAAQ,qBAAqB,EAAE;AAChD,UAAM,UAAU,OAAO;AACvB,QAAI,QAAQ,WAAW,CAAC,KAAK,WAAW,GAAG,EAAG,MAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AAAA,EAC3E;AACA,SAAO;AACT;AAkBA,SAAS,cAAc,SAAqC;AAC1D,QAAM,OAA2B,CAAC;AAClC,MAAI,aAAa;AAEjB,aAAW,QAAQ,QAAQ,MAAM,IAAI,GAAG;AACtC,QAAI,YAAY,KAAK,IAAI,GAAG;AAC1B,mBAAa,KAAK,WAAW,WAAW;AACxC;AAAA,IACF;AACA,QAAI,CAAC,WAAY;AAGjB,UAAM,QAAQ,sBAAsB,KAAK,IAAI;AAC7C,QAAI,CAAC,QAAQ,CAAC,EAAG;AAEjB,QAAI,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,gBAAgB,EAAE;AACpD,UAAM,IAAI,QAAQ,OAAO,EAAE;AAG3B,UAAM,IAAI,QAAQ,SAAS,EAAE;AAK7B,QAAI;AACJ,QAAI;AACJ,UAAM,UAAU,4BAA4B,KAAK,GAAG;AACpD,QAAI,UAAU,CAAC,KAAK,QAAQ,CAAC,GAAG;AAC9B,aAAO,QAAQ,CAAC;AAChB,mBAAa,QAAQ,CAAC;AAAA,IACxB,OAAO;AACL,YAAM,MAAM,iBAAiB,GAAG;AAChC,UAAI,CAAC,IAAK;AACV,aAAO,IAAI;AACX,mBAAa,IAAI;AAAA,IACnB;AAIA,UAAM,UAAU,aAAa,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAC3D,QAAI,QAAS,MAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AAAA,EAC1C;AAEA,SAAO;AACT;AAWA,SAAS,cAAc,SAAqC;AAC1D,QAAM,OAA2B,CAAC;AAClC,MAAI,cAA6B;AAEjC,aAAW,QAAQ,QAAQ,MAAM,IAAI,GAAG;AACtC,QAAI,KAAK,WAAW,GAAG,KAAK,KAAK,KAAK,MAAM,GAAI;AAEhD,QAAI,CAAC,MAAM,KAAK,IAAI,GAAG;AACrB,oBAAc;AACd,YAAM,SAAS,KAAK,QAAQ,SAAS,EAAE;AAGvC,YAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,QAAQ,gBAAgB,EAAE;AACrE,UAAI,CAAC,MAAO;AAEZ,UAAI,CAAC,MAAM,SAAS,GAAG,KAAK,UAAU,aAAc;AAKpD,UAAI,8CAA8C,KAAK,KAAK,EAAG;AAC/D,YAAM,MAAM,iBAAiB,MAAM,QAAQ,SAAS,GAAG,CAAC;AACxD,UAAI,IAAK,eAAc,IAAI;AAC3B;AAAA,IACF;AAEA,QAAI,CAAC,YAAa;AAClB,UAAM,UAAU,2CAA2C,KAAK,IAAI;AACpE,QAAI,CAAC,UAAU,CAAC,EAAG;AACnB,UAAM,QAAQ,aAAa,QAAQ,CAAC,CAAC;AACrC,QAAI,MAAO,MAAK,KAAK,EAAE,MAAM,aAAa,SAAS,MAAM,CAAC;AAC1D,kBAAc;AAAA,EAChB;AAEA,SAAO;AACT;AAGA,SAAS,iBAAiB,SAAqC;AAC7D,QAAM,OAAO,KAAK,MAAM,OAAO;AAC/B,QAAM,OAA2B,CAAC;AAElC,aAAW,WAAW,CAAC,WAAW,SAAS,GAAG;AAC5C,UAAM,WAAW,KAAK,OAAO;AAC7B,QAAI,CAAC,YAAY,OAAO,aAAa,SAAU;AAC/C,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAGpD,YAAM,UAAU,aAAa,OAAO,OAAO,WAAW,EAAE,EAAE,QAAQ,OAAO,EAAE,CAAC;AAC5E,UAAI,QAAQ,QAAS,MAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AAAA,IAClD;AAAA,EACF;AAEA,SAAO;AACT;AAQA,SAAS,qBAAqB,SAAqC;AACjE,QAAM,OAA2B,CAAC;AAElC,aAAW,OAAO,QAAQ,MAAM,IAAI,GAAG;AAGrC,UAAM,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACpD,QAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,EAAG;AAEnC,UAAM,QAAQ,wDAAwD,KAAK,IAAI;AAC/E,QAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAG;AAE9B,UAAM,UAAU,aAAa,MAAM,CAAC,CAAC;AACrC,QAAI,QAAS,MAAK,KAAK,EAAE,MAAM,MAAM,CAAC,GAAG,QAAQ,CAAC;AAAA,EACpD;AAEA,SAAO;AACT;AAEA,IAAM,YAAwC;AAAA,EAC5C,EAAE,MAAM,qBAAqB,WAAW,OAAO,OAAO,iBAAiB;AAAA,EACvE,EAAE,MAAM,kBAAkB,WAAW,OAAO,OAAO,cAAc;AAAA,EACjE,EAAE,MAAM,aAAa,WAAW,OAAO,OAAO,cAAc;AAAA,EAC5D,EAAE,MAAM,oBAAoB,WAAW,QAAQ,OAAO,qBAAqB;AAAA,EAC3E,EAAE,MAAM,gBAAgB,WAAW,QAAQ,OAAO,iBAAiB;AACrE;AAGO,IAAM,mBAA6D,OAAO;AAAA,EAC/E,UAAU,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,MAAM,KAAK,CAAC;AACpD;AAGA,SAAS,mBAAmB,MAAuB;AACjD,SAAO,6BAA6B,KAAK,IAAI;AAC/C;AAEA,SAAS,eAAe,SAA0B;AAChD,SAAO,2BAA2B,KAAK,OAAO;AAChD;AAEA,eAAe,SAAS,MAAc,SAAiB,WAAgD;AACrG,MAAI,CAAC,mBAAmB,IAAI,KAAK,CAAC,eAAe,OAAO,EAAG,QAAO,CAAC;AAEnE,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,gCAAgC;AAAA,MAC3D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,GAAG,QAAQ,CAAC;AAAA,MAC9D,QAAQ,YAAY,QAAQ,GAAI;AAAA,IAClC,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,QAAO,CAAC;AAC1B,UAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,KAAK,SAAS,CAAC;AAAA,EACxB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;;;AC/WA,IAAAC,sBAA2B;AAC3B,IAAAC,oBAAmD;;;AjBiCnD,SAAS,cAAsB;AAC7B,aAAW,aAAa;AAAA,QACtB,yBAAK,WAAW,MAAM,cAAc;AAAA,QACpC,yBAAK,WAAW,MAAM,MAAM,cAAc;AAAA,EAC5C,GAAG;AACD,QAAI;AACF,aACG,KAAK,UAAM,+BAAa,WAAW,OAAO,CAAC,EAA2B,WAAW;AAAA,IAEtF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAM,cAAc,YAAY;AAmBhC,SAAS,YACP,YACA,UACA,cACW;AACX,QAAM,aAAkC,SAAS,IAAI,CAAC,aAAa;AAAA,IACjE,MAAM,QAAQ;AAAA,IACd,UAAU,QAAQ;AAAA,IAClB,SAAS,QAAQ;AAAA,IACjB,UAAU,GAAG,QAAQ,IAAI,IAAI,QAAQ,IAAI;AAAA,IACzC,SAAS;AAAA,MACP,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,SAAS,QAAQ;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB,YAAY,QAAQ;AAAA,MACpB,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,IAC5C;AAAA,EACF,EAAE;AACF,QAAM,SAAS,UAAU,UAAU;AAEnC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,kBAAkB;AAAA,IAClB,SACE,SAAS,WAAW,IAChB,0BAA0B,YAAY,WACtC,GAAG,SAAS,MAAM,cAAc,OAAO,QAAQ,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,KAAK,OAAO,GAAG;AAAA,EACxG;AACF;AAEA,SAAS,aAAa,YAAoB,SAA4B;AACpE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU,CAAC;AAAA,IACX,kBAAkB,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,EAAE;AAAA,IACrE,SAAS,gBAAgB,OAAO;AAAA,IAChC,OAAO;AAAA,EACT;AACF;AASA,eAAsB,QAAQ,YAAwC;AACpE,MAAI;AACF,UAAM,SAAS,SAAS,UAAU;AAClC,UAAM,WAAW,CAAC,GAAG,OAAO,UAAU,GAAI,MAAM,iBAAiB,UAAU,CAAE;AAC7E,WAAO,YAAY,YAAY,UAAU,OAAO,YAAY;AAAA,EAC9D,SAAS,KAAK;AACZ,WAAO,aAAa,YAAa,IAAc,OAAO;AAAA,EACxD;AACF;;;AkB1IA,IAAM,iBAAiB;AAAA,EACrB;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,SAAiB,6DAA6D,KAAK,IAAI;AAAA,IAC9F,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,KAAa,SAAiB,KAAK,SAAS,eAAe,KAAK,KAAK,SAAS,iBAAiB;AAAA,IACtG,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,MAAc,OAAe,YAAoC;AACtE,YAAM,WAAW,CAAC,0BAA0B,mBAAmB,2BAA2B;AAC1F,YAAM,UAAU,SAAS,OAAO,OAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AAC9D,aAAO,QAAQ,SAAS;AAAA,IAC1B;AAAA,IACA,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,MAAc,OAAe,YAAoC;AACtE,aAAO,CAAC,EAAE,QAAQ,QAAQ,KAAK,2BAA2B,KAAK,QAAQ,QAAQ,CAAC;AAAA,IAClF;AAAA,IACA,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,SAAiB,0CAA0C,KAAK,IAAI;AAAA,IAC3E,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,SAAiB,mDAAmD,KAAK,IAAI;AAAA,IACpF,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA;AAAA,EAEA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,MAAc,OAAe,YAAoC;AACtE,YAAM,OAAO,QAAQ,6BAA6B;AAClD,aAAO,SAAS,OAAO,SAAS;AAAA,IAClC;AAAA,IACA,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,MAAc,OAAe,YAAoC;AACtE,YAAM,YAAY,QAAQ,YAAY,KAAK;AAC3C,aAAO,UAAU,SAAS,MAAM,CAAC,UAAU,SAAS,UAAU,KAAK,CAAC,UAAU,SAAS,QAAQ;AAAA,IACjG;AAAA,IACA,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,MAAc,OAAe,YAAoC;AACtE,aAAO,CAAC,QAAQ,yBAAyB;AAAA,IAC3C;AAAA,IACA,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM,CAAC,SAAiB,sDAAsD,KAAK,IAAI;AAAA,IACvF,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AACF;AAEA,eAAsB,WAAW,QAAoC;AACnE,QAAM,YAAY,OAAO,WAAW,MAAM,IAAI,SAAS,WAAW,MAAM;AACxE,QAAM,UAAU,MAAM,sBAAsB,SAAS;AACrD,QAAM,aAAkC,QAAQ,IAAI,CAAC,OAAO;AAAA,IAC1D,MAAM,EAAE;AAAA,IACR,UAAU,EAAE,aAAa,QAAQ,QAAS,EAAE;AAAA,IAC5C,SAAS,EAAE;AAAA,IACX,UAAU,EAAE;AAAA,IACZ,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EAC/C,EAAE;AACF,QAAM,SAAS,UAAU,UAAU;AACnC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,kBAAkB;AAAA,IAClB,SAAS,WAAW,WAAW,IAC3B,gCACA,GAAG,WAAW,MAAM,cAAc,OAAO,QAAQ,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,KAAK,OAAO,GAAG;AAAA,EACxG;AACF;AAEA,eAAe,sBAAsB,WAA6C;AAChF,QAAM,UAA2B,CAAC;AAClC,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,WAAW,EAAE,UAAU,SAAS,CAAC;AAC1D,UAAM,UAAkC,CAAC;AACzC,SAAK,QAAQ,QAAQ,CAAC,GAAG,MAAM;AAAE,cAAQ,CAAC,IAAI;AAAA,IAAG,CAAC;AAClD,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,eAAW,SAAS,gBAAgB;AAClC,UAAI;AACF,YAAI,MAAM,KAAK,MAAM,MAAM,OAAO,GAAG;AACnC,kBAAQ,KAAK,EAAE,KAAK,WAAW,MAAM,MAAM,MAAM,UAAU,MAAM,UAAU,SAAS,MAAM,QAAQ,CAAC;AAAA,QACrG;AAAA,MACF,QAAQ;AAAA,MAAa;AAAA,IACvB;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,CAAC,cAAc,0BAA0B,cAAc;AAC5E,aAAW,WAAW,cAAc;AAClC,QAAI;AACF,YAAM,UAAU,GAAG,SAAS,OAAO,mBAAmB,OAAO,CAAC;AAC9D,YAAM,OAAO,MAAM,MAAM,SAAS,EAAE,UAAU,UAAU,QAAQ,YAAY,QAAQ,GAAI,EAAE,CAAC;AAC3F,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAI,yDAAyD,KAAK,IAAI,GAAG;AACvE,gBAAQ,KAAK,EAAE,KAAK,SAAS,MAAM,iBAAiB,UAAU,YAAY,SAAS,2BAA2B,OAAO,GAAG,CAAC;AAAA,MAC3H;AAAA,IACF,QAAQ;AAAA,IAAa;AAAA,EACvB;AAEA,QAAM,iBAAiB,CAAC,oBAAoB,0BAA0B,wBAAwB;AAC9F,aAAW,QAAQ,gBAAgB;AACjC,QAAI;AACF,YAAM,UAAU,GAAG,SAAS,IAAI,IAAI;AACpC,YAAM,OAAO,MAAM,MAAM,SAAS,EAAE,UAAU,UAAU,QAAQ,YAAY,QAAQ,GAAI,EAAE,CAAC;AAC3F,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAI,+CAA+C,KAAK,IAAI,GAAG;AAC7D,gBAAQ,KAAK,EAAE,KAAK,SAAS,MAAM,kBAAkB,UAAU,YAAY,SAAS,oCAAoC,IAAI,GAAG,CAAC;AAAA,MAClI;AAAA,IACF,QAAQ;AAAA,IAAa;AAAA,EACvB;AAEA,QAAM,UAAU,CAAC,WAAW,SAAS,UAAU,KAAK;AACpD,aAAW,UAAU,SAAS;AAC5B,QAAI;AACF,YAAM,OAAO,MAAM,MAAM,WAAW,EAAE,QAAQ,QAAQ,YAAY,QAAQ,GAAI,EAAE,CAAC;AACjF,UAAI,KAAK,SAAS,OAAO,WAAW,WAAW;AAC7C,gBAAQ,KAAK,EAAE,KAAK,WAAW,MAAM,uBAAuB,MAAM,IAAI,UAAU,UAAU,SAAS,GAAG,MAAM,oBAAoB,KAAK,MAAM,IAAI,CAAC;AAAA,MAClJ;AACA,UAAI,WAAW,WAAW;AACxB,cAAM,QAAQ,KAAK,QAAQ,IAAI,OAAO;AACtC,YAAI,SAAS,oBAAoB,KAAK,KAAK,GAAG;AAC5C,kBAAQ,KAAK,EAAE,KAAK,WAAW,MAAM,gBAAgB,UAAU,OAAO,SAAS,oBAAoB,KAAK,GAAG,CAAC;AAAA,QAC9G;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAa;AAAA,EACvB;AAEA,SAAO;AACT;;;ACzKA,IAAM,UAAU,QAAQ,IAAI,uBAAuB;AACnD,IAAM,mBAAmB;AACzB,IAAM,uBAAuB;AAiBtB,IAAM,aAAN,MAAiB;AAAA,EAMtB,YAAoBC,MAAe;AAAf,eAAAA;AAAA,EAAgB;AAAA,EAAhB;AAAA,EALZ,YAAmC;AAAA,EACnC,gBAAuC;AAAA,EACvC,UAAU;AAAA,EACV,SAAmB,CAAC;AAAA,EAI5B,MAAM,QAAuB;AAC3B,QAAI,CAAC,WAAW,EAAG;AAEnB,QAAI;AACF,YAAM,KAAK,YAAY;AAAA,IACzB,QAAQ;AAAA,IAER;AAEA,SAAK,IAAI,eAAe,eAAe,WAAW,QAAQ,mBAAmB,GAAI,GAAG;AACpF,SAAK,KAAK;AACV,SAAK,aAAa;AAClB,SAAK,YAAY,YAAY,MAAM,KAAK,KAAK,GAAG,gBAAgB;AAChE,SAAK,gBAAgB,YAAY,MAAM,KAAK,aAAa,GAAG,oBAAoB;AAAA,EAClF;AAAA,EAEA,OAAa;AACX,QAAI,KAAK,UAAW,eAAc,KAAK,SAAS;AAChD,QAAI,KAAK,cAAe,eAAc,KAAK,aAAa;AACxD,SAAK,YAAY;AACjB,SAAK,gBAAgB;AACrB,SAAK,IAAI,eAAe,eAAe,SAAS;AAAA,EAClD;AAAA,EAEA,MAAc,eAA8B;AAC1C,QAAI,CAAC,WAAW,EAAG;AACnB,QAAI;AACF,UAAI,KAAK,OAAO,WAAW,EAAG,OAAM,KAAK,YAAY;AACrD,iBAAW,SAAS,KAAK,QAAQ;AAC/B,YAAI;AACF,gBAAM,MAAM,GAAG,OAAO,aAAa,KAAK,mBAAmB;AAAA,YACzD,QAAQ;AAAA,YACR,SAAS,YAAY;AAAA,UACvB,CAAC;AAAA,QACH,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAc,OAAsB;AAClC,QAAI,KAAK,QAAS;AAClB,QAAI,CAAC,WAAW,EAAG;AAEnB,SAAK,UAAU;AACf,QAAI;AACF,UAAI,KAAK,OAAO,WAAW,EAAG,OAAM,KAAK,YAAY;AACrD,iBAAW,SAAS,KAAK,QAAQ;AAC/B,cAAM,UAAU,MAAM,KAAK,SAAS,KAAK;AACzC,YAAI,CAAC,QAAS;AAEd,cAAM,SAAS,MAAM,KAAK,QAAQ,OAAO;AACzC,cAAM,KAAK,SAAS,OAAO,SAAS,MAAM;AAAA,MAC5C;AAAA,IACF,QAAQ;AAAA,IAER,UAAE;AACA,WAAK,UAAU;AAAA,IACjB;AAAA,EACF;AAAA,EAEA,MAAc,cAA6B;AACzC,UAAM,MAAM,MAAM,MAAM,GAAG,OAAO,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;AACzE,QAAI,CAAC,IAAI,GAAI;AACb,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,SAAK,UAAU,KAAK,iBAAiB,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,EAC1D;AAAA,EAEA,MAAc,SAAS,OAA2C;AAChE,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,GAAG,OAAO,aAAa,KAAK,iBAAiB;AAAA,QACnE,QAAQ;AAAA,QACR,SAAS,YAAY;AAAA,QACrB,MAAM,KAAK,UAAU,EAAE,WAAW,SAAS,EAAE,CAAC;AAAA,MAChD,CAAC;AACD,UAAI,CAAC,IAAI,GAAI,QAAO;AACpB,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,KAAK,OAAO;AAAA,IACrB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,QAAQ,KAAqC;AACzD,UAAM,SAAS,IAAI,UAAU;AAC7B,QAAI,CAAC,QAAQ;AACX,aAAO;AAAA,QACL,MAAM,IAAI;AAAA,QACV,QAAQ;AAAA,QACR,UAAU,CAAC;AAAA,QACX,kBAAkB,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,EAAE;AAAA,QACrE,SAAS;AAAA,QACT,OAAO;AAAA,MACT;AAAA,IACF;AAEA,SAAK,IAAI,eAAe,eAAe,WAAW,GAAG,IAAI,IAAI,IAAI,IAAI,UAAU,QAAQ,MAAM,EAAE;AAE/F,QAAI;AACF,UAAI,IAAI,SAAS,OAAQ,QAAO,MAAM,QAAQ,MAAM;AACpD,aAAO,MAAM,WAAW,MAAM;AAAA,IAChC,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,MAAM,IAAI;AAAA,QACV;AAAA,QACA,UAAU,CAAC;AAAA,QACX,kBAAkB,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,EAAE;AAAA,QACrE,SAAS,WAAY,IAAc,OAAO;AAAA,QAC1C,OAAQ,IAAc;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,SAAS,OAAe,SAAqB,QAAkC;AAC3F,QAAI;AACF,YAAM;AAAA,QACJ,GAAG,OAAO,aAAa,KAAK,eAAe,QAAQ,WAAW,SAAS,QAAQ,EAAE;AAAA,QACjF;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,YAAY;AAAA,UACrB,MAAM,KAAK,UAAU;AAAA,YACnB,QAAQ,OAAO,QAAQ,WAAW;AAAA,YAClC,gBAAgB,OAAO,SAAS;AAAA,YAChC,kBAAkB,OAAO;AAAA,YACzB,SAAS,OAAO;AAAA,YAChB,UAAU,OAAO;AAAA,YACjB,OAAO,OAAO;AAAA,YACd,QAAQ;AAAA,YACR,WAAW,SAAS;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER,UAAE;AACA,WAAK,IAAI,eAAe,eAAe,MAAM;AAAA,IAC/C;AAAA,EACF;AACF;;;AC1IO,IAAM,aAAN,MAAiB;AAAA,EAItB,YAAoB,aAQR;AARQ;AAAA,EAQP;AAAA,EARO;AAAA,EAHZ,QAAyB,CAAC;AAAA,EAC1B,UAAU,oBAAI,IAAyB;AAAA,EAY/C,UAAU,OAA8B;AACtC,SAAK,QAAQ,MAAM,OAAO,OAAK,EAAE,YAAY,KAAK;AAAA,EACpD;AAAA,EAEA,WAA4B;AAC1B,WAAO,CAAC,GAAG,KAAK,KAAK;AAAA,EACvB;AAAA,EAEA,SAAS,OAA0B;AACjC,UAAM,MAAM,KAAK,IAAI;AAErB,eAAW,QAAQ,KAAK,OAAO;AAE7B,UAAI,KAAK,aAAa,SAAS,KAAK,CAAC,KAAK,aAAa,SAAS,MAAM,MAAM,KAAK,CAAC,KAAK,aAAa,SAAS,MAAM,QAAQ,GAAG;AAC5H;AAAA,MACF;AAGA,UAAI,CAAC,KAAK,iBAAiB,OAAO,KAAK,KAAK,EAAG;AAG/C,YAAM,YAAY,GAAG,KAAK,EAAE,IAAI,MAAM,aAAa,QAAQ;AAC3D,UAAI,SAAS,KAAK,QAAQ,IAAI,SAAS;AACvC,UAAI,CAAC,QAAQ;AACX,iBAAS,EAAE,QAAQ,CAAC,GAAG,WAAW,EAAE;AACpC,aAAK,QAAQ,IAAI,WAAW,MAAM;AAAA,MACpC;AAGA,aAAO,OAAO,KAAK,EAAE,WAAW,KAAK,MAAM,CAAC;AAG5C,YAAM,SAAS,MAAO,KAAK,iBAAiB;AAC5C,aAAO,SAAS,OAAO,OAAO,OAAO,OAAK,EAAE,aAAa,MAAM;AAG/D,UAAI,OAAO,OAAO,SAAS,KAAK,UAAW;AAG3C,UAAI,OAAO,YAAY,KAAM,MAAM,OAAO,YAAc,KAAK,mBAAmB,IAAO;AAGvF,aAAO,YAAY;AACnB,aAAO,SAAS,CAAC;AAEjB,WAAK,YAAY;AAAA,QACf,SAAS,KAAK;AAAA,QACd,UAAU,KAAK;AAAA,QACf,OAAO,KAAK;AAAA,QACZ,aAAa,GAAG,KAAK,WAAW,KAAK,KAAK,SAAS,cAAc,KAAK,cAAc;AAAA,QACpF,WAAW,MAAM;AAAA,QACjB,UAAU,MAAM,SAAS,QAAkB;AAAA,QAC3C,cAAc;AAAA,UACZ,cAAc,KAAK;AAAA,UACnB,MAAM,KAAK;AAAA,UACX,UAAU,KAAK;AAAA,UACf,aAAa,KAAK;AAAA,QACpB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEQ,iBAAiB,OAAoB,OAA2B;AACtE,UAAM,aAAa,KAAK,cAAc,OAAO,MAAM,KAAK;AACxD,QAAI,eAAe,OAAW,QAAO;AAErC,UAAM,WAAW,OAAO,UAAU;AAClC,QAAI,SAAS;AAEb,YAAQ,MAAM,UAAU;AAAA,MACtB,KAAK;AACH,iBAAS,SAAS,YAAY,EAAE,SAAS,OAAO,MAAM,KAAK,EAAE,YAAY,CAAC;AAC1E;AAAA,MACF,KAAK;AACH,YAAI;AAAE,mBAAS,IAAI,OAAO,OAAO,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,QAAQ;AAAA,QAAG,QAAQ;AAAE,mBAAS;AAAA,QAAO;AAC9F;AAAA,MACF,KAAK;AACH,iBAAS,aAAa,OAAO,MAAM,KAAK;AACxC;AAAA,MACF,KAAK;AACH,iBAAS,SAAS,WAAW,OAAO,MAAM,KAAK,CAAC;AAChD;AAAA,MACF,KAAK;AACH,iBAAS,SAAS,SAAS,OAAO,MAAM,KAAK,CAAC;AAC9C;AAAA,IACJ;AAGA,QAAI,UAAU,MAAM,KAAK;AACvB,eAAS,MAAM,IAAI,MAAM,OAAK,KAAK,iBAAiB,OAAO,CAAC,CAAC;AAAA,IAC/D;AAGA,QAAI,CAAC,UAAU,MAAM,IAAI;AACvB,eAAS,MAAM,GAAG,KAAK,OAAK,KAAK,iBAAiB,OAAO,CAAC,CAAC;AAAA,IAC7D;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,cAAc,OAAoB,OAAwB;AAChE,YAAQ,OAAO;AAAA,MACb,KAAK;AAAW,eAAO,MAAM;AAAA,MAC7B,KAAK;AAAY,eAAO,MAAM;AAAA,MAC9B,KAAK;AAAU,eAAO,MAAM;AAAA,MAC5B,KAAK;AAAY,eAAO,MAAM;AAAA,MAC9B,KAAK;AAAa,eAAO,MAAM;AAAA,MAC/B;AACE,eAAO,MAAM,UAAU,KAAK;AAAA,IAChC;AAAA,EACF;AAAA;AAAA,EAGA,UAAgB;AACd,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,KAAK,MAAM,KAAK,KAAK,QAAQ,QAAQ,GAAG;AAClD,UAAI,OAAO,OAAO,WAAW,KAAM,MAAM,OAAO,YAAa,MAAU;AACrE,aAAK,QAAQ,OAAO,GAAG;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AACF;;;AC3KA,IAAAC,mBAAsD;AACtD,IAAAC,qBAAqB;;;ACCd,IAAM,gBAAiC;AAAA,EAC5C;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,aAAa,MAAM;AAAA,IAClC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,eAAe,qBAAqB;AAAA,IAClD,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,aAAa,MAAM;AAAA,IAClC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,sBAAsB;AAAA,IACpC,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,aAAa,MAAM;AAAA,IAClC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,aAAa;AAAA,IAC3B,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,aAAa,MAAM;AAAA,IAClC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,eAAe,gBAAgB;AAAA,IAC7C,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,gBAAgB,QAAQ;AAAA,IACvC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,QAAQ,sBAAsB;AAAA,IACrC,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,eAAe,KAAK;AAAA,IACnC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,QAAQ,WAAW;AAAA,IACjC,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,eAAe,KAAK;AAAA,IACnC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,kBAAkB,KAAK;AAAA,IACrC,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,eAAe,KAAK;AAAA,IACnC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,OAAO,WAAW;AAAA,IAChC,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,eAAe,KAAK;AAAA,IACnC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,WAAW,gBAAgB;AAAA,IACzC,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,mBAAmB,SAAS;AAAA,IAC3C,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,WAAW,aAAa,gBAAgB;AAAA,IAC/C,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,gBAAgB,QAAQ;AAAA,IACvC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,UAAU,UAAU;AAAA,IAC3B,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aAAa;AAAA,IACb,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,cAAc,CAAC,eAAe,KAAK;AAAA,IACnC,OAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,kBAAkB;AAAA,IAClB,MAAM,CAAC,OAAO,WAAW,OAAO;AAAA,IAChC,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AAAA,IACA,SAAS;AAAA,EACX;AACF;;;AD/QA,IAAM,YAAY;AAEX,SAAS,aAAa,WAAqC;AAChE,QAAM,QAAQ,CAAC,GAAG,aAAa;AAC/B,QAAM,MAAM,aAAa;AAEzB,UAAI,6BAAW,GAAG,GAAG;AACnB,UAAM,YAAQ,8BAAY,GAAG,EAAE,OAAO,OAAK,EAAE,SAAS,OAAO,CAAC;AAC9D,eAAW,QAAQ,OAAO;AACxB,UAAI;AACF,cAAM,UAAM,mCAAa,yBAAK,KAAK,IAAI,GAAG,OAAO;AACjD,cAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,cAAM,cAA+B,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;AAC7E,mBAAW,QAAQ,aAAa;AAC9B,cAAI,CAAC,KAAK,MAAM,CAAC,KAAK,SAAS,CAAC,KAAK,OAAO;AAC1C,oBAAQ,KAAK,oCAAoC,IAAI,2BAA2B;AAChF;AAAA,UACF;AACA,gBAAM,cAAc,MAAM,UAAU,OAAK,EAAE,OAAO,KAAK,EAAE;AACzD,cAAI,eAAe,GAAG;AACpB,kBAAM,WAAW,IAAI,EAAE,GAAG,MAAM,WAAW,GAAG,GAAG,KAAK;AAAA,UACxD,OAAO;AACL,kBAAM,KAAK,IAAI;AAAA,UACjB;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ,KAAK,0BAA0B,IAAI,KAAM,IAAc,OAAO,EAAE;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;;;AErCA,IAAAC,6BAAoC;AACpC,IAAAC,mBAAqB;AAWrB,SAAS,sBAAsB,IAAkB;AAC/C,UAAI,uBAAK,EAAE,MAAM,GAAG;AAClB,UAAM,IAAI,MAAM,yBAAyB,EAAE,EAAE;AAAA,EAC/C;AACF;AAEO,IAAM,kBAAN,MAAiD;AAAA,EACtD,OAAO;AAAA,EACC,QAAQ;AAAA,EACR,MAAM;AAAA,EAEd,cAAuB;AACrB,UAAM,aAAS,sCAAU,OAAO,CAAC,WAAW,GAAG,EAAE,OAAO,OAAO,CAAC;AAChE,WAAO,OAAO,WAAW;AAAA,EAC3B;AAAA,EAEQ,cAAoB;AAC1B,QAAI;AACF,+CAAS,uBAAuB,KAAK,KAAK,gBAAgB,EAAE,OAAO,OAAO,CAAC;AAAA,IAC7E,QAAQ;AACN,+CAAS,sBAAsB,KAAK,KAAK,EAAE;AAC3C,+CAAS,oBAAoB,KAAK,KAAK,IAAI,KAAK,GAAG,uCAAuC;AAC1F,+CAAS,sBAAsB,KAAK,KAAK,iEAAiE;AAC1G,+CAAS,qBAAqB,KAAK,KAAK,oBAAoB,KAAK,GAAG,OAAO;AAAA,IAC7E;AAAA,EACF;AAAA,EAEA,MAAM,MAAM,IAA2B;AACrC,0BAAsB,EAAE;AACxB,SAAK,YAAY;AACjB,6CAAS,wBAAwB,KAAK,KAAK,IAAI,KAAK,GAAG,OAAO,EAAE,KAAK;AAAA,EACvE;AAAA,EAEA,MAAM,QAAQ,IAA2B;AACvC,0BAAsB,EAAE;AACxB,QAAI;AACF,+CAAS,2BAA2B,KAAK,KAAK,IAAI,KAAK,GAAG,OAAO,EAAE,KAAK;AAAA,IAC1E,QAAQ;AAAA,IAA8B;AAAA,EACxC;AAAA,EAEA,MAAM,UAAU,IAA8B;AAC5C,0BAAsB,EAAE;AACxB,QAAI;AACF,YAAM,aAAS,qCAAS,qBAAqB,KAAK,KAAK,IAAI,KAAK,GAAG,IAAI,EAAE,UAAU,QAAQ,CAAC;AAC5F,aAAO,OAAO,SAAS,EAAE;AAAA,IAC3B,QAAQ;AAAE,aAAO;AAAA,IAAO;AAAA,EAC1B;AAAA,EAEA,MAAM,cAAiC;AACrC,QAAI;AACF,YAAM,aAAS,qCAAS,qBAAqB,KAAK,KAAK,IAAI,KAAK,GAAG,IAAI,EAAE,UAAU,QAAQ,CAAC;AAC5F,YAAM,QAAQ,OAAO,MAAM,4BAA4B;AACvD,UAAI,CAAC,MAAO,QAAO,CAAC;AACpB,aAAO,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,OAAO;AAAA,IAC7E,QAAQ;AAAE,aAAO,CAAC;AAAA,IAAG;AAAA,EACvB;AACF;AAEO,IAAM,kBAAN,MAAiD;AAAA,EACtD,OAAO;AAAA,EACC,QAAQ;AAAA,EAEhB,cAAuB;AACrB,UAAM,aAAS,sCAAU,YAAY,CAAC,WAAW,GAAG,EAAE,OAAO,OAAO,CAAC;AACrE,WAAO,OAAO,WAAW;AAAA,EAC3B;AAAA,EAEQ,cAAoB;AAC1B,QAAI;AACF,+CAAS,kBAAkB,KAAK,KAAK,gBAAgB,EAAE,OAAO,OAAO,CAAC;AAAA,IACxE,QAAQ;AACN,+CAAS,eAAe,KAAK,KAAK,EAAE;AACpC,+CAAS,0BAA0B,KAAK,KAAK,EAAE;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,MAAM,MAAM,IAA2B;AACrC,0BAAsB,EAAE;AACxB,SAAK,YAAY;AACjB,QAAI,MAAM,KAAK,UAAU,EAAE,EAAG;AAC9B,6CAAS,eAAe,KAAK,KAAK,OAAO,EAAE,UAAU;AAAA,EACvD;AAAA,EAEA,MAAM,QAAQ,IAA2B;AACvC,0BAAsB,EAAE;AACxB,QAAI;AAAE,+CAAS,eAAe,KAAK,KAAK,OAAO,EAAE,UAAU;AAAA,IAAG,QACxD;AAAA,IAA2B;AAAA,EACnC;AAAA,EAEA,MAAM,UAAU,IAA8B;AAC5C,0BAAsB,EAAE;AACxB,QAAI;AACF,YAAM,aAAS,qCAAS,kBAAkB,KAAK,KAAK,IAAI,EAAE,UAAU,QAAQ,CAAC;AAC7E,aAAO,OAAO,SAAS,EAAE;AAAA,IAC3B,QAAQ;AAAE,aAAO;AAAA,IAAO;AAAA,EAC1B;AAAA,EAEA,MAAM,cAAiC;AACrC,QAAI;AACF,YAAM,aAAS,qCAAS,kBAAkB,KAAK,KAAK,IAAI,EAAE,UAAU,QAAQ,CAAC;AAC7E,YAAM,MAAgB,CAAC;AACvB,iBAAW,QAAQ,OAAO,MAAM,IAAI,GAAG;AACrC,cAAM,QAAQ,KAAK,MAAM,wCAAwC;AACjE,YAAI,MAAO,KAAI,KAAK,MAAM,CAAC,CAAC;AAAA,MAC9B;AACA,aAAO;AAAA,IACT,QAAQ;AAAE,aAAO,CAAC;AAAA,IAAG;AAAA,EACvB;AACF;AAEO,IAAM,gBAAN,MAA+C;AAAA,EACpD,OAAO;AAAA,EACC,UAAU,oBAAI,IAAY;AAAA,EAElC,cAAuB;AAAE,WAAO;AAAA,EAAM;AAAA,EACtC,MAAM,MAAM,IAA2B;AAAE,0BAAsB,EAAE;AAAG,SAAK,QAAQ,IAAI,EAAE;AAAA,EAAG;AAAA,EAC1F,MAAM,QAAQ,IAA2B;AAAE,0BAAsB,EAAE;AAAG,SAAK,QAAQ,OAAO,EAAE;AAAA,EAAG;AAAA,EAC/F,MAAM,UAAU,IAA8B;AAAE,0BAAsB,EAAE;AAAG,WAAO,KAAK,QAAQ,IAAI,EAAE;AAAA,EAAG;AAAA,EACxG,MAAM,cAAiC;AAAE,WAAO,CAAC,GAAG,KAAK,OAAO;AAAA,EAAG;AACrE;AAEO,SAAS,wBAAyC;AACvD,QAAM,MAAM,IAAI,gBAAgB;AAChC,MAAI,IAAI,YAAY,EAAG,QAAO;AAC9B,QAAM,MAAM,IAAI,gBAAgB;AAChC,MAAI,IAAI,YAAY,EAAG,QAAO;AAC9B,SAAO,IAAI,cAAc;AAC3B;;;AC3IA,IAAAC,mBAA+B;AAwB/B,IAAMC,kBAAoC;AAAA,EACxC,SAAS;AAAA,EACT,SAAS;AAAA,EACT,qBAAqB;AAAA,EACrB,cAAc;AAAA,EACd,WAAW,CAAC,aAAa,KAAK;AAChC;AAEA,IAAMC,iBAAwC;AAAA,EAC5C,MAAM;AAAA,EAAG,KAAK;AAAA,EAAG,QAAQ;AAAA,EAAG,MAAM;AAAA,EAAG,UAAU;AACjD;AAEO,IAAM,qBAAN,MAAyB;AAAA,EAK9B,YACU,SACAC,MACR,QACA;AAHQ;AACA,eAAAA;AAGR,SAAK,SAAS,EAAE,GAAGF,iBAAgB,GAAG,OAAO;AAC7C,SAAK,UAAU;AACf,SAAK,kBAAkB;AAAA,EACzB;AAAA,EAPU;AAAA,EACA;AAAA,EANF;AAAA,EACA,YAA0B,CAAC;AAAA,EAC3B,cAAqC;AAAA,EAY7C,MAAM,gBAAgB,OAAmC;AACvD,QAAI,CAAC,KAAK,OAAO,QAAS;AAE1B,UAAM,YAAYC,eAAc,MAAM,QAAQ,KAAK;AACnD,UAAM,UAAUA,eAAc,KAAK,OAAO,YAAY,KAAK;AAC3D,QAAI,YAAY,QAAS;AAEzB,UAAM,KAAK,MAAM;AACjB,QAAI,CAAC,GAAI;AACT,QAAI,KAAK,cAAc,EAAE,EAAG;AAC5B,QAAI,KAAK,UAAU,KAAK,OAAK,EAAE,OAAO,EAAE,EAAG;AAE3C,UAAM,kBAAkB,MAAM,SAAS;AACvC,UAAM,MAAO,iBAAiB,eAA0B,KAAK,OAAO;AACpE,UAAM,SAAS,MAAM,SAAS;AAE9B,UAAM,KAAK,QAAQ,IAAI,MAAM,SAAS,QAAQ,GAAG;AAAA,EACnD;AAAA,EAEA,MAAM,QAAQ,IAAY,QAAgB,QAAiB,YAAuC;AAChG,QAAI,KAAK,cAAc,EAAE,EAAG,QAAO;AAEnC,UAAM,QAAoB;AAAA,MACxB;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,YAAY,KAAK,IAAI;AAAA,MACrB,YAAY,aAAa,KAAK,IAAI,IAAK,aAAa,MAAQ;AAAA,MAC5D,SAAS,KAAK,OAAO;AAAA,IACvB;AAEA,QAAI,CAAC,KAAK,OAAO,SAAS;AACxB,UAAI;AACF,cAAM,KAAK,QAAQ,MAAM,EAAE;AAAA,MAC7B,SAAS,KAAK;AACZ,aAAK,QAAQ,uCAAuC,EAAE,KAAM,IAAc,OAAO,EAAE;AACnF,aAAK,IAAI,QAAQ;AAAA,UACf,WAAW,oBAAI,KAAK;AAAA,UACpB,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,UAAU;AAAA,UACV,SAAS,mBAAmB,EAAE,KAAM,IAAc,OAAO;AAAA,QAC3D,CAAC;AACD,eAAO;AAAA,MACT;AAAA,IACF;AAEA,SAAK,UAAU,KAAK,KAAK;AACzB,SAAK,UAAU;AAEf,UAAM,OAAO,KAAK,OAAO,UAAU,eAAe;AAClD,UAAM,YAAY,aAAa,gBAAgB,UAAU,OAAO;AAChE,SAAK,QAAQ,cAAc,IAAI,WAAW,EAAE,KAAK,MAAM,GAAG,SAAS,EAAE;AAErE,SAAK,IAAI,QAAQ;AAAA,MACf,WAAW,oBAAI,KAAK;AAAA,MACpB,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,SAAS,GAAG,IAAI,WAAW,EAAE,KAAK,MAAM,GAAG,SAAS;AAAA,MACpD,WAAW;AAAA,MACX,SAAS,EAAE,QAAQ,SAAS,SAAS,QAAQ,SAAS,KAAK,OAAO,SAAS,aAAa,WAAW;AAAA,IACrG,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,UAAU,IAA8B;AAC5C,UAAM,MAAM,KAAK,UAAU,UAAU,OAAK,EAAE,OAAO,EAAE;AACrD,QAAI,MAAM,EAAG,QAAO;AAEpB,UAAM,QAAQ,KAAK,UAAU,GAAG;AAChC,QAAI,CAAC,MAAM,SAAS;AAClB,UAAI;AACF,cAAM,KAAK,QAAQ,QAAQ,EAAE;AAAA,MAC/B,SAAS,KAAK;AACZ,aAAK,QAAQ,+BAA+B,EAAE,KAAM,IAAc,OAAO,EAAE;AAC3E,eAAO;AAAA,MACT;AAAA,IACF;AAEA,SAAK,UAAU,OAAO,KAAK,CAAC;AAC5B,SAAK,UAAU;AAEf,SAAK,QAAQ,wBAAwB,EAAE,EAAE;AACzC,SAAK,IAAI,QAAQ;AAAA,MACf,WAAW,oBAAI,KAAK;AAAA,MACpB,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,SAAS,aAAa,EAAE;AAAA,MACxB,WAAW;AAAA,MACX,SAAS,EAAE,QAAQ,UAAU;AAAA,IAC/B,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EAEA,cAAc,IAAqB;AACjC,WAAO,KAAK,OAAO,UAAU,SAAS,EAAE;AAAA,EAC1C;AAAA,EAEA,eAAe,IAAkB;AAC/B,QAAI,CAAC,KAAK,OAAO,UAAU,SAAS,EAAE,GAAG;AACvC,WAAK,OAAO,UAAU,KAAK,EAAE;AAAA,IAC/B;AAAA,EACF;AAAA,EAEA,oBAAoB,IAAkB;AACpC,SAAK,OAAO,YAAY,KAAK,OAAO,UAAU,OAAO,OAAK,MAAM,EAAE;AAAA,EACpE;AAAA,EAEA,eAA6B;AAAE,WAAO,CAAC,GAAG,KAAK,SAAS;AAAA,EAAG;AAAA,EAC3D,eAAyB;AAAE,WAAO,CAAC,GAAG,KAAK,OAAO,SAAS;AAAA,EAAG;AAAA,EAE9D,OAAa;AACX,QAAI,KAAK,YAAa,eAAc,KAAK,WAAW;AACpD,SAAK,cAAc;AAAA,EACrB;AAAA,EAEQ,oBAA0B;AAChC,SAAK,cAAc,YAAY,MAAM,KAAK,KAAK,gBAAgB,GAAG,GAAM;AAAA,EAC1E;AAAA,EAEA,MAAc,kBAAiC;AAC7C,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,UAAU,KAAK,UAAU,OAAO,OAAK,EAAE,cAAc,EAAE,cAAc,GAAG;AAC9E,eAAW,SAAS,SAAS;AAC3B,YAAM,KAAK,UAAU,MAAM,EAAE;AAAA,IAC/B;AAAA,EACF;AAAA,EAEQ,YAAkB;AACxB,QAAI;AACF,YAAM,QAAQ,eAAe,kBAAkB,WAAW;AAC1D,UAAI,MAAM,QAAQ,KAAK,EAAG,MAAK,YAAY;AAAA,IAC7C,QAAQ;AAAA,IAAsC;AAAA,EAChD;AAAA,EAEQ,YAAkB;AACxB,QAAI;AAAE,qBAAe,kBAAkB,aAAa,KAAK,SAAS;AAAA,IAAG,QAC/D;AAAA,IAAsC;AAAA,EAC9C;AAAA,EAEQ,QAAQ,MAAoB;AAClC,QAAI;AAAE,2CAAe,MAAM,SAAS,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,IAAI;AAAA,CAAI;AAAA,IAAG,QACxE;AAAA,IAAoB;AAAA,EAC5B;AACF;;;AChMA,IAAI,QAAQ;AAIZ,IAAI,SAAc;AAElB,eAAe,aAA4B;AACzC,MAAI,OAAQ;AACZ,MAAI;AACF,aAAS,MAAM,OAAO,cAAc;AAAA,EACtC,QAAQ;AACN,aAAS;AAAA,EACX;AACF;AAEA,eAAsB,cAAc,SAA0C;AAC5E,MAAI,MAAO;AACX,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK;AAEV,QAAM,WAAW;AACjB,MAAI,CAAC,OAAQ;AAEb,SAAO,KAAK;AAAA,IACV;AAAA,IACA,aAAa,QAAQ,IAAI,YAAY;AAAA,IACrC,SAAS,QAAQ,IAAI;AAAA,IACrB,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,WAAW,OAAgC;AACzC,YAAM,MAAO,MAA6D;AAC1E,UAAI,KAAK,SAAS;AAChB,eAAO,IAAI,QAAQ;AACnB,eAAO,IAAI,QAAQ;AAAA,MACrB;AACA,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AAED,UAAQ;AACV;AAEO,SAAS,iBAAiB,KAAoB;AACnD,MAAI,CAAC,SAAS,CAAC,OAAQ;AACvB,SAAO,iBAAiB,GAAG;AAC7B;AAEA,eAAsB,eAAe,YAAY,KAAqB;AACpE,MAAI,CAAC,SAAS,CAAC,OAAQ;AACvB,MAAI;AAAE,UAAM,OAAO,MAAM,SAAS;AAAA,EAAG,QAAQ;AAAA,EAAe;AAC9D;;;A7CvCA,SAASE,eAAsB;AAC7B,MAAI;AACF,UAAM,MAAM,KAAK,UAAM,mCAAa,yBAAK,WAAW,MAAM,cAAc,GAAG,OAAO,CAAC;AACnF,WAAO,IAAI,WAAW;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,QAAQ,MAAoB;AACnC,MAAI;AACF,yCAAe,MAAM,SAAS,IAAG,oBAAI,KAAK,GAAE,YAAY,CAAC,IAAI,IAAI;AAAA,CAAI;AAAA,EACvE,QAAQ;AAAA,EAER;AACF;AAEA,eAAsB,YAA2B;AAC/C,MAAI,kBAAkB,GAAG;AACvB,YAAQ,MAAM,6CAA6C,MAAM,OAAO,IAAI;AAC5E,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,oBAAkB;AAClB,eAAa;AAEb,QAAM,cAAc,QAAQ;AAC5B,UAAQ,GAAG,qBAAqB,CAAC,QAAQ;AACvC,YAAQ,+BAA+B,IAAI,OAAO,EAAE;AACpD,qBAAiB,GAAG;AAAA,EACtB,CAAC;AACD,UAAQ,GAAG,sBAAsB,CAAC,WAAW;AAC3C,YAAQ,gCAAgC,OAAO,MAAM,CAAC,EAAE;AACxD,qBAAiB,MAAM;AAAA,EACzB,CAAC;AAED,QAAM,UAAUA,aAAY;AAC5B,UAAQ,mCAAmC,OAAO,SAAS,MAAM,IAAI,EAAE;AAEvE,MAAI;AACF,gBAAY,MAAM,OAAO;AAAA,EAC3B,SAAS,KAAK;AACZ,YAAQ,kCAAmC,IAAc,OAAO,EAAE;AAAA,EACpE;AAEA,QAAM,SAAS,eAAW,6BAAW,MAAM,UAAU,IAAI,MAAM,aAAa,MAAS;AAErF,MAAI,GAAG,SAAS,CAAC,UAAuB;AACtC,YAAQ,WAAW,MAAM,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO,EAAE;AAAA,EACtE,CAAC;AAED,QAAM,aAAa,IAAI,WAAW,GAAG;AACrC,QAAM,WAAW,MAAM;AAGvB,QAAM,aAAa,IAAI,WAAW,CAAC,cAAc;AAC/C,UAAM,QAAqB;AAAA,MACzB,WAAW,oBAAI,KAAK;AAAA,MACpB,QAAQ;AAAA,MACR,UAAW,UAAU,cAAc,YAAoB;AAAA,MACvD,UAAU,UAAU;AAAA,MACpB,SAAS,eAAe,UAAU,KAAK;AAAA,MACvC,WAAW,UAAU;AAAA,MACrB,SAAS;AAAA,QACP,SAAS,UAAU;AAAA,QACnB,UAAU,UAAU;AAAA,QACpB,GAAG,UAAU;AAAA,MACf;AAAA,IACF;AACA,QAAI,QAAQ,KAAK;AAAA,EACnB,CAAC;AACD,aAAW,UAAU,aAAa,CAAC;AACnC,MAAI,GAAG,SAAS,CAAC,UAAU;AACzB,QAAI,MAAM,WAAW,cAAe,YAAW,SAAS,KAAK;AAAA,EAC/D,CAAC;AACD,UAAQ,+BAA+B,WAAW,SAAS,EAAE,MAAM,QAAQ;AAC3E,cAAY,MAAM,WAAW,QAAQ,GAAG,GAAO;AAG/C,QAAM,kBAAkB,sBAAsB;AAC9C,QAAM,cAAc,IAAI,mBAAmB,iBAAiB,KAAM,OAAe,WAAW;AAC5F,MAAI,GAAG,SAAS,CAAC,UAAU;AACzB,QAAI,MAAM,WAAW,kBAAkB;AACrC,WAAK,YAAY,gBAAgB,KAAK;AAAA,IACxC;AAAA,EACF,CAAC;AACD,UAAQ,iDAAiD,gBAAgB,IAAI,aAAc,OAAe,aAAa,WAAW,IAAI,GAAG;AAEzI,MAAI,gBAAgB,KAAK,MAAM;AAE/B,QAAM,aAAa,IAAI,WAAW,GAAG;AACrC,MAAI;AACF,UAAM,WAAW,MAAM;AAAA,EACzB,SAAS,KAAK;AACZ,YAAQ,yCAA0C,IAAc,OAAO,EAAE;AAAA,EAC3E;AAEA,QAAM,MAAM,IAAI,UAAU,SAAS,UAAU;AAC7C,QAAM,IAAI,MAAM;AAChB,UAAQ,6BAA6B,MAAM,MAAM,EAAE;AAEnD,QAAM,WAAW,OAAO,WAAmB;AACzC,YAAQ,qBAAqB,MAAM,iBAAiB;AACpD,QAAI;AAAE,kBAAY,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAC;AACnC,QAAI;AAAE,iBAAW,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAC;AAClC,QAAI;AAAE,YAAM,WAAW,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAC;AACxC,QAAI;AAAE,YAAM,IAAI,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAC;AACjC,QAAI;AAAE,cAAQ;AAAA,IAAG,QAAQ;AAAA,IAAC;AAC1B,QAAI;AAAE,YAAM,eAAe;AAAA,IAAG,QAAQ;AAAA,IAAC;AACvC,kBAAc;AACd,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,UAAQ,GAAG,UAAU,MAAM;AAAE,SAAK,SAAS,QAAQ;AAAA,EAAG,CAAC;AACvD,UAAQ,GAAG,WAAW,MAAM;AAAE,SAAK,SAAS,SAAS;AAAA,EAAG,CAAC;AACzD,UAAQ,GAAG,UAAU,MAAM;AAAE,SAAK,SAAS,QAAQ;AAAA,EAAG,CAAC;AAGvD,cAAY,MAAM;AAAA,EAAC,GAAG,KAAK,EAAE;AAC/B;;;A8CtIA,UAAU,EAAE,MAAM,CAAC,QAAQ;AACzB,UAAQ,MAAM,iCAAiC,GAAG;AAClD,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":["exports","module","exports","module","exports","module","exports","module","exports","module","Date","exports","module","exports","module","exports","module","exports","module","resolve","index","blocksize","exports","module","resolve","exports","module","exports","module","tomlType","str","exports","import_node_fs","import_node_path","import_node_fs","import_node_fs","import_node_fs","import_node_path","Database","module","resolve","isRoot","import_node_fs","import_node_path","import_toml","import_node_crypto","import_node_fs","import_node_path","verifySignature","import_node_fs","bus","bus","isRoot","import_node_child_process","import_node_fs","bus","import_node_fs","import_node_readline","bus","import_node_fs","import_node_path","TOML","bus","TOML","SEVERITY_RANK","SEVERITY_RANK","bus","import_node_fs","import_node_path","import_node_os","import_node_fs","import_node_path","import_node_os","process","os","tty","styles","chalk","styles","SEVERITY_COLORS","import_node_os","os","import_node_fs","import_node_path","end","import_node_fs","import_node_path","import_node_crypto","import_node_path","bus","import_node_fs","import_node_path","import_node_child_process","import_node_net","import_node_fs","DEFAULT_CONFIG","SEVERITY_RANK","bus","readVersion"]}