@quantakrypto/core 0.4.1 → 0.4.3

package/dist/detectors/source.js

@@ -1,4 +1,4 @@
-import { JS_TS_EXTENSIONS, JWT_HOST_EXTENSIONS, eachMatch, findingFromRule, hasExtension, nearSortedCall, } from "../detect-utils.js";
+import { JS_TS_EXTENSIONS, DOC_EXTENSIONS, JWT_HOST_EXTENSIONS, eachMatch, findingFromRule, hasExtension, nearSortedCall, } from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
 /* -------------------------------------------------------------------------- */
 /* Precompiled regexes (module scope — never recreated per file)              */
@@ -46,7 +46,10 @@ const RE_TLS_REJECT = /rejectUnauthorized\s*:\s*false/g;
 // Hardened cipher regex: bounded spans (no unbounded `[^'"`]*` straddling the
 // alternation), single-quote-style anchoring removed in favour of {0,256} bounds
 // so worst-case backtracking is linear in the bound, not the file (P0-6).
-const RE_TLS_WEAK_CIPHER = /ciphers\s*:\s*['"`][^'"`\n]{0,256}?\b(RC4|DES|3DES|MD5|NULL|EXPORT|aNULL|eNULL)\b[^'"`\n]{0,256}?['"`]/gi;
+// The `(?<![!-])` lookbehind skips OpenSSL EXCLUSION syntax — `!MD5` / `-RC4`
+// DISABLE those ciphers, so a hardened list like `...:!aNULL:!MD5:!RC4` must not
+// be flagged as weak (audit: crypto #7). A genuinely-enabled `RC4` still matches.
+const RE_TLS_WEAK_CIPHER = /ciphers\s*:\s*['"`][^'"`\n]{0,256}?\b(?<![!-])(RC4|DES|3DES|MD5|NULL|EXPORT|aNULL|eNULL)\b[^'"`\n]{0,256}?['"`]/gi;
 /* -------------------------------------------------------------------------- */
 /* Node.js `crypto` module                                                    */
 /* -------------------------------------------------------------------------- */
@@ -203,8 +206,8 @@ const nodeCryptoDetector = {
                 },
                 dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
                 dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
-                x25519: { algo: "X25519", cat: "key-exchange", sev: "low", hndl: true, label: "X25519" },
-                x448: { algo: "X448", cat: "key-exchange", sev: "low", hndl: true, label: "X448" },
+                x25519: { algo: "X25519", cat: "key-exchange", sev: "medium", hndl: true, label: "X25519" },
+                x448: { algo: "X448", cat: "key-exchange", sev: "medium", hndl: true, label: "X448" },
                 ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
                 ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
             };
@@ -396,11 +399,14 @@ const RULE_ELLIPTIC_EC = {
     id: "elliptic-ec",
     title: "elliptic curve instantiation",
     description: "the `elliptic` library — new EC(...)",
-    category: "signature",
+    // `new EC(...)` is a dual-use curve context (ECDSA sign AND ECDH `key.derive()`).
+    // Per this scanner's own EC-ambiguity policy, ambiguous EC is treated as
+    // key-agreement-capable and HNDL-exposed (audit: crypto #8).
+    category: "key-exchange",
     severity: "high",
     confidence: "high",
-    algorithm: "ECDSA",
-    hndl: false,
+    algorithm: "ECDH",
+    hndl: true,
     cwe: CWE_BROKEN_CRYPTO,
     message: "The `elliptic` library implements classical ECDSA/ECDH, both broken by Shor's algorithm.",
 };
@@ -421,11 +427,13 @@ const RULE_JSRSASIGN_KEYGEN = {
     id: "jsrsasign-keygen",
     title: "jsrsasign key generation",
     description: "jsrsasign KEYUTIL.generateKeypair",
-    category: "signature",
+    // KEYUTIL.generateKeypair("RSA"|"EC") makes keys usable for RSA-OAEP encryption
+    // and ECDH — HNDL-exposed, like Node's generateKeyPair (audit: crypto #13).
+    category: "key-exchange",
     severity: "high",
     confidence: "high",
     algorithm: "unknown",
-    hndl: false,
+    hndl: true,
     cwe: CWE_BROKEN_CRYPTO,
     message: "jsrsasign generates classical RSA/EC key pairs, which are not quantum-safe.",
     remediation: "ML-KEM-768 (FIPS 203) / ML-DSA-65 (FIPS 204)",
@@ -487,6 +495,10 @@ const libraryDetector = {
 /* -------------------------------------------------------------------------- */
 /* JWT / JOSE / COSE algorithm strings                                         */
 /* -------------------------------------------------------------------------- */
+// JOSE RSA key-transport algorithms (JWE `alg`): quoted RSA-OAEP / RSA-OAEP-256
+// /384/512 / RSA1_5. Classical RSA *encryption* (key transport) — distinct from
+// the RS*/PS* *signature* tokens above, and a harvest-now-decrypt-later surface.
+const RE_JOSE_KEM = /['"`](RSA-OAEP(?:-(?:256|384|512))?|RSA1_5)['"`]/g;
 const RULE_JWT_ALG = {
     id: "jwt-classical-alg",
     title: "Classical JWT/JOSE algorithm",
@@ -513,6 +525,19 @@ const RULE_JOSE_ECDH = {
     message: "JOSE ECDH-ES performs classical ECDH key agreement — harvest-now-decrypt-later exposed.",
     remediation: "Track IETF PQC JOSE/COSE; adopt hybrid X25519MLKEM768 KEM-based encryption.",
 };
+const RULE_JOSE_RSA_OAEP = {
+    id: "jose-rsa-oaep",
+    title: "JOSE RSA key-transport algorithm",
+    description: "JWE RSA-OAEP / RSA-OAEP-256/384/512 / RSA1_5 key encryption",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "medium",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "JOSE RSA key transport (RSA-OAEP / RSA1_5) is classical RSA encryption — harvest-now-decrypt-later exposed.",
+    remediation: "Track IETF PQC JOSE/COSE; adopt hybrid X25519MLKEM768 KEM-based encryption.",
+};
 /**
  * Detects classical signature algorithm identifiers used by JWT/JOSE, plus
  * ECDH-ES key-agreement identifiers (HNDL-exposed). These appear as string
@@ -526,7 +551,7 @@ const jwtDetector = {
     // signal in JS/TS or Python (e.g. PyJWT `algorithm="RS256"`), so this detector
     // is un-gated from JS-only to the JWT host surfaces.
     language: "any",
-    rules: [RULE_JWT_ALG, RULE_JOSE_ECDH],
+    rules: [RULE_JWT_ALG, RULE_JOSE_ECDH, RULE_JOSE_RSA_OAEP],
     appliesTo: (f) => hasExtension(f, JWT_HOST_EXTENSIONS),
     detect({ file, content }) {
         const findings = [];
@@ -553,6 +578,13 @@ const jwtDetector = {
                 message: `JOSE "${m[1]}" performs classical ECDH key agreement — harvest-now-decrypt-later exposed.`,
             }));
         });
+        // JOSE RSA key transport (RSA-OAEP / RSA1_5) — classical RSA encryption, HNDL.
+        eachMatch(RE_JOSE_KEM, content, (m) => {
+            findings.push(findingFromRule(RULE_JOSE_RSA_OAEP, { file, content, index: m.index, matchLength: m[0].length }, {
+                title: `JOSE RSA key transport ${m[1]}`,
+                message: `JOSE "${m[1]}" is classical RSA key transport — harvest-now-decrypt-later exposed.`,
+            }));
+        });
         return findings;
     },
 };
@@ -640,6 +672,12 @@ const tlsDetector = {
 /* -------------------------------------------------------------------------- */
 const RE_SSH_PUBKEY = /\b(ssh-rsa|ssh-ed25519|ssh-dss|ecdsa-sha2-nistp(?:256|384|521))\b/g;
 const RE_CERT_SIG_ALG = /\b(sha(?:1|256|384|512)WithRSAEncryption|ecdsa-with-SHA(?:1|256|384|512)|rsassaPss|dsaWithSHA(?:1|256))\b/g;
+// Classical SSH key-exchange algorithm identifiers: finite-field DH groups
+// (diffie-hellman-group{1,14,15,16,17,18} + group-exchange), ECDH over NIST
+// curves (ecdh-sha2-nistp*), and Curve25519 (curve25519-sha256). All are
+// Shor-broken key agreement — the harvest-now-decrypt-later surface a lexical
+// scan misses when only the `crypto/*` API is matched, not the negotiated kex.
+const RE_SSH_KEX = /\b(diffie-hellman-group(?:1|14|15|16|17|18)(?:-sha1|-sha256|-sha512)?|diffie-hellman-group-exchange-sha(?:1|256)|ecdh-sha2-nistp(?:256|384|521)|curve25519-sha256)\b/g;
 const RULE_SSH_PUBKEY = {
     id: "ssh-public-key",
     title: "Classical SSH public key",
@@ -652,7 +690,7 @@ const RULE_SSH_PUBKEY = {
     cwe: CWE_BROKEN_CRYPTO,
     sensitive: true,
     message: "A classical SSH public key is forgeable by a quantum attacker.",
-    remediation: "Plan migration to PQC-capable SSH (e.g. sntrup761x25519 KEX, PQC host keys).",
+    remediation: "Plan migration to PQC-capable SSH: prefer the mlkem768x25519-sha256 KEX (ML-KEM-768 hybrid, OpenSSH 10's default since Apr 2025); sntrup761x25519 is an acceptable interim. Rotate to PQC host keys as they land.",
 };
 const RULE_CERT_SIG_ALG = {
     id: "cert-signature-algorithm",
@@ -667,6 +705,19 @@ const RULE_CERT_SIG_ALG = {
     message: "A classical certificate signature algorithm (RSA/ECDSA/DSA) is a quantum forgery surface.",
     remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
 };
+const RULE_SSH_KEX = {
+    id: "ssh-kex-classical",
+    title: "Classical SSH key exchange",
+    description: "diffie-hellman-group* / group-exchange / ecdh-sha2-* / curve25519-sha256 kex",
+    category: "key-exchange",
+    severity: "medium",
+    confidence: "medium",
+    algorithm: "unknown",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "A classical SSH key-exchange algorithm (finite-field DH / ECDH / X25519) is harvest-now-decrypt-later exposed.",
+    remediation: "Prefer the mlkem768x25519-sha256 KEX (ML-KEM-768 hybrid, OpenSSH 10 default); sntrup761x25519 is an acceptable interim.",
+};
 /**
  * Detects classical SSH public keys (`authorized_keys` / `known_hosts` lines)
  * and X.509 certificate signature-algorithm identifiers in any text file. These
@@ -678,8 +729,10 @@ const sshCertDetector = {
     description: "SSH public keys and TLS/X.509 certificate signature algorithms in config",
     scope: "config",
     language: "any",
-    rules: [RULE_SSH_PUBKEY, RULE_CERT_SIG_ALG],
-    appliesTo: () => true,
+    rules: [RULE_SSH_PUBKEY, RULE_CERT_SIG_ALG, RULE_SSH_KEX],
+    // Skip prose/docs: a changelog or README that merely mentions `ssh-rsa` in a
+    // sentence is not crypto config. PEM material is caught by its own detector.
+    appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
     detect({ file, content }) {
         const findings = [];
         // SSH public keys: ssh-rsa AAAA…, ecdsa-sha2-nistp256 …, ssh-ed25519 …
@@ -712,6 +765,70 @@ const sshCertDetector = {
                 message: `Certificate signature algorithm "${tok}" is classical (RSA/ECDSA/DSA) — a quantum forgery surface.`,
             }));
         });
+        // SSH key-exchange algorithm identifiers (finite-field DH / ECDH / X25519).
+        eachMatch(RE_SSH_KEX, content, (m) => {
+            const tok = m[1];
+            const algorithm = tok.startsWith("diffie-hellman")
+                ? "DH"
+                : tok.startsWith("ecdh")
+                    ? "ECDH"
+                    : "X25519";
+            findings.push(findingFromRule(RULE_SSH_KEX, { file, content, index: m.index, matchLength: m[0].length }, {
+                title: `Classical SSH key exchange (${tok})`,
+                algorithm,
+                message: `SSH key-exchange "${tok}" is classical (${algorithm}) — harvest-now-decrypt-later exposed.`,
+            }));
+        });
+        return findings;
+    },
+};
+/* -------------------------------------------------------------------------- */
+/* Classical TLS key-exchange cipher suites (language-agnostic config)         */
+/* -------------------------------------------------------------------------- */
+// Classical KEX cipher-suite identifiers, in both the OpenSSL (`ECDHE-RSA-…`) and
+// IANA (`TLS_ECDHE_RSA_WITH_…`) spellings, with `-` or `_` separators. These name
+// a Shor-broken key exchange (ECDHE/DHE), so they are the harvest-now surface a
+// PQC scanner should flag — distinct from the legacy-*version* / weak-cipher rules
+// above. Case-sensitive on purpose: cipher-suite tokens are upper-case constants,
+// so prose like "ecdhe rsa" does not misfire. No trailing \b so the IANA
+// `TLS_ECDHE_RSA_WITH_…` form (a `_` follows `RSA`) still matches.
+const RE_TLS_CLASSICAL_KEX = /\b(?:TLS_)?(?:ECDHE|ECDH|DHE)[-_](?:RSA|ECDSA|DSS)/g;
+const RULE_TLS_CLASSICAL_KEX = {
+    id: "tls-classical-kex",
+    title: "Classical TLS key-exchange cipher suite",
+    description: "ECDHE / DHE cipher suites negotiate Shor-broken key exchange",
+    category: "tls",
+    severity: "medium",
+    confidence: "medium",
+    algorithm: "unknown",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical TLS key exchange (ECDHE/DHE) is harvest-now-decrypt-later exposed — the session key can be recorded now and recovered by a quantum attacker.",
+    remediation: "Adopt a PQC-hybrid TLS 1.3 key exchange (e.g. X25519MLKEM768) as your stack and peers support it; keep classical suites only as a transitional fallback.",
+};
+/**
+ * Detects classical TLS key-exchange cipher suites in any text/config file
+ * (OpenSSL cipher lists, IANA suite constants in Go/Java/C#/Rust, `.properties`,
+ * etc.). Language-agnostic because the suite identifiers are the same tokens
+ * everywhere — this is the cross-language TLS gap the legacy-version rule misses.
+ */
+const tlsClassicalKexDetector = {
+    id: "tls-cipher-suite",
+    description: "Classical TLS key-exchange cipher suites (ECDHE/DHE) in any config",
+    scope: "config",
+    language: "any",
+    rules: [RULE_TLS_CLASSICAL_KEX],
+    appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        eachMatch(RE_TLS_CLASSICAL_KEX, content, (m) => {
+            const tok = m[0];
+            const algorithm = tok.includes("ECDH") ? "ECDH" : "DH";
+            findings.push(findingFromRule(RULE_TLS_CLASSICAL_KEX, { file, content, index: m.index, matchLength: m[0].length }, {
+                algorithm,
+                message: `Classical TLS key-exchange suite "${tok}…" (${algorithm}) is harvest-now-decrypt-later exposed.`,
+            }));
+        });
         return findings;
     },
 };
@@ -723,5 +840,6 @@ export const sourceDetectors = [
     jwtDetector,
     tlsDetector,
     sshCertDetector,
+    tlsClassicalKexDetector,
 ];
 //# sourceMappingURL=source.js.map

package/dist/detectors/source.js.map

@@ -1 +1 @@
-{"version":3,"file":"source.js","sourceRoot":"","sources":["../../src/detectors/source.ts"],"names":[],"mappings":"AA6BA,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEtF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,mBAAmB,GACvB,8FAA8F,CAAC;AACjG,MAAM,qBAAqB,GAAG,6BAA6B,CAAC;AAC5D,yEAAyE;AACzE,iFAAiF;AACjF,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,sBAAsB,GAC1B,6EAA6E,CAAC;AAChF,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAC3D,MAAM,SAAS,GAAG,mDAAmD,CAAC;AACtE,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAC1C,MAAM,cAAc,GAAG,qDAAqD,CAAC;AAC7E,MAAM,eAAe,GAAG,uCAAuC,CAAC;AAEhE,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,iBAAiB,GACrB,iFAAiF,CAAC;AACpF,MAAM,cAAc,GAClB,0HAA0H,CAAC;AAE7H,aAAa;AACb,MAAM,YAAY,GAAG,iCAAiC,CAAC;AACvD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,iFAAiF;AACjF,gFAAgF;AAChF,4DAA4D;AAC5D,MAAM,cAAc,GAClB,oIAAoI,CAAC;AACvI,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;AAC7D,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AACjE,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAC1C,6EAA6E;AAC7E,MAAM,YAAY,GAChB,2GAA2G,CAAC;AAE9G,YAAY;AACZ,MAAM,UAAU,GAAG,+EAA+E,CAAC;AACnG,oEAAoE;AACpE,MAAM,YAAY,GAAG,+CAA+C,CAAC;AAErE,cAAc;AACd,MAAM,qBAAqB,GACzB,6GAA6G,CAAC;AAChH,MAAM,aAAa,GAAG,iCAAiC,CAAC;AACxD,8EAA8E;AAC9E,iFAAiF;AACjF,0EAA0E;AAC1E,MAAM,kBAAkB,GACtB,0GAA0G,CAAC;AAE7G,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,uEAAuE;CACjF,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,+CAA+C;IACtD,WAAW,EAAE,yCAAyC;IACtD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,kGAAkG;IACpG,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,sBAAsB,GAAa;IACvC,EAAE,EAAE,0BAA0B;IAC9B,KAAK,EAAE,mDAAmD;IAC1D,WAAW,EAAE,kDAAkD;IAC/D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+GAA+G;IACjH,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,6BAA6B;IACpC,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,wFAAwF;CAClG,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,qBAAqB;IACzB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,kCAAkC;IAC/C,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,6FAA6F;CAChG,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EAAE,mBAAmB;IAChC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0FAA0F;CAC7F,CAAC;AACF,MAAM,qBAAqB,GAAa;IACtC,EAAE,EAAE,yBAAyB;IAC7B,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,8CAA8C;IAC3D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mGAAmG;CACtG,CAAC;AACF,MAAM,sBAAsB,GAAa;IACvC,EAAE,EAAE,0BAA0B;IAC9B,KAAK,EAAE,yCAAyC;IAChD,WAAW,EAAE,iDAAiD;IAC9D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2FAA2F;CAC9F,CAAC;AAEF,+EAA+E;AAC/E,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE;QACL,gBAAgB;QAChB,cAAc;QACd,sBAAsB;QACtB,YAAY;QACZ,iBAAiB;QACjB,cAAc;QACd,qBAAqB;QACrB,sBAAsB;KACvB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACnD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,iFAAiF;QACjF,SAAS,CAAC,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAChC,MAAM,GAAG,GAWL;gBACF,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;gBACvE,uEAAuE;gBACvE,wDAAwD;gBACxD,SAAS,EAAE;oBACT,IAAI,EAAE,KAAK;oBACX,GAAG,EAAE,WAAW;oBAChB,GAAG,EAAE,MAAM;oBACX,IAAI,EAAE,KAAK;oBACX,KAAK,EAAE,SAAS;oBAChB,OAAO,EACL,sFAAsF;oBACxF,WAAW,EAAE,4CAA4C;iBAC1D;gBACD,mEAAmE;gBACnE,uEAAuE;gBACvE,qEAAqE;gBACrE,EAAE,EAAE;oBACF,IAAI,EAAE,MAAM;oBACZ,GAAG,EAAE,cAAc;oBACnB,GAAG,EAAE,MAAM;oBACX,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EACL,wEAAwE;wBACxE,6EAA6E;oBAC/E,WAAW,EACT,8FAA8F;iBACjG;gBACD,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC9E,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE;gBACzF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE;gBACxF,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE;gBAClF,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE;gBACvF,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;aACpF,CAAC;YACF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,gBAAgB,EAChB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,iBAAiB;gBACrC,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,SAAS,EAAE,IAAI,CAAC,IAAI;gBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EACL,IAAI,CAAC,OAAO;oBACZ,yBAAyB,IAAI,CAAC,KAAK,uCAAuC;gBAC5E,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,4DAA4D;QAC5D,SAAS,CAAC,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC9C,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,cAAc,EAAE;gBAC9B,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,+EAA+E;QAC/E,SAAS,CAAC,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC/C,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,sBAAsB,EAAE;gBACtC,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,iFAAiF;QACjF,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACrC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAC3F,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAClC,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,iBAAiB,EACjB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAAC,GAAG;gBAC5C,OAAO,EAAE,qCAAqC,CAAC,CAAC,CAAC,CAAC,8DAA8D;aACjH,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,2DAA2D;QAC3D,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACvC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,cAAc,EAAE;gBAC9B,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,8EAA8E;QAC9E,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACvC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,qBAAqB,EAAE;gBACrC,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,sEAAsE;QACtE,SAAS,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACxC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,sBAAsB,EAAE;gBACtC,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,qBAAqB;IACzB,KAAK,EAAE,+BAA+B;IACtC,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,gFAAgF;CAC1F,CAAC;AAEF;;;;GAIG;AACH,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,WAAW;IACf,WAAW,EAAE,4DAA4D;IACzE,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,CAAC,cAAc,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACnD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAE9C,SAAS,CAAC,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC1C,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC;gBAAE,OAAO;YACvD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAChC,0EAA0E;YAC1E,uEAAuE;YACvE,IAAI,SAA+B,CAAC;YACpC,IAAI,QAA6B,CAAC;YAClC,IAAI,IAAa,CAAC;YAClB,IAAI,QAAyC,CAAC;YAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,SAAS,GAAG,KAAK,CAAC;gBAClB,MAAM,KAAK,GAAG,IAAI,KAAK,UAAU,CAAC;gBAClC,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;gBACvC,IAAI,GAAG,KAAK,CAAC;YACf,CAAC;iBAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC3B,SAAS,GAAG,MAAM,CAAC;gBACnB,QAAQ,GAAG,cAAc,CAAC;gBAC1B,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBAChD,SAAS,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAChD,QAAQ,GAAG,cAAc,CAAC;gBAC1B,IAAI,GAAG,IAAI,CAAC;gBACZ,QAAQ,GAAG,KAAK,CAAC,CAAC,uBAAuB;YAC3C,CAAC;iBAAM,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,SAAS,GAAG,OAAO,CAAC;gBACpB,QAAQ,GAAG,WAAW,CAAC;gBACvB,IAAI,GAAG,KAAK,CAAC;gBACb,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,OAAO,CAAC;gBACpB,QAAQ,GAAG,WAAW,CAAC;gBACvB,IAAI,GAAG,KAAK,CAAC;YACf,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,cAAc,EACd,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC1B,QAAQ;gBACR,SAAS;gBACT,IAAI;gBACJ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,wDAAwD;aAC9F,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,+BAA+B;IACtC,WAAW,EAAE,oCAAoC;IACjD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,2EAA2E;CACrF,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,4BAA4B;IACzC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,sEAAsE;CAChF,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,sCAAsC;IACnD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0FAA0F;CAC7F,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,yCAAyC;IACtD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,yGAAyG;IAC3G,WAAW,EAAE,+EAA+E;CAC7F,CAAC;AACF,MAAM,qBAAqB,GAAa;IACtC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,6EAA6E;IACtF,WAAW,EAAE,8CAA8C;CAC5D,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,qBAAqB;IAC5B,WAAW,EAAE,yCAAyC;IACtD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,yFAAyF;IAC3F,WAAW,EAAE,sBAAsB;CACpC,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,2CAA2C;IACxD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,6EAA6E;CACvF,CAAC;AAEF,0EAA0E;AAC1E,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,2EAA2E;IACxF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE;QACL,cAAc;QACd,kBAAkB;QAClB,gBAAgB;QAChB,cAAc;QACd,qBAAqB;QACrB,mBAAmB;QACnB,iBAAiB;KAClB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACnD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QAEJ,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,2CAA2C;QAC9E,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC,CAAC,8BAA8B;QACzE,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,gCAAgC;QACvE,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,6CAA6C;QAChF,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC,CAAC,0CAA0C;QAC3F,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,2BAA2B;QACxE,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,6BAA6B;QAElE,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,iCAAiC;IAC9C,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,oFAAoF;IAC7F,WAAW,EAAE,2DAA2D;CACzE,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,2CAA2C;IACxD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,yFAAyF;IAC3F,WAAW,EAAE,6EAA6E;CAC3F,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,UAAU;IACd,WAAW,EAAE,0EAA0E;IACvF,KAAK,EAAE,QAAQ;IACf,6EAA6E;IAC7E,+EAA+E;IAC/E,qDAAqD;IACrD,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,CAAC,YAAY,EAAE,cAAc,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,mBAAmB,CAAC;IACtD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,yEAAyE;QACzE,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACnC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,SAA+B,CAAC;YACpC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAS,GAAG,KAAK,CAAC;iBAC/D,IAAI,GAAG,KAAK,OAAO;gBAAE,SAAS,GAAG,OAAO,CAAC;;gBACzC,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM;YAChC,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,YAAY,EACZ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,sBAAsB,GAAG,EAAE;gBAClC,SAAS;gBACT,OAAO,EAAE,uBAAuB,GAAG,8DAA8D;aAClG,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,yEAAyE;QACzE,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACrC,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,cAAc,EACd,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE;gBACnC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,8EAA8E;aACrG,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,4DAA4D;IACzE,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,2DAA2D;IACpE,WAAW,EAAE,+DAA+D;CAC7E,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,yBAAyB;IAC7B,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,2BAA2B;IACxC,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,mBAAmB;IACxB,OAAO,EAAE,6EAA6E;IACtF,WAAW,EAAE,gEAAgE;CAC9E,CAAC;AACF,MAAM,oBAAoB,GAAa;IACrC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,QAAQ;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,sDAAsD;IAC/D,WAAW,EAAE,oDAAoD;CAClE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,YAAY;IAChB,WAAW,EAAE,mDAAmD;IAChE,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,oBAAoB,CAAC;IAC/D,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACnD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,qEAAqE;QACrE,SAAS,CAAC,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC9C,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,eAAe,EAAE;gBAC/B,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,iEAAiE;QACjE,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACtC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,eAAe,EAAE;gBAC/B,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,SAAS,CAAC,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC3C,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,oBAAoB,EACpB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,uCAAuC,EAAE,CACzE,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,aAAa,GAAG,oEAAoE,CAAC;AAC3F,MAAM,eAAe,GACnB,4GAA4G,CAAC;AAE/G,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,4DAA4D;IACzE,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,SAAS,EAAE,IAAI;IACf,OAAO,EAAE,gEAAgE;IACzE,WAAW,EAAE,8EAA8E;CAC5F,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,0BAA0B;IAC9B,KAAK,EAAE,2CAA2C;IAClD,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2FAA2F;IAC7F,WAAW,EAAE,8EAA8E;CAC5F,CAAC;AAEF;;;;;GAKG;AACH,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,UAAU;IACd,WAAW,EAAE,0EAA0E;IACvF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC;IAC3C,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,uEAAuE;QACvE,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,SAAS,GAAyB,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC/D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,GAAG,KAAK,aAAa;oBACrB,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,GAAG,KAAK,SAAS;wBACjB,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,OAAO,CAAC;YAChB,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,eAAe,EACf,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,6BAA6B,GAAG,GAAG;gBAC1C,SAAS;gBACT,OAAO,EAAE,wBAAwB,GAAG,uDAAuD;aAC5F,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,SAAS,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACxC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,SAAS,GAAyB,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC7D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;oBACvB,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,KAAK,CAAC;YACZ,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,iBAAiB,EACjB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,8CAA8C,GAAG,GAAG;gBAC3D,SAAS;gBACT,OAAO,EAAE,oCAAoC,GAAG,6DAA6D;aAC9G,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAe;IACzC,kBAAkB;IAClB,iBAAiB;IACjB,eAAe;IACf,WAAW;IACX,WAAW;IACX,eAAe;CAChB,CAAC"}
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../src/detectors/source.ts"],"names":[],"mappings":"AA6BA,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEtF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,mBAAmB,GACvB,8FAA8F,CAAC;AACjG,MAAM,qBAAqB,GAAG,6BAA6B,CAAC;AAC5D,yEAAyE;AACzE,iFAAiF;AACjF,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,sBAAsB,GAC1B,6EAA6E,CAAC;AAChF,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAC3D,MAAM,SAAS,GAAG,mDAAmD,CAAC;AACtE,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAC1C,MAAM,cAAc,GAAG,qDAAqD,CAAC;AAC7E,MAAM,eAAe,GAAG,uCAAuC,CAAC;AAEhE,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,iBAAiB,GACrB,iFAAiF,CAAC;AACpF,MAAM,cAAc,GAClB,0HAA0H,CAAC;AAE7H,aAAa;AACb,MAAM,YAAY,GAAG,iCAAiC,CAAC;AACvD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,iFAAiF;AACjF,gFAAgF;AAChF,4DAA4D;AAC5D,MAAM,cAAc,GAClB,oIAAoI,CAAC;AACvI,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;AAC7D,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AACjE,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAC1C,6EAA6E;AAC7E,MAAM,YAAY,GAChB,2GAA2G,CAAC;AAE9G,YAAY;AACZ,MAAM,UAAU,GAAG,+EAA+E,CAAC;AACnG,oEAAoE;AACpE,MAAM,YAAY,GAAG,+CAA+C,CAAC;AAErE,cAAc;AACd,MAAM,qBAAqB,GACzB,6GAA6G,CAAC;AAChH,MAAM,aAAa,GAAG,iCAAiC,CAAC;AACxD,8EAA8E;AAC9E,iFAAiF;AACjF,0EAA0E;AAC1E,8EAA8E;AAC9E,iFAAiF;AACjF,kFAAkF;AAClF,MAAM,kBAAkB,GACtB,mHAAmH,CAAC;AAEtH,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,uEAAuE;CACjF,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,+CAA+C;IACtD,WAAW,EAAE,yCAAyC;IACtD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,kGAAkG;IACpG,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,sBAAsB,GAAa;IACvC,EAAE,EAAE,0BAA0B;IAC9B,KAAK,EAAE,mDAAmD;IAC1D,WAAW,EAAE,kDAAkD;IAC/D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+GAA+G;IACjH,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,6BAA6B;IACpC,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,wFAAwF;CAClG,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,qBAAqB;IACzB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,kCAAkC;IAC/C,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,6FAA6F;CAChG,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EAAE,mBAAmB;IAChC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0FAA0F;CAC7F,CAAC;AACF,MAAM,qBAAqB,GAAa;IACtC,EAAE,EAAE,yBAAyB;IAC7B,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,8CAA8C;IAC3D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mGAAmG;CACtG,CAAC;AACF,MAAM,sBAAsB,GAAa;IACvC,EAAE,EAAE,0BAA0B;IAC9B,KAAK,EAAE,yCAAyC;IAChD,WAAW,EAAE,iDAAiD;IAC9D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2FAA2F;CAC9F,CAAC;AAEF,+EAA+E;AAC/E,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE;QACL,gBAAgB;QAChB,cAAc;QACd,sBAAsB;QACtB,YAAY;QACZ,iBAAiB;QACjB,cAAc;QACd,qBAAqB;QACrB,sBAAsB;KACvB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACnD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,iFAAiF;QACjF,SAAS,CAAC,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAChC,MAAM,GAAG,GAWL;gBACF,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;gBACvE,uEAAuE;gBACvE,wDAAwD;gBACxD,SAAS,EAAE;oBACT,IAAI,EAAE,KAAK;oBACX,GAAG,EAAE,WAAW;oBAChB,GAAG,EAAE,MAAM;oBACX,IAAI,EAAE,KAAK;oBACX,KAAK,EAAE,SAAS;oBAChB,OAAO,EACL,sFAAsF;oBACxF,WAAW,EAAE,4CAA4C;iBAC1D;gBACD,mEAAmE;gBACnE,uEAAuE;gBACvE,qEAAqE;gBACrE,EAAE,EAAE;oBACF,IAAI,EAAE,MAAM;oBACZ,GAAG,EAAE,cAAc;oBACnB,GAAG,EAAE,MAAM;oBACX,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EACL,wEAAwE;wBACxE,6EAA6E;oBAC/E,WAAW,EACT,8FAA8F;iBACjG;gBACD,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC9E,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE;gBACzF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE;gBAC3F,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE;gBACrF,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE;gBACvF,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;aACpF,CAAC;YACF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,gBAAgB,EAChB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,iBAAiB;gBACrC,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,SAAS,EAAE,IAAI,CAAC,IAAI;gBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EACL,IAAI,CAAC,OAAO;oBACZ,yBAAyB,IAAI,CAAC,KAAK,uCAAuC;gBAC5E,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,4DAA4D;QAC5D,SAAS,CAAC,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC9C,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,cAAc,EAAE;gBAC9B,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,+EAA+E;QAC/E,SAAS,CAAC,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC/C,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,sBAAsB,EAAE;gBACtC,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,iFAAiF;QACjF,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACrC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAC3F,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAClC,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,iBAAiB,EACjB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAAC,GAAG;gBAC5C,OAAO,EAAE,qCAAqC,CAAC,CAAC,CAAC,CAAC,8DAA8D;aACjH,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,2DAA2D;QAC3D,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACvC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,cAAc,EAAE;gBAC9B,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,8EAA8E;QAC9E,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACvC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,qBAAqB,EAAE;gBACrC,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,sEAAsE;QACtE,SAAS,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACxC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,sBAAsB,EAAE;gBACtC,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,qBAAqB;IACzB,KAAK,EAAE,+BAA+B;IACtC,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,gFAAgF;CAC1F,CAAC;AAEF;;;;GAIG;AACH,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,WAAW;IACf,WAAW,EAAE,4DAA4D;IACzE,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,CAAC,cAAc,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACnD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAE9C,SAAS,CAAC,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC1C,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC;gBAAE,OAAO;YACvD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAChC,0EAA0E;YAC1E,uEAAuE;YACvE,IAAI,SAA+B,CAAC;YACpC,IAAI,QAA6B,CAAC;YAClC,IAAI,IAAa,CAAC;YAClB,IAAI,QAAyC,CAAC;YAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,SAAS,GAAG,KAAK,CAAC;gBAClB,MAAM,KAAK,GAAG,IAAI,KAAK,UAAU,CAAC;gBAClC,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;gBACvC,IAAI,GAAG,KAAK,CAAC;YACf,CAAC;iBAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC3B,SAAS,GAAG,MAAM,CAAC;gBACnB,QAAQ,GAAG,cAAc,CAAC;gBAC1B,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBAChD,SAAS,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAChD,QAAQ,GAAG,cAAc,CAAC;gBAC1B,IAAI,GAAG,IAAI,CAAC;gBACZ,QAAQ,GAAG,KAAK,CAAC,CAAC,uBAAuB;YAC3C,CAAC;iBAAM,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,SAAS,GAAG,OAAO,CAAC;gBACpB,QAAQ,GAAG,WAAW,CAAC;gBACvB,IAAI,GAAG,KAAK,CAAC;gBACb,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,OAAO,CAAC;gBACpB,QAAQ,GAAG,WAAW,CAAC;gBACvB,IAAI,GAAG,KAAK,CAAC;YACf,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,cAAc,EACd,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC1B,QAAQ;gBACR,SAAS;gBACT,IAAI;gBACJ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,wDAAwD;aAC9F,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,+BAA+B;IACtC,WAAW,EAAE,oCAAoC;IACjD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,2EAA2E;CACrF,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,4BAA4B;IACzC,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,sEAAsE;CAChF,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,sCAAsC;IACnD,kFAAkF;IAClF,yEAAyE;IACzE,6DAA6D;IAC7D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0FAA0F;CAC7F,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,yCAAyC;IACtD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,yGAAyG;IAC3G,WAAW,EAAE,+EAA+E;CAC7F,CAAC;AACF,MAAM,qBAAqB,GAAa;IACtC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,mCAAmC;IAChD,gFAAgF;IAChF,4EAA4E;IAC5E,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,6EAA6E;IACtF,WAAW,EAAE,8CAA8C;CAC5D,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,qBAAqB;IAC5B,WAAW,EAAE,yCAAyC;IACtD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,yFAAyF;IAC3F,WAAW,EAAE,sBAAsB;CACpC,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,2CAA2C;IACxD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,6EAA6E;CACvF,CAAC;AAEF,0EAA0E;AAC1E,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,2EAA2E;IACxF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE;QACL,cAAc;QACd,kBAAkB;QAClB,gBAAgB;QAChB,cAAc;QACd,qBAAqB;QACrB,mBAAmB;QACnB,iBAAiB;KAClB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACnD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QAEJ,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,2CAA2C;QAC9E,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC,CAAC,8BAA8B;QACzE,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,gCAAgC;QACvE,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,6CAA6C;QAChF,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC,CAAC,0CAA0C;QAC3F,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,2BAA2B;QACxE,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,6BAA6B;QAElE,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,MAAM,WAAW,GAAG,mDAAmD,CAAC;AAExE,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,iCAAiC;IAC9C,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,oFAAoF;IAC7F,WAAW,EAAE,2DAA2D;CACzE,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,2CAA2C;IACxD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,yFAAyF;IAC3F,WAAW,EAAE,6EAA6E;CAC3F,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,6DAA6D;IAC1E,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,6GAA6G;IAC/G,WAAW,EAAE,6EAA6E;CAC3F,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,UAAU;IACd,WAAW,EAAE,0EAA0E;IACvF,KAAK,EAAE,QAAQ;IACf,6EAA6E;IAC7E,+EAA+E;IAC/E,qDAAqD;IACrD,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,CAAC,YAAY,EAAE,cAAc,EAAE,kBAAkB,CAAC;IACzD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,mBAAmB,CAAC;IACtD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,yEAAyE;QACzE,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACnC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,SAA+B,CAAC;YACpC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAS,GAAG,KAAK,CAAC;iBAC/D,IAAI,GAAG,KAAK,OAAO;gBAAE,SAAS,GAAG,OAAO,CAAC;;gBACzC,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM;YAChC,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,YAAY,EACZ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,sBAAsB,GAAG,EAAE;gBAClC,SAAS;gBACT,OAAO,EAAE,uBAAuB,GAAG,8DAA8D;aAClG,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,yEAAyE;QACzE,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACrC,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,cAAc,EACd,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE;gBACnC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,8EAA8E;aACrG,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,+EAA+E;QAC/E,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACpC,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,kBAAkB,EAClB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,uEAAuE;aAC9F,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,4DAA4D;IACzE,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,2DAA2D;IACpE,WAAW,EAAE,+DAA+D;CAC7E,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,yBAAyB;IAC7B,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,2BAA2B;IACxC,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,mBAAmB;IACxB,OAAO,EAAE,6EAA6E;IACtF,WAAW,EAAE,gEAAgE;CAC9E,CAAC;AACF,MAAM,oBAAoB,GAAa;IACrC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,QAAQ;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,sDAAsD;IAC/D,WAAW,EAAE,oDAAoD;CAClE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,YAAY;IAChB,WAAW,EAAE,mDAAmD;IAChE,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,oBAAoB,CAAC;IAC/D,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACnD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,qEAAqE;QACrE,SAAS,CAAC,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC9C,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,eAAe,EAAE;gBAC/B,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,iEAAiE;QACjE,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACtC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,eAAe,EAAE;gBAC/B,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,SAAS,CAAC,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC3C,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,oBAAoB,EACpB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,uCAAuC,EAAE,CACzE,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,aAAa,GAAG,oEAAoE,CAAC;AAC3F,MAAM,eAAe,GACnB,4GAA4G,CAAC;AAC/G,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,UAAU,GACd,uKAAuK,CAAC;AAE1K,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,4DAA4D;IACzE,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,SAAS,EAAE,IAAI;IACf,OAAO,EAAE,gEAAgE;IACzE,WAAW,EACT,mNAAmN;CACtN,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,0BAA0B;IAC9B,KAAK,EAAE,2CAA2C;IAClD,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2FAA2F;IAC7F,WAAW,EAAE,8EAA8E;CAC5F,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,8EAA8E;IAC3F,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,gHAAgH;IAClH,WAAW,EACT,yHAAyH;CAC5H,CAAC;AAEF;;;;;GAKG;AACH,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,UAAU;IACd,WAAW,EAAE,0EAA0E;IACvF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,CAAC,eAAe,EAAE,iBAAiB,EAAE,YAAY,CAAC;IACzD,6EAA6E;IAC7E,6EAA6E;IAC7E,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,uEAAuE;QACvE,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,SAAS,GAAyB,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC/D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,GAAG,KAAK,aAAa;oBACrB,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,GAAG,KAAK,SAAS;wBACjB,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,OAAO,CAAC;YAChB,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,eAAe,EACf,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,6BAA6B,GAAG,GAAG;gBAC1C,SAAS;gBACT,OAAO,EAAE,wBAAwB,GAAG,uDAAuD;aAC5F,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,SAAS,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACxC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,SAAS,GAAyB,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC7D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;oBACvB,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,KAAK,CAAC;YACZ,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,iBAAiB,EACjB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,8CAA8C,GAAG,GAAG;gBAC3D,SAAS;gBACT,OAAO,EAAE,oCAAoC,GAAG,6DAA6D;aAC9G,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,4EAA4E;QAC5E,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACnC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,SAAS,GAAyB,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC;gBACtE,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;oBACtB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,QAAQ,CAAC;YACf,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,YAAY,EACZ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,KAAK,EAAE,+BAA+B,GAAG,GAAG;gBAC5C,SAAS;gBACT,OAAO,EAAE,qBAAqB,GAAG,mBAAmB,SAAS,wCAAwC;aACtG,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,kFAAkF;AAClF,kFAAkF;AAClF,gFAAgF;AAChF,mFAAmF;AACnF,kFAAkF;AAClF,yEAAyE;AACzE,mEAAmE;AACnE,MAAM,oBAAoB,GAAG,qDAAqD,CAAC;AAEnF,MAAM,sBAAsB,GAAa;IACvC,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,yCAAyC;IAChD,WAAW,EAAE,8DAA8D;IAC3E,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,wJAAwJ;IAC1J,WAAW,EACT,0JAA0J;CAC7J,CAAC;AAEF;;;;;GAKG;AACH,MAAM,uBAAuB,GAAa;IACxC,EAAE,EAAE,kBAAkB;IACtB,WAAW,EAAE,oEAAoE;IACjF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,CAAC,sBAAsB,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,SAAS,CAAC,oBAAoB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,SAAS,GAAyB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7E,QAAQ,CAAC,IAAI,CACX,eAAe,CACb,sBAAsB,EACtB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAC3D;gBACE,SAAS;gBACT,OAAO,EAAE,qCAAqC,GAAG,OAAO,SAAS,yCAAyC;aAC3G,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAe;IACzC,kBAAkB;IAClB,iBAAiB;IACjB,eAAe;IACf,WAAW;IACX,WAAW;IACX,eAAe;IACf,uBAAuB;CACxB,CAAC","sourcesContent":["/**\n * Source-code detectors for classical, non-quantum-safe asymmetric cryptography\n * in JavaScript / TypeScript. Each detector is pure and stateless: it declares\n * which files it applies to, the catalog of rules it can emit (`rules`), and\n * returns zero or more Findings for a file's contents.\n *\n * Rule metadata (title / severity / category / remediation / …) lives ONCE in\n * the per-detector `RuleMeta` declarations below, not inline in `detect()`.\n * `detect()` builds findings from those declarations via `findingFromRule`,\n * overriding only the fields that genuinely vary per match (e.g. the concrete\n * algorithm family of a `generateKeyPair('ec')` call). The declarations are the\n * catalog surfaced by the registry, SARIF `rules[]`, and the MCP resolver.\n *\n * The detection strategy is deliberately lexical (regex over source text). This\n * is robust to bundling and partial files and keeps the package dependency-free.\n * Confidence is set per-pattern to reflect how specific the match is.\n *\n * All per-file regexes are precompiled at module scope (not re-created per\n * file) — `eachMatch` clones a fresh stateful copy only when a regex lacks the\n * global flag, and these are all global, so they are reused safely.\n *\n * HNDL (harvest-now-decrypt-later) policy:\n *   - confidentiality primitives (key exchange / KEM: ECDH, DH, RSA-OAEP) → hndl:true\n *   - signatures (RSA-PSS, ECDSA, EdDSA, DSA, JWT alg) → hndl:false, but still high\n *     severity because a quantum attacker can forge them.\n *   - EC keygen is ambiguous (an 'ec' key feeds BOTH ECDSA and ECDH); it is\n *     classified conservatively as key-exchange-capable (hndl:true).\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport {\n  JS_TS_EXTENSIONS,\n  DOC_EXTENSIONS,\n  JWT_HOST_EXTENSIONS,\n  eachMatch,\n  findingFromRule,\n  hasExtension,\n  nearSortedCall,\n} from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from \"../cwe.js\";\n\n/* -------------------------------------------------------------------------- */\n/* Precompiled regexes (module scope — never recreated per file)              */\n/* -------------------------------------------------------------------------- */\n\n// `rsa-pss` is listed before `rsa` so the alternation consumes the full token\n// (ordered alternation would otherwise match `rsa` and reject the `-pss` tail).\nconst RE_GENERATE_KEYPAIR =\n  /generateKeyPair(?:Sync)?\\s*\\(\\s*['\"`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['\"`]/g;\nconst RE_CREATE_SIGN_VERIFY = /create(?:Sign|Verify)\\s*\\(/g;\n// One-shot crypto.sign/verify(algorithm, data, key). A LOOKBEHIND (not a\n// consumed char) anchors it so it doesn't fire inside identifiers like `assign(`\n// or `createSign(` (handled by the dedicated createSign/createVerify rule) —\n// consuming the preceding char used to push the match onto the previous line,\n// corrupting the reported line/snippet and SARIF/baseline fingerprints. The\n// first argument is either a quoted digest-algorithm string (RSA/ECDSA) or\n// `null` — Node's EdDSA one-shot form is `crypto.sign(null, data, edKey)`.\nconst RE_ONESHOT_SIGN_VERIFY =\n  /(?<![.\\w])(?:crypto\\.)?(sign|verify)\\s*\\(\\s*(?:['\"`][\\w.-]+['\"`]|null)\\s*,/g;\nconst RE_CREATE_DH = /createDiffieHellman(?:Group)?\\s*\\(/g;\nconst RE_GET_DH = /getDiffieHellman\\s*\\(\\s*['\"`](modp\\d+)['\"`]\\s*\\)/g;\nconst RE_CREATE_ECDH = /createECDH\\s*\\(/g;\nconst RE_RSA_ENCRYPT = /(?:crypto\\.)?(?:publicEncrypt|privateDecrypt)\\s*\\(/g;\nconst RE_DH_KEYOBJECT = /(?:crypto\\.)?diffieHellman\\s*\\(\\s*\\{/g;\n\n// WebCrypto. Includes the newer curve algorithms (Ed25519/Ed448 signatures,\n// X25519/X448 key agreement) shipping in modern SubtleCrypto implementations.\nconst RE_WEBCRYPTO_ALGO =\n  /\\b(RSA-OAEP|RSA-PSS|RSASSA-PKCS1-v1_5|ECDH|ECDSA|Ed25519|Ed448|X25519|X448)\\b/gi;\nconst RE_SUBTLE_CALL =\n  /subtle\\s*\\.\\s*(generateKey|importKey|exportKey|deriveKey|deriveBits|sign|verify|encrypt|decrypt|wrapKey|unwrapKey)\\s*\\(/g;\n\n// Libraries.\nconst RE_FORGE_RSA = /pki\\.rsa\\.generateKeyPair\\s*\\(/g;\nconst RE_FORGE_ED25519 = /forge\\.ed25519\\b/g;\n// Require a curve-like first argument so `new EC(\"request-scope\")` (a non-crypto\n// `EC` class) is not flagged; the elliptic library is always constructed with a\n// named curve (`new EC('secp256k1')`, `new EC('p256')`, …).\nconst RE_ELLIPTIC_EC =\n  /new\\s+(?:elliptic\\.)?ec\\s*\\(\\s*['\"`](?:sec[pt]|prime|nistp|curve|ed25519|ed448|brainpool|p-?(?:192|224|256|384|521)|x25519|x448)/gi;\nconst RE_JSRSASIGN_KEYGEN = /KEYUTIL\\.generateKeypair\\s*\\(/g;\nconst RE_JSRSASIGN_SIGN = /KJUR\\.crypto\\.(?:Signature|ECDSA)\\b/g;\nconst RE_NODE_RSA = /new\\s+NodeRSA\\s*\\(/g;\n// secp256k1 — direct @noble/secp256k1 / secp256k1-style API usage in source.\nconst RE_SECP256K1 =\n  /\\b(?:secp(?:256k1)?|secp)\\s*\\.\\s*(?:sign|verify|getPublicKey|getSharedSecret|ecdh|recoverPublicKey)\\s*\\(/g;\n\n// JWT/JOSE.\nconst RE_JWT_ALG = /['\"`](RS(?:256|384|512)|PS(?:256|384|512)|ES(?:256|384|512|256K)|EdDSA)['\"`]/g;\n// JOSE ECDH-ES key agreement (HNDL) and COSE algorithm identifiers.\nconst RE_JOSE_ECDH = /['\"`](ECDH-ES(?:\\+A(?:128|192|256)KW)?)['\"`]/g;\n\n// TLS config.\nconst RE_TLS_LEGACY_VERSION =\n  /(?:minVersion|maxVersion)\\s*:\\s*['\"`]TLSv1(?:\\.1)?['\"`]|secureProtocol\\s*:\\s*['\"`]TLSv1(?:_1)?_method['\"`]/g;\nconst RE_TLS_REJECT = /rejectUnauthorized\\s*:\\s*false/g;\n// Hardened cipher regex: bounded spans (no unbounded `[^'\"`]*` straddling the\n// alternation), single-quote-style anchoring removed in favour of {0,256} bounds\n// so worst-case backtracking is linear in the bound, not the file (P0-6).\n// The `(?<![!-])` lookbehind skips OpenSSL EXCLUSION syntax — `!MD5` / `-RC4`\n// DISABLE those ciphers, so a hardened list like `...:!aNULL:!MD5:!RC4` must not\n// be flagged as weak (audit: crypto #7). A genuinely-enabled `RC4` still matches.\nconst RE_TLS_WEAK_CIPHER =\n  /ciphers\\s*:\\s*['\"`][^'\"`\\n]{0,256}?\\b(?<![!-])(RC4|DES|3DES|MD5|NULL|EXPORT|aNULL|eNULL)\\b[^'\"`\\n]{0,256}?['\"`]/gi;\n\n/* -------------------------------------------------------------------------- */\n/* Node.js `crypto` module                                                    */\n/* -------------------------------------------------------------------------- */\n\n/**\n * Rule catalog for the Node `crypto` detector. `node-crypto-keygen` and\n * `node-crypto-dh-modp` refine some fields per match; the rest emit findings\n * straight from these declarations.\n */\nconst RULE_NODE_KEYGEN: RuleMeta = {\n  id: \"node-crypto-keygen\",\n  title: \"Classical key generation\",\n  description: \"crypto.generateKeyPair(Sync)('rsa'|'ec'|'dsa'|'dh'|…)\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Generates a classical asymmetric key pair, which is not quantum-safe.\",\n};\nconst RULE_NODE_SIGN: RuleMeta = {\n  id: \"node-crypto-sign\",\n  title: \"Classical signature (createSign/createVerify)\",\n  description: \"crypto.createSign / crypto.createVerify\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"medium\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Uses createSign/createVerify, typically RSA, ECDSA or DSA — all forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_NODE_SIGN_ONESHOT: RuleMeta = {\n  id: \"node-crypto-sign-oneshot\",\n  title: \"Classical one-shot signature (crypto.sign/verify)\",\n  description: \"one-shot crypto.sign / crypto.verify (Node ≥ 12)\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"medium\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Uses the one-shot crypto.sign/crypto.verify API, typically RSA/ECDSA/EdDSA — forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_NODE_DH: RuleMeta = {\n  id: \"node-crypto-dh\",\n  title: \"Diffie-Hellman key exchange\",\n  description: \"crypto.createDiffieHellman(Group)\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Finite-field Diffie-Hellman is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_NODE_DH_MODP: RuleMeta = {\n  id: \"node-crypto-dh-modp\",\n  title: \"Diffie-Hellman MODP group\",\n  description: \"crypto.getDiffieHellman('modpN')\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Named finite-field DH MODP group is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_NODE_ECDH: RuleMeta = {\n  id: \"node-crypto-ecdh\",\n  title: \"ECDH key exchange\",\n  description: \"crypto.createECDH\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Elliptic-curve Diffie-Hellman is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_NODE_RSA_ENCRYPT: RuleMeta = {\n  id: \"node-crypto-rsa-encrypt\",\n  title: \"RSA public-key encryption\",\n  description: \"crypto.publicEncrypt / crypto.privateDecrypt\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"RSA public-key encryption is broken by Shor's algorithm and exposed to harvest-now-decrypt-later.\",\n};\nconst RULE_NODE_DH_KEYOBJECT: RuleMeta = {\n  id: \"node-crypto-dh-keyobject\",\n  title: \"Diffie-Hellman (KeyObject) key exchange\",\n  description: \"crypto.diffieHellman({ privateKey, publicKey })\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"crypto.diffieHellman() performs a classical (EC)DH agreement (harvest-now-decrypt-later).\",\n};\n\n/** Detects classical asymmetric usage from Node's built-in `crypto` module. */\nconst nodeCryptoDetector: Detector = {\n  id: \"node-crypto\",\n  description: \"Classical asymmetric crypto via the Node.js `crypto` module\",\n  scope: \"source\",\n  language: \"js\",\n  rules: [\n    RULE_NODE_KEYGEN,\n    RULE_NODE_SIGN,\n    RULE_NODE_SIGN_ONESHOT,\n    RULE_NODE_DH,\n    RULE_NODE_DH_MODP,\n    RULE_NODE_ECDH,\n    RULE_NODE_RSA_ENCRYPT,\n    RULE_NODE_DH_KEYOBJECT,\n  ],\n  appliesTo: (f) => hasExtension(f, JS_TS_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n\n    // generateKeyPair(Sync)('rsa' | 'ec' | 'dsa' | 'dh' | 'x25519' | 'ed25519', ...)\n    eachMatch(RE_GENERATE_KEYPAIR, content, (m) => {\n      const type = m[1].toLowerCase();\n      const map: Record<\n        string,\n        {\n          algo: Finding[\"algorithm\"];\n          cat: Finding[\"category\"];\n          sev: Finding[\"severity\"];\n          hndl: boolean;\n          label: string;\n          message?: string;\n          remediation?: string;\n        }\n      > = {\n        rsa: { algo: \"RSA\", cat: \"kem\", sev: \"high\", hndl: true, label: \"RSA\" },\n        // RSA-PSS is signature-only, so classify it as a (forgeable) signature\n        // rather than a KEM — no HNDL confidentiality exposure.\n        \"rsa-pss\": {\n          algo: \"RSA\",\n          cat: \"signature\",\n          sev: \"high\",\n          hndl: false,\n          label: \"RSA-PSS\",\n          message:\n            \"Generates a classical RSA-PSS signing key, which is forgeable by a quantum attacker.\",\n          remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n        },\n        // EC keys feed BOTH ECDSA (sign) and ECDH (key agreement). ECDH is\n        // HNDL-exposed, so classify conservatively as key-exchange-capable and\n        // surface both concerns rather than asserting signature-only (P0-4).\n        ec: {\n          algo: \"ECDH\",\n          cat: \"key-exchange\",\n          sev: \"high\",\n          hndl: true,\n          label: \"EC (ECDSA/ECDH)\",\n          message:\n            \"Generates a classical EC key pair. EC keys feed BOTH ECDSA signatures \" +\n            \"and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.\",\n          remediation:\n            \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).\",\n        },\n        dsa: { algo: \"DSA\", cat: \"signature\", sev: \"high\", hndl: false, label: \"DSA\" },\n        dh: { algo: \"DH\", cat: \"key-exchange\", sev: \"high\", hndl: true, label: \"Diffie-Hellman\" },\n        x25519: { algo: \"X25519\", cat: \"key-exchange\", sev: \"medium\", hndl: true, label: \"X25519\" },\n        x448: { algo: \"X448\", cat: \"key-exchange\", sev: \"medium\", hndl: true, label: \"X448\" },\n        ed25519: { algo: \"EdDSA\", cat: \"signature\", sev: \"low\", hndl: false, label: \"Ed25519\" },\n        ed448: { algo: \"EdDSA\", cat: \"signature\", sev: \"low\", hndl: false, label: \"Ed448\" },\n      };\n      const info = map[type];\n      findings.push(\n        findingFromRule(\n          RULE_NODE_KEYGEN,\n          { file, content, index: m.index, matchLength: m[0].length },\n          {\n            title: `${info.label} key generation`,\n            category: info.cat,\n            severity: info.sev,\n            algorithm: info.algo,\n            hndl: info.hndl,\n            message:\n              info.message ??\n              `Generates a classical ${info.label} key pair, which is not quantum-safe.`,\n            ...(info.remediation ? { remediation: info.remediation } : {}),\n          },\n        ),\n      );\n    });\n\n    // createSign / createVerify — RSA / ECDSA / DSA signatures.\n    eachMatch(RE_CREATE_SIGN_VERIFY, content, (m) => {\n      findings.push(\n        findingFromRule(RULE_NODE_SIGN, {\n          file,\n          content,\n          index: m.index,\n          matchLength: m[0].length,\n        }),\n      );\n    });\n\n    // One-shot crypto.sign(algorithm, data, key) / crypto.verify(...) (Node ≥ 12).\n    eachMatch(RE_ONESHOT_SIGN_VERIFY, content, (m) => {\n      findings.push(\n        findingFromRule(RULE_NODE_SIGN_ONESHOT, {\n          file,\n          content,\n          index: m.index,\n          matchLength: m[0].length,\n        }),\n      );\n    });\n\n    // createDiffieHellman / createDiffieHellmanGroup — finite-field DH key exchange.\n    eachMatch(RE_CREATE_DH, content, (m) => {\n      findings.push(\n        findingFromRule(RULE_NODE_DH, { file, content, index: m.index, matchLength: m[0].length }),\n      );\n    });\n\n    // getDiffieHellman('modpN') — named built-in finite-field MODP groups.\n    eachMatch(RE_GET_DH, content, (m) => {\n      findings.push(\n        findingFromRule(\n          RULE_NODE_DH_MODP,\n          { file, content, index: m.index, matchLength: m[0].length },\n          {\n            title: `Diffie-Hellman MODP group (${m[1]})`,\n            message: `Named finite-field DH MODP group \"${m[1]}\" is broken by Shor's algorithm (harvest-now-decrypt-later).`,\n          },\n        ),\n      );\n    });\n\n    // createECDH — elliptic-curve Diffie-Hellman key exchange.\n    eachMatch(RE_CREATE_ECDH, content, (m) => {\n      findings.push(\n        findingFromRule(RULE_NODE_ECDH, {\n          file,\n          content,\n          index: m.index,\n          matchLength: m[0].length,\n        }),\n      );\n    });\n\n    // publicEncrypt / privateDecrypt — RSA encryption (KEM-like confidentiality).\n    eachMatch(RE_RSA_ENCRYPT, content, (m) => {\n      findings.push(\n        findingFromRule(RULE_NODE_RSA_ENCRYPT, {\n          file,\n          content,\n          index: m.index,\n          matchLength: m[0].length,\n        }),\n      );\n    });\n\n    // diffieHellman({ privateKey, publicKey }) — KeyObject-based DH/ECDH.\n    eachMatch(RE_DH_KEYOBJECT, content, (m) => {\n      findings.push(\n        findingFromRule(RULE_NODE_DH_KEYOBJECT, {\n          file,\n          content,\n          index: m.index,\n          matchLength: m[0].length,\n        }),\n      );\n    });\n\n    return findings;\n  },\n};\n\n/* -------------------------------------------------------------------------- */\n/* WebCrypto (SubtleCrypto)                                                    */\n/* -------------------------------------------------------------------------- */\n\nconst RULE_WEBCRYPTO: RuleMeta = {\n  id: \"webcrypto-classical\",\n  title: \"WebCrypto classical algorithm\",\n  description: \"classical asymmetric algorithm passed to SubtleCrypto\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"A classical asymmetric WebCrypto algorithm is used, which is not quantum-safe.\",\n};\n\n/**\n * Detects classical algorithms passed to WebCrypto's SubtleCrypto methods. The\n * algorithm name can appear as a bare string (\"RSA-OAEP\") or as\n * `{ name: \"ECDH\" }`; we scan both forms within a window after a subtle call.\n */\nconst webCryptoDetector: Detector = {\n  id: \"webcrypto\",\n  description: \"Classical asymmetric algorithms via WebCrypto SubtleCrypto\",\n  scope: \"source\",\n  language: \"js\",\n  rules: [RULE_WEBCRYPTO],\n  appliesTo: (f) => hasExtension(f, JS_TS_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n\n    // Only consider names that appear near a subtle.* call to reduce noise.\n    // callIndexes is collected in ascending order (regex scans left→right), so\n    // proximity is resolved with a binary search instead of an O(M·C) scan.\n    const callIndexes: number[] = [];\n    eachMatch(RE_SUBTLE_CALL, content, (m) => callIndexes.push(m.index));\n    if (callIndexes.length === 0) return findings;\n\n    eachMatch(RE_WEBCRYPTO_ALGO, content, (m) => {\n      if (!nearSortedCall(callIndexes, m.index, 400)) return;\n      const name = m[1].toUpperCase();\n      // Classify by algorithm: RSA-OAEP is KEM (HNDL); ECDH/X25519/X448 are key\n      // agreement (HNDL); RSA-PSS/RSASSA/ECDSA/Ed25519/Ed448 are signatures.\n      let algorithm: Finding[\"algorithm\"];\n      let category: Finding[\"category\"];\n      let hndl: boolean;\n      let severity: Finding[\"severity\"] | undefined;\n      if (name.startsWith(\"RSA\")) {\n        algorithm = \"RSA\";\n        const isKem = name === \"RSA-OAEP\";\n        category = isKem ? \"kem\" : \"signature\";\n        hndl = isKem;\n      } else if (name === \"ECDH\") {\n        algorithm = \"ECDH\";\n        category = \"key-exchange\";\n        hndl = true;\n      } else if (name === \"X25519\" || name === \"X448\") {\n        algorithm = name === \"X448\" ? \"X448\" : \"X25519\";\n        category = \"key-exchange\";\n        hndl = true;\n        severity = \"low\"; // modern but classical\n      } else if (name === \"ED25519\" || name === \"ED448\") {\n        algorithm = \"EdDSA\";\n        category = \"signature\";\n        hndl = false;\n        severity = \"low\";\n      } else {\n        algorithm = \"ECDSA\";\n        category = \"signature\";\n        hndl = false;\n      }\n      findings.push(\n        findingFromRule(\n          RULE_WEBCRYPTO,\n          { file, content, index: m.index, matchLength: m[0].length },\n          {\n            title: `WebCrypto ${m[1]}`,\n            category,\n            algorithm,\n            hndl,\n            ...(severity ? { severity } : {}),\n            message: `WebCrypto algorithm \"${m[1]}\" is classical asymmetric crypto and not quantum-safe.`,\n          },\n        ),\n      );\n    });\n\n    return findings;\n  },\n};\n\n/* -------------------------------------------------------------------------- */\n/* Popular crypto libraries                                                    */\n/* -------------------------------------------------------------------------- */\n\nconst RULE_FORGE_RSA: RuleMeta = {\n  id: \"forge-rsa-keygen\",\n  title: \"node-forge RSA key generation\",\n  description: \"node-forge pki.rsa.generateKeyPair\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"node-forge generates a classical RSA key pair, which is not quantum-safe.\",\n};\nconst RULE_FORGE_ED25519: RuleMeta = {\n  id: \"forge-ed25519\",\n  title: \"node-forge Ed25519 usage\",\n  description: \"node-forge forge.ed25519.*\",\n  category: \"signature\",\n  severity: \"low\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"node-forge Ed25519 is a modern but still classical signature scheme.\",\n};\nconst RULE_ELLIPTIC_EC: RuleMeta = {\n  id: \"elliptic-ec\",\n  title: \"elliptic curve instantiation\",\n  description: \"the `elliptic` library — new EC(...)\",\n  // `new EC(...)` is a dual-use curve context (ECDSA sign AND ECDH `key.derive()`).\n  // Per this scanner's own EC-ambiguity policy, ambiguous EC is treated as\n  // key-agreement-capable and HNDL-exposed (audit: crypto #8).\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"The `elliptic` library implements classical ECDSA/ECDH, both broken by Shor's algorithm.\",\n};\nconst RULE_SECP256K1: RuleMeta = {\n  id: \"secp256k1-usage\",\n  title: \"secp256k1 ECDSA/ECDH usage\",\n  description: \"direct @noble/secp256k1-style API usage\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"medium\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Direct secp256k1 usage (ECDSA signatures / ECDH agreement) is classical and broken by Shor's algorithm.\",\n  remediation: \"ML-DSA-65 (FIPS 204) for signatures; hybrid X25519MLKEM768 for key agreement.\",\n};\nconst RULE_JSRSASIGN_KEYGEN: RuleMeta = {\n  id: \"jsrsasign-keygen\",\n  title: \"jsrsasign key generation\",\n  description: \"jsrsasign KEYUTIL.generateKeypair\",\n  // KEYUTIL.generateKeypair(\"RSA\"|\"EC\") makes keys usable for RSA-OAEP encryption\n  // and ECDH — HNDL-exposed, like Node's generateKeyPair (audit: crypto #13).\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"jsrsasign generates classical RSA/EC key pairs, which are not quantum-safe.\",\n  remediation: \"ML-KEM-768 (FIPS 203) / ML-DSA-65 (FIPS 204)\",\n};\nconst RULE_JSRSASIGN_SIGN: RuleMeta = {\n  id: \"jsrsasign-sign\",\n  title: \"jsrsasign signature\",\n  description: \"jsrsasign KJUR.crypto.Signature / ECDSA\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"jsrsasign signing uses classical RSA/ECDSA signatures, forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204)\",\n};\nconst RULE_NODE_RSA_LIB: RuleMeta = {\n  id: \"node-rsa\",\n  title: \"node-rsa key/usage\",\n  description: \"the `node-rsa` library — new NodeRSA(...)\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"node-rsa wraps classical RSA encryption/signing, which is not quantum-safe.\",\n};\n\n/** Detects classical crypto from popular npm libraries used in source. */\nconst libraryDetector: Detector = {\n  id: \"crypto-libs\",\n  description: \"Classical asymmetric crypto via node-forge, elliptic, jsrsasign, node-rsa\",\n  scope: \"source\",\n  language: \"js\",\n  rules: [\n    RULE_FORGE_RSA,\n    RULE_FORGE_ED25519,\n    RULE_ELLIPTIC_EC,\n    RULE_SECP256K1,\n    RULE_JSRSASIGN_KEYGEN,\n    RULE_JSRSASIGN_SIGN,\n    RULE_NODE_RSA_LIB,\n  ],\n  appliesTo: (f) => hasExtension(f, JS_TS_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n\n    add(RE_FORGE_RSA, RULE_FORGE_RSA); // node-forge: pki.rsa.generateKeyPair(...)\n    add(RE_FORGE_ED25519, RULE_FORGE_ED25519); // node-forge: forge.ed25519.*\n    add(RE_ELLIPTIC_EC, RULE_ELLIPTIC_EC); // elliptic: new EC('secp256k1')\n    add(RE_SECP256K1, RULE_SECP256K1); // secp.sign / getPublicKey / getSharedSecret\n    add(RE_JSRSASIGN_KEYGEN, RULE_JSRSASIGN_KEYGEN); // jsrsasign: KEYUTIL.generateKeypair(...)\n    add(RE_JSRSASIGN_SIGN, RULE_JSRSASIGN_SIGN); // jsrsasign: KJUR.crypto.*\n    add(RE_NODE_RSA, RULE_NODE_RSA_LIB); // node-rsa: new NodeRSA(...)\n\n    return findings;\n  },\n};\n\n/* -------------------------------------------------------------------------- */\n/* JWT / JOSE / COSE algorithm strings                                         */\n/* -------------------------------------------------------------------------- */\n\n// JOSE RSA key-transport algorithms (JWE `alg`): quoted RSA-OAEP / RSA-OAEP-256\n// /384/512 / RSA1_5. Classical RSA *encryption* (key transport) — distinct from\n// the RS*/PS* *signature* tokens above, and a harvest-now-decrypt-later surface.\nconst RE_JOSE_KEM = /['\"`](RSA-OAEP(?:-(?:256|384|512))?|RSA1_5)['\"`]/g;\n\nconst RULE_JWT_ALG: RuleMeta = {\n  id: \"jwt-classical-alg\",\n  title: \"Classical JWT/JOSE algorithm\",\n  description: \"JWS alg tokens (RS/PS/ES/EdDSA)\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"medium\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"A classical JWT/JOSE signature algorithm is used, forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204); track IETF PQC JOSE/COSE algorithms\",\n};\nconst RULE_JOSE_ECDH: RuleMeta = {\n  id: \"jose-ecdh-es\",\n  title: \"JOSE ECDH-ES key agreement\",\n  description: \"JOSE ECDH-ES / ECDH-ES+A*KW key agreement\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"medium\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"JOSE ECDH-ES performs classical ECDH key agreement — harvest-now-decrypt-later exposed.\",\n  remediation: \"Track IETF PQC JOSE/COSE; adopt hybrid X25519MLKEM768 KEM-based encryption.\",\n};\nconst RULE_JOSE_RSA_OAEP: RuleMeta = {\n  id: \"jose-rsa-oaep\",\n  title: \"JOSE RSA key-transport algorithm\",\n  description: \"JWE RSA-OAEP / RSA-OAEP-256/384/512 / RSA1_5 key encryption\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"medium\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"JOSE RSA key transport (RSA-OAEP / RSA1_5) is classical RSA encryption — harvest-now-decrypt-later exposed.\",\n  remediation: \"Track IETF PQC JOSE/COSE; adopt hybrid X25519MLKEM768 KEM-based encryption.\",\n};\n\n/**\n * Detects classical signature algorithm identifiers used by JWT/JOSE, plus\n * ECDH-ES key-agreement identifiers (HNDL-exposed). These appear as string\n * literals: `alg: \"RS256\"`, `algorithms: [\"ES256\"]`, `enc: \"ECDH-ES+A256KW\"`.\n */\nconst jwtDetector: Detector = {\n  id: \"jwt-jose\",\n  description: \"Classical JWT/JOSE algorithms (RS/PS/ES/EdDSA) and ECDH-ES key agreement\",\n  scope: \"source\",\n  // Language-agnostic evidence: a quoted \"RS256\"/\"ES256\" alg token is the same\n  // signal in JS/TS or Python (e.g. PyJWT `algorithm=\"RS256\"`), so this detector\n  // is un-gated from JS-only to the JWT host surfaces.\n  language: \"any\",\n  rules: [RULE_JWT_ALG, RULE_JOSE_ECDH, RULE_JOSE_RSA_OAEP],\n  appliesTo: (f) => hasExtension(f, JWT_HOST_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n\n    // Classical JWS signature alg tokens. Anchored to quotes to avoid words.\n    eachMatch(RE_JWT_ALG, content, (m) => {\n      const alg = m[1];\n      let algorithm: Finding[\"algorithm\"];\n      if (alg.startsWith(\"RS\") || alg.startsWith(\"PS\")) algorithm = \"RSA\";\n      else if (alg === \"EdDSA\") algorithm = \"EdDSA\";\n      else algorithm = \"ECDSA\"; // ES*\n      findings.push(\n        findingFromRule(\n          RULE_JWT_ALG,\n          { file, content, index: m.index, matchLength: m[0].length },\n          {\n            title: `JWT/JOSE algorithm ${alg}`,\n            algorithm,\n            message: `JWT/JOSE algorithm \"${alg}\" is a classical signature, forgeable by a quantum attacker.`,\n          },\n        ),\n      );\n    });\n\n    // JOSE ECDH-ES key agreement (and ECDH-ES+A*KW) — confidentiality, HNDL.\n    eachMatch(RE_JOSE_ECDH, content, (m) => {\n      findings.push(\n        findingFromRule(\n          RULE_JOSE_ECDH,\n          { file, content, index: m.index, matchLength: m[0].length },\n          {\n            title: `JOSE key agreement ${m[1]}`,\n            message: `JOSE \"${m[1]}\" performs classical ECDH key agreement — harvest-now-decrypt-later exposed.`,\n          },\n        ),\n      );\n    });\n\n    // JOSE RSA key transport (RSA-OAEP / RSA1_5) — classical RSA encryption, HNDL.\n    eachMatch(RE_JOSE_KEM, content, (m) => {\n      findings.push(\n        findingFromRule(\n          RULE_JOSE_RSA_OAEP,\n          { file, content, index: m.index, matchLength: m[0].length },\n          {\n            title: `JOSE RSA key transport ${m[1]}`,\n            message: `JOSE \"${m[1]}\" is classical RSA key transport — harvest-now-decrypt-later exposed.`,\n          },\n        ),\n      );\n    });\n\n    return findings;\n  },\n};\n\n/* -------------------------------------------------------------------------- */\n/* TLS legacy configuration                                                    */\n/* -------------------------------------------------------------------------- */\n\nconst RULE_TLS_LEGACY: RuleMeta = {\n  id: \"tls-legacy-version\",\n  title: \"Legacy TLS version pinned\",\n  description: \"minVersion/maxVersion/secureProtocol pinned to TLS 1.0/1.1\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_WEAK_STRENGTH,\n  message: \"TLS 1.0/1.1 are deprecated and insecure; require TLS 1.3.\",\n  remediation: \"Set minVersion: 'TLSv1.3' and prefer PQC-hybrid key exchange.\",\n};\nconst RULE_TLS_REJECT: RuleMeta = {\n  id: \"tls-reject-unauthorized\",\n  title: \"TLS certificate verification disabled\",\n  description: \"rejectUnauthorized: false\",\n  category: \"tls\",\n  severity: \"high\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_CERT_VALIDATION,\n  message: \"rejectUnauthorized:false disables TLS certificate verification (MITM risk).\",\n  remediation: \"Remove rejectUnauthorized:false; verify certificates properly.\",\n};\nconst RULE_TLS_WEAK_CIPHER: RuleMeta = {\n  id: \"tls-weak-cipher\",\n  title: \"Weak TLS cipher configured\",\n  description: \"weak/export cipher in a `ciphers` string\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"medium\",\n  hndl: false,\n  cwe: CWE_WEAK_STRENGTH,\n  message: \"A weak cipher is configured in the TLS ciphers list.\",\n  remediation: \"Use a modern AEAD cipher suite (TLS 1.3 defaults).\",\n};\n\n/**\n * Detects legacy / insecure TLS configuration expressed as JS object literals:\n * forced TLS 1.0/1.1, disabled certificate verification, and weak ciphers.\n * These aren't quantum-specific but materially weaken transport security and\n * are squarely in qScan's \"config\" scope.\n */\nconst tlsDetector: Detector = {\n  id: \"tls-config\",\n  description: \"Legacy / insecure TLS configuration in JS objects\",\n  scope: \"config\",\n  language: \"js\",\n  rules: [RULE_TLS_LEGACY, RULE_TLS_REJECT, RULE_TLS_WEAK_CIPHER],\n  appliesTo: (f) => hasExtension(f, JS_TS_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n\n    // minVersion / maxVersion / secureProtocol pinned to TLS 1.0 or 1.1.\n    eachMatch(RE_TLS_LEGACY_VERSION, content, (m) => {\n      findings.push(\n        findingFromRule(RULE_TLS_LEGACY, {\n          file,\n          content,\n          index: m.index,\n          matchLength: m[0].length,\n        }),\n      );\n    });\n\n    // rejectUnauthorized: false — disables certificate verification.\n    eachMatch(RE_TLS_REJECT, content, (m) => {\n      findings.push(\n        findingFromRule(RULE_TLS_REJECT, {\n          file,\n          content,\n          index: m.index,\n          matchLength: m[0].length,\n        }),\n      );\n    });\n\n    // Weak / export ciphers referenced in a ciphers string (bounded regex).\n    eachMatch(RE_TLS_WEAK_CIPHER, content, (m) => {\n      findings.push(\n        findingFromRule(\n          RULE_TLS_WEAK_CIPHER,\n          { file, content, index: m.index, matchLength: m[0].length },\n          { message: `Weak cipher (${m[1]}) configured in the TLS ciphers list.` },\n        ),\n      );\n    });\n\n    return findings;\n  },\n};\n\n/* -------------------------------------------------------------------------- */\n/* SSH public keys + TLS certificate signature algorithms (config scope)       */\n/* -------------------------------------------------------------------------- */\n\nconst RE_SSH_PUBKEY = /\\b(ssh-rsa|ssh-ed25519|ssh-dss|ecdsa-sha2-nistp(?:256|384|521))\\b/g;\nconst RE_CERT_SIG_ALG =\n  /\\b(sha(?:1|256|384|512)WithRSAEncryption|ecdsa-with-SHA(?:1|256|384|512)|rsassaPss|dsaWithSHA(?:1|256))\\b/g;\n// Classical SSH key-exchange algorithm identifiers: finite-field DH groups\n// (diffie-hellman-group{1,14,15,16,17,18} + group-exchange), ECDH over NIST\n// curves (ecdh-sha2-nistp*), and Curve25519 (curve25519-sha256). All are\n// Shor-broken key agreement — the harvest-now-decrypt-later surface a lexical\n// scan misses when only the `crypto/*` API is matched, not the negotiated kex.\nconst RE_SSH_KEX =\n  /\\b(diffie-hellman-group(?:1|14|15|16|17|18)(?:-sha1|-sha256|-sha512)?|diffie-hellman-group-exchange-sha(?:1|256)|ecdh-sha2-nistp(?:256|384|521)|curve25519-sha256)\\b/g;\n\nconst RULE_SSH_PUBKEY: RuleMeta = {\n  id: \"ssh-public-key\",\n  title: \"Classical SSH public key\",\n  description: \"ssh-rsa / ssh-ed25519 / ssh-dss / ecdsa-sha2-* public keys\",\n  category: \"certificate\",\n  severity: \"low\",\n  confidence: \"medium\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  sensitive: true,\n  message: \"A classical SSH public key is forgeable by a quantum attacker.\",\n  remediation:\n    \"Plan migration to PQC-capable SSH: prefer the mlkem768x25519-sha256 KEX (ML-KEM-768 hybrid, OpenSSH 10's default since Apr 2025); sntrup761x25519 is an acceptable interim. Rotate to PQC host keys as they land.\",\n};\nconst RULE_CERT_SIG_ALG: RuleMeta = {\n  id: \"cert-signature-algorithm\",\n  title: \"Classical certificate signature algorithm\",\n  description: \"X.509/TLS certificate signature-algorithm identifiers\",\n  category: \"certificate\",\n  severity: \"low\",\n  confidence: \"medium\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"A classical certificate signature algorithm (RSA/ECDSA/DSA) is a quantum forgery surface.\",\n  remediation: \"Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.\",\n};\nconst RULE_SSH_KEX: RuleMeta = {\n  id: \"ssh-kex-classical\",\n  title: \"Classical SSH key exchange\",\n  description: \"diffie-hellman-group* / group-exchange / ecdh-sha2-* / curve25519-sha256 kex\",\n  category: \"key-exchange\",\n  severity: \"medium\",\n  confidence: \"medium\",\n  algorithm: \"unknown\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"A classical SSH key-exchange algorithm (finite-field DH / ECDH / X25519) is harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"Prefer the mlkem768x25519-sha256 KEX (ML-KEM-768 hybrid, OpenSSH 10 default); sntrup761x25519 is an acceptable interim.\",\n};\n\n/**\n * Detects classical SSH public keys (`authorized_keys` / `known_hosts` lines)\n * and X.509 certificate signature-algorithm identifiers in any text file. These\n * are language-agnostic config surfaces — the SSH-key forgery surface and the\n * PKI signature surface that lexical PEM detection misses.\n */\nconst sshCertDetector: Detector = {\n  id: \"ssh-cert\",\n  description: \"SSH public keys and TLS/X.509 certificate signature algorithms in config\",\n  scope: \"config\",\n  language: \"any\",\n  rules: [RULE_SSH_PUBKEY, RULE_CERT_SIG_ALG, RULE_SSH_KEX],\n  // Skip prose/docs: a changelog or README that merely mentions `ssh-rsa` in a\n  // sentence is not crypto config. PEM material is caught by its own detector.\n  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n\n    // SSH public keys: ssh-rsa AAAA…, ecdsa-sha2-nistp256 …, ssh-ed25519 …\n    eachMatch(RE_SSH_PUBKEY, content, (m) => {\n      const tok = m[1];\n      const algorithm: Finding[\"algorithm\"] = tok.startsWith(\"ssh-rsa\")\n        ? \"RSA\"\n        : tok === \"ssh-ed25519\"\n          ? \"EdDSA\"\n          : tok === \"ssh-dss\"\n            ? \"DSA\"\n            : \"ECDSA\";\n      findings.push(\n        findingFromRule(\n          RULE_SSH_PUBKEY,\n          { file, content, index: m.index, matchLength: m[0].length },\n          {\n            title: `Classical SSH public key (${tok})`,\n            algorithm,\n            message: `SSH public key type \"${tok}\" is a classical key forgeable by a quantum attacker.`,\n          },\n        ),\n      );\n    });\n\n    // X.509 / TLS certificate signature algorithm identifiers (forgery surface).\n    eachMatch(RE_CERT_SIG_ALG, content, (m) => {\n      const tok = m[1];\n      const algorithm: Finding[\"algorithm\"] = /RSA|rsassa/i.test(tok)\n        ? \"RSA\"\n        : tok.startsWith(\"ecdsa\")\n          ? \"ECDSA\"\n          : \"DSA\";\n      findings.push(\n        findingFromRule(\n          RULE_CERT_SIG_ALG,\n          { file, content, index: m.index, matchLength: m[0].length },\n          {\n            title: `Classical certificate signature algorithm (${tok})`,\n            algorithm,\n            message: `Certificate signature algorithm \"${tok}\" is classical (RSA/ECDSA/DSA) — a quantum forgery surface.`,\n          },\n        ),\n      );\n    });\n\n    // SSH key-exchange algorithm identifiers (finite-field DH / ECDH / X25519).\n    eachMatch(RE_SSH_KEX, content, (m) => {\n      const tok = m[1];\n      const algorithm: Finding[\"algorithm\"] = tok.startsWith(\"diffie-hellman\")\n        ? \"DH\"\n        : tok.startsWith(\"ecdh\")\n          ? \"ECDH\"\n          : \"X25519\";\n      findings.push(\n        findingFromRule(\n          RULE_SSH_KEX,\n          { file, content, index: m.index, matchLength: m[0].length },\n          {\n            title: `Classical SSH key exchange (${tok})`,\n            algorithm,\n            message: `SSH key-exchange \"${tok}\" is classical (${algorithm}) — harvest-now-decrypt-later exposed.`,\n          },\n        ),\n      );\n    });\n\n    return findings;\n  },\n};\n\n/* -------------------------------------------------------------------------- */\n/* Classical TLS key-exchange cipher suites (language-agnostic config)         */\n/* -------------------------------------------------------------------------- */\n\n// Classical KEX cipher-suite identifiers, in both the OpenSSL (`ECDHE-RSA-…`) and\n// IANA (`TLS_ECDHE_RSA_WITH_…`) spellings, with `-` or `_` separators. These name\n// a Shor-broken key exchange (ECDHE/DHE), so they are the harvest-now surface a\n// PQC scanner should flag — distinct from the legacy-*version* / weak-cipher rules\n// above. Case-sensitive on purpose: cipher-suite tokens are upper-case constants,\n// so prose like \"ecdhe rsa\" does not misfire. No trailing \\b so the IANA\n// `TLS_ECDHE_RSA_WITH_…` form (a `_` follows `RSA`) still matches.\nconst RE_TLS_CLASSICAL_KEX = /\\b(?:TLS_)?(?:ECDHE|ECDH|DHE)[-_](?:RSA|ECDSA|DSS)/g;\n\nconst RULE_TLS_CLASSICAL_KEX: RuleMeta = {\n  id: \"tls-classical-kex\",\n  title: \"Classical TLS key-exchange cipher suite\",\n  description: \"ECDHE / DHE cipher suites negotiate Shor-broken key exchange\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"medium\",\n  algorithm: \"unknown\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical TLS key exchange (ECDHE/DHE) is harvest-now-decrypt-later exposed — the session key can be recorded now and recovered by a quantum attacker.\",\n  remediation:\n    \"Adopt a PQC-hybrid TLS 1.3 key exchange (e.g. X25519MLKEM768) as your stack and peers support it; keep classical suites only as a transitional fallback.\",\n};\n\n/**\n * Detects classical TLS key-exchange cipher suites in any text/config file\n * (OpenSSL cipher lists, IANA suite constants in Go/Java/C#/Rust, `.properties`,\n * etc.). Language-agnostic because the suite identifiers are the same tokens\n * everywhere — this is the cross-language TLS gap the legacy-version rule misses.\n */\nconst tlsClassicalKexDetector: Detector = {\n  id: \"tls-cipher-suite\",\n  description: \"Classical TLS key-exchange cipher suites (ECDHE/DHE) in any config\",\n  scope: \"config\",\n  language: \"any\",\n  rules: [RULE_TLS_CLASSICAL_KEX],\n  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    eachMatch(RE_TLS_CLASSICAL_KEX, content, (m) => {\n      const tok = m[0];\n      const algorithm: Finding[\"algorithm\"] = tok.includes(\"ECDH\") ? \"ECDH\" : \"DH\";\n      findings.push(\n        findingFromRule(\n          RULE_TLS_CLASSICAL_KEX,\n          { file, content, index: m.index, matchLength: m[0].length },\n          {\n            algorithm,\n            message: `Classical TLS key-exchange suite \"${tok}…\" (${algorithm}) is harvest-now-decrypt-later exposed.`,\n          },\n        ),\n      );\n    });\n    return findings;\n  },\n};\n\n/** All built-in source/config detectors, in run order. */\nexport const sourceDetectors: Detector[] = [\n  nodeCryptoDetector,\n  webCryptoDetector,\n  libraryDetector,\n  jwtDetector,\n  tlsDetector,\n  sshCertDetector,\n  tlsClassicalKexDetector,\n];\n"]}

package/dist/detectors/stateful-hbs.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Config / source-agnostic detector: stateful hash-based signatures
+ * (NIST SP 800-208) — LMS, HSS, XMSS and XMSSMT.
+ *
+ * These schemes ARE quantum-safe and NIST-approved (SP 800-208, for firmware /
+ * secure-boot signing), so this is NOT a "broken crypto" finding. The hazard it
+ * flags is STATE MANAGEMENT: each private key holds a bounded set of one-time
+ * key indices, and reusing an index is catastrophic (it enables signature
+ * forgery). The detector therefore surfaces the usage so a reviewer can confirm
+ * rigorous state handling exists — or migrate to a stateless scheme.
+ *
+ * Like {@link pemDetector}, this is a `scope: "config"`, `language: "any"`
+ * detector that runs on every text file, because the distinctive LMS/XMSS
+ * parameter strings and library tokens (`LMS_SHA256_M32_H10`, `pyhsslms`,
+ * `XMSS-SHA2_10_256`, …) appear identically across languages, config, and docs.
+ * Every rule's metadata lives in the {@link RuleMeta} declaration below; the
+ * regexes are tightly bounded and `\b`-anchored to stay high-signal.
+ */
+import type { Detector } from "../types.js";
+/** Detects stateful hash-based signature (SP 800-208) usage in arbitrary files. */
+export declare const statefulHbsDetector: Detector;
+//# sourceMappingURL=stateful-hbs.d.ts.map

package/dist/detectors/stateful-hbs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stateful-hbs.d.ts","sourceRoot":"","sources":["../../src/detectors/stateful-hbs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAoI/D,mFAAmF;AACnF,eAAO,MAAM,mBAAmB,EAAE,QAyBjC,CAAC"}

package/dist/detectors/stateful-hbs.js

@@ -0,0 +1,139 @@
+import { eachMatch, findingFromRule } from "../detect-utils.js";
+import { CWE_RISKY_PRIMITIVE } from "../cwe.js";
+/**
+ * Shared remediation for every stateful-HBS finding: these are approved but
+ * STATEFUL, so the reviewer must confirm state management before trusting them.
+ */
+const STATEFUL_HBS_REMEDIATION = "LMS/HSS/XMSS/XMSSMT are NIST-approved (SP 800-208) but STATEFUL: the signer " +
+    "must NEVER reuse a one-time key index (reuse enables signature forgery). Use " +
+    "only with rigorous, crash-safe state management; otherwise prefer the " +
+    "stateless ML-DSA (FIPS 204) or SLH-DSA (FIPS 205).";
+const HBS_RULES = [
+    {
+        // LMS parameter set, e.g. LMS_SHA256_M32_H10 (RFC 8554 / SP 800-208).
+        re: /\bLMS_SHA256_[MN]\d+_[HW]\d+\b/g,
+        meta: {
+            id: "stateful-hbs-lms-param",
+            title: "LMS parameter set (stateful hash-based signature)",
+            description: "LMS/HSS one-time-signature parameter string (SP 800-208)",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_RISKY_PRIMITIVE,
+            message: "LMS parameter set — NIST-approved (SP 800-208) but STATEFUL: reusing a one-time key index is catastrophic.",
+            remediation: STATEFUL_HBS_REMEDIATION,
+        },
+    },
+    {
+        // HSS keygen (hierarchical LMS), e.g. pyhsslms.hss_generate_private_key(...).
+        re: /\bhss_generate_private_key\b/g,
+        meta: {
+            id: "stateful-hbs-hss-keygen",
+            title: "HSS private-key generation (stateful hash-based signature)",
+            description: "HSS (hierarchical LMS) private-key generation call (SP 800-208)",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_RISKY_PRIMITIVE,
+            message: "HSS private-key generation — NIST-approved (SP 800-208) but STATEFUL: never reuse a one-time key index.",
+            remediation: STATEFUL_HBS_REMEDIATION,
+        },
+    },
+    {
+        // pyhsslms — the Python LMS/HSS library import token.
+        re: /\bpyhsslms\b/g,
+        meta: {
+            id: "stateful-hbs-pyhsslms",
+            title: "pyhsslms library (stateful LMS/HSS signatures)",
+            description: "Reference to the pyhsslms LMS/HSS library (SP 800-208)",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_RISKY_PRIMITIVE,
+            message: "pyhsslms (LMS/HSS) — NIST-approved (SP 800-208) but STATEFUL: the signer must never reuse a one-time key index.",
+            remediation: STATEFUL_HBS_REMEDIATION,
+        },
+    },
+    {
+        // XMSS parameter set, e.g. XMSS-SHA2_10_256 (RFC 8391 / SP 800-208).
+        re: /\bXMSS-SHA2_\d+_256\b/g,
+        meta: {
+            id: "stateful-hbs-xmss-param",
+            title: "XMSS parameter set (stateful hash-based signature)",
+            description: "XMSS one-time-signature parameter string (SP 800-208)",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_RISKY_PRIMITIVE,
+            message: "XMSS parameter set — NIST-approved (SP 800-208) but STATEFUL: reusing a one-time key index is catastrophic.",
+            remediation: STATEFUL_HBS_REMEDIATION,
+        },
+    },
+    {
+        // XMSSMT (multi-tree XMSS) parameter set, e.g. XMSSMT-SHA2_20/2_256.
+        re: /\bXMSSMT-SHA2_\d+\b/g,
+        meta: {
+            id: "stateful-hbs-xmssmt-param",
+            title: "XMSSMT parameter set (stateful hash-based signature)",
+            description: "XMSSMT (multi-tree XMSS) parameter string (SP 800-208)",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_RISKY_PRIMITIVE,
+            message: "XMSSMT parameter set — NIST-approved (SP 800-208) but STATEFUL: never reuse a one-time key index.",
+            remediation: STATEFUL_HBS_REMEDIATION,
+        },
+    },
+    {
+        // XMSS keypair generation, e.g. xmss_keypair(...) (liboqs / xmss reference).
+        re: /\bxmss_keypair\b/g,
+        meta: {
+            id: "stateful-hbs-xmss-keypair",
+            title: "XMSS keypair generation (stateful hash-based signature)",
+            description: "XMSS keypair-generation call (SP 800-208)",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_RISKY_PRIMITIVE,
+            message: "XMSS keypair generation — NIST-approved (SP 800-208) but STATEFUL: the signer must never reuse a one-time key index.",
+            remediation: STATEFUL_HBS_REMEDIATION,
+        },
+    },
+];
+/** Detects stateful hash-based signature (SP 800-208) usage in arbitrary files. */
+export const statefulHbsDetector = {
+    id: "stateful-hbs",
+    description: "Stateful hash-based signatures (NIST SP 800-208: LMS / HSS / XMSS / XMSSMT) in any file",
+    scope: "config",
+    language: "any",
+    rules: HBS_RULES.map((r) => r.meta),
+    // Applies to every text file; the walker already filters out binaries.
+    appliesTo: () => true,
+    detect({ file, content }) {
+        const findings = [];
+        for (const rule of HBS_RULES) {
+            eachMatch(rule.re, content, (m) => {
+                findings.push(findingFromRule(rule.meta, {
+                    file,
+                    content,
+                    index: m.index,
+                    matchLength: m[0].length,
+                }));
+            });
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=stateful-hbs.js.map