@securecode-ai/mcp 0.1.0 → 0.2.0

package/dist/project-map/fixTester.js

@@ -0,0 +1,338 @@
+"use strict";
+/**
+ * Phase H — Fix Regression Tester.
+ *
+ * Verifies that a fix doesn't break existing behavior or introduce new
+ * vulnerabilities by running a differential analysis on the original and
+ * fixed code.
+ *
+ * Algorithm:
+ *   1. Syntax check: parse the fixed code — if it doesn't parse, syntaxValid = false
+ *   2. Differential analysis: run the AST Sink Finder (Phase B) + Taint Tracker
+ *      (Phase C) on both original and fixed code
+ *      - Original had a tainted sink + fixed doesn't → fix is effective
+ *      - Fixed code has a new tainted sink → newVulnerabilities
+ *      - Fixed code has a new sink not in original → newVulnerabilities
+ *   3. Functional regression: check if the fix changed the code structure
+ *      in ways that could break behavior (removed functions, changed signatures)
+ *
+ * No runtime execution needed — the POC Executor (Phase F) handles that.
+ * The fix tester is purely static: it compares the AST analysis results.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.testFix = testFix;
+const parserLoader_1 = require("./parserLoader");
+const sinkFinder_1 = require("./sinkFinder");
+const taintTracker_1 = require("./taintTracker");
+// ── Helpers ────────────────────────────────────────────────────────────────
+/** Extract function names from source code via AST walk. */
+async function extractFunctionNames(source, language) {
+    const parsed = await (0, parserLoader_1.parseSource)(source, language);
+    if (!parsed)
+        return new Set();
+    const { root } = parsed;
+    const names = new Set();
+    const { walk } = await Promise.resolve().then(() => __importStar(require('./astHelpers')));
+    const FUNCTION_TYPES = new Set([
+        'function_declaration', 'function_definition', 'method_definition',
+        'async_function_declaration', 'async_function_definition',
+    ]);
+    for (const node of walk(root)) {
+        if (FUNCTION_TYPES.has(node.type)) {
+            const id = node.namedChildren.find(c => c.type === 'identifier');
+            if (id) {
+                const name = parsed.root.startIndex !== undefined
+                    ? source.slice(id.startIndex, id.endIndex)
+                    : '';
+                if (name)
+                    names.add(name);
+            }
+        }
+    }
+    return names;
+}
+/** Compare sink findings between original and fixed code. */
+function compareSinks(originalSinks, fixedSinks, vulnType, vulnLine) {
+    const removed = [];
+    const added = [];
+    const newVulns = [];
+    // Sinks in original but not in fixed → removed (fix worked)
+    for (const orig of originalSinks) {
+        const stillExists = fixedSinks.some(f => f.line === orig.line && f.canonicalType === orig.canonicalType);
+        if (!stillExists) {
+            removed.push(orig);
+        }
+    }
+    // Sinks in fixed but not in original → new vulnerabilities
+    for (const fixed of fixedSinks) {
+        const existedBefore = originalSinks.some(o => o.line === fixed.line && o.canonicalType === fixed.canonicalType);
+        if (!existedBefore) {
+            added.push(fixed);
+            newVulns.push(`${fixed.canonicalType} at line ${fixed.line} (${fixed.sink})`);
+        }
+    }
+    return { removed, added, newVulns };
+}
+/** Compare taint results between original and fixed code. */
+function compareTaint(originalTaint, fixedTaint, vulnType, vulnLine) {
+    const fixedFlows = [];
+    const newFlows = [];
+    // Taint flows in original but not in fixed → fixed
+    for (const orig of originalTaint) {
+        const stillTainted = fixedTaint.some(f => f.source === orig.source && f.sink === orig.sink && f.sinkLine === orig.sinkLine);
+        if (!stillTainted) {
+            fixedFlows.push(orig);
+        }
+    }
+    // Taint flows in fixed but not in original → new vulns
+    for (const fixed of fixedTaint) {
+        const existedBefore = originalTaint.some(o => o.source === fixed.source && o.sink === fixed.sink && o.sinkLine === fixed.sinkLine);
+        if (!existedBefore) {
+            newFlows.push(fixed);
+        }
+    }
+    return { fixedFlows, newFlows };
+}
+// ── Main entry point ───────────────────────────────────────────────────────
+/**
+ * Test a fix by comparing the original and fixed code statically.
+ *
+ * @param originalCode  the original source code
+ * @param fixedCode     the fixed source code
+ * @param language      the source language
+ * @param options       optional test options (vulnType, vulnLine)
+ * @returns the test result
+ */
+async function testFix(originalCode, fixedCode, language, options) {
+    const tests = [];
+    const newVulnerabilities = [];
+    const regressions = [];
+    // ── 1. Syntax check ─────────────────────────────────────────────────
+    // Tree-sitter is error-recovery: it produces a parse tree even for
+    // invalid syntax, inserting ERROR/MISSING nodes. We walk the tree to
+    // detect these — parseSource returning non-null does NOT mean the
+    // syntax is valid.
+    let syntaxValid = true;
+    try {
+        const parsed = await (0, parserLoader_1.parseSource)(fixedCode, language);
+        if (!parsed) {
+            syntaxValid = false;
+            tests.push({
+                name: 'Syntax check',
+                passed: false,
+                error: 'Fixed code failed to parse (invalid syntax or unsupported language)',
+            });
+        }
+        else {
+            // Walk the tree looking for ERROR/MISSING nodes, and check the
+            // root's hasError flag (tree-sitter sets this when error
+            // recovery inserted ERROR/MISSING nodes during parsing).
+            const { walk } = await Promise.resolve().then(() => __importStar(require('./astHelpers')));
+            let hasError = parsed.root.hasError === true;
+            if (!hasError) {
+                for (const node of walk(parsed.root)) {
+                    if (node.type === 'ERROR' || node.type === 'error'
+                        || node.type === 'MISSING' || node.type === 'missing') {
+                        hasError = true;
+                        break;
+                    }
+                }
+            }
+            if (hasError) {
+                syntaxValid = false;
+                tests.push({
+                    name: 'Syntax check',
+                    passed: false,
+                    error: 'Fixed code contains syntax errors (detected ERROR nodes in AST)',
+                });
+            }
+            else {
+                tests.push({ name: 'Syntax check', passed: true });
+            }
+        }
+    }
+    catch (err) {
+        syntaxValid = false;
+        tests.push({
+            name: 'Syntax check',
+            passed: false,
+            error: err.message,
+        });
+    }
+    // If syntax is invalid, we can't do further analysis
+    if (!syntaxValid) {
+        return {
+            passes: false,
+            syntaxValid: false,
+            fixEffective: false,
+            newVulnerabilities: [],
+            regressions: [],
+            tests,
+        };
+    }
+    // ── 2. Differential sink analysis ────────────────────────────────────
+    let originalSinks = [];
+    let fixedSinks = [];
+    try {
+        [originalSinks, fixedSinks] = await Promise.all([
+            (0, sinkFinder_1.findSinks)(originalCode, language),
+            (0, sinkFinder_1.findSinks)(fixedCode, language),
+        ]);
+    }
+    catch (err) {
+        tests.push({
+            name: 'Differential sink analysis',
+            passed: false,
+            error: `Sink finder failed: ${err.message}`,
+        });
+    }
+    if (originalSinks.length > 0 || fixedSinks.length > 0) {
+        const { removed, added, newVulns } = compareSinks(originalSinks, fixedSinks, options?.vulnType, options?.vulnLine);
+        if (newVulns.length > 0) {
+            newVulnerabilities.push(...newVulns);
+            tests.push({
+                name: 'No new sinks introduced',
+                passed: false,
+                error: `Fix introduced new sinks: ${newVulns.join(', ')}`,
+            });
+        }
+        else {
+            tests.push({ name: 'No new sinks introduced', passed: true });
+        }
+        if (removed.length > 0) {
+            tests.push({
+                name: 'Original sink removed',
+                passed: true,
+            });
+        }
+    }
+    // ── 3. Differential taint analysis ────────────────────────────────────
+    let originalTaint = [];
+    let fixedTaint = [];
+    try {
+        [originalTaint, fixedTaint] = await Promise.all([
+            (0, taintTracker_1.trackTaint)(originalCode, language),
+            (0, taintTracker_1.trackTaint)(fixedCode, language),
+        ]);
+    }
+    catch (err) {
+        tests.push({
+            name: 'Differential taint analysis',
+            passed: false,
+            error: `Taint tracker failed: ${err.message}`,
+        });
+    }
+    if (originalTaint.length > 0 || fixedTaint.length > 0) {
+        const { fixedFlows, newFlows } = compareTaint(originalTaint, fixedTaint, options?.vulnType, options?.vulnLine);
+        if (newFlows.length > 0) {
+            newVulnerabilities.push(...newFlows.map(f => `${f.canonicalType}: ${f.source} → ${f.sink} (line ${f.sinkLine})`));
+            tests.push({
+                name: 'No new taint flows introduced',
+                passed: false,
+                error: `Fix introduced new taint flows: ${newFlows.length}`,
+            });
+        }
+        else {
+            tests.push({ name: 'No new taint flows introduced', passed: true });
+        }
+        if (fixedFlows.length > 0) {
+            tests.push({
+                name: 'Original taint flow eliminated',
+                passed: true,
+            });
+        }
+    }
+    // ── 4. Function preservation check ──────────────────────────────────
+    try {
+        const [origFns, fixedFns] = await Promise.all([
+            extractFunctionNames(originalCode, language),
+            extractFunctionNames(fixedCode, language),
+        ]);
+        const removedFns = [...origFns].filter(fn => !fixedFns.has(fn));
+        if (removedFns.length > 0) {
+            regressions.push(`Functions removed: ${removedFns.join(', ')}`);
+            tests.push({
+                name: 'No functions removed',
+                passed: false,
+                error: `Removed: ${removedFns.join(', ')}`,
+            });
+        }
+        else {
+            tests.push({ name: 'No functions removed', passed: true });
+        }
+    }
+    catch {
+        // Best-effort: skip if function extraction fails
+    }
+    // ── 5. Determine if the fix is effective ─────────────────────────────
+    let fixEffective = false;
+    if (options?.vulnType) {
+        // Check if the specific vulnerability was removed
+        const hadVuln = originalSinks.some(s => s.canonicalType === options.vulnType)
+            || originalTaint.some(t => t.canonicalType === options.vulnType);
+        const stillHasVuln = fixedSinks.some(s => s.canonicalType === options.vulnType)
+            || fixedTaint.some(t => t.canonicalType === options.vulnType);
+        fixEffective = hadVuln && !stillHasVuln;
+    }
+    else {
+        // No specific type: fix is effective if any sink/taint was removed
+        fixEffective = originalSinks.length > fixedSinks.length
+            || originalTaint.length > fixedTaint.length;
+    }
+    if (fixEffective) {
+        tests.push({ name: 'Fix effective (vulnerability removed)', passed: true });
+    }
+    else if (options?.vulnType) {
+        tests.push({
+            name: 'Fix effective (vulnerability removed)',
+            passed: false,
+            error: `Original ${options.vulnType} vulnerability still present in fixed code`,
+        });
+    }
+    // ── Final verdict ────────────────────────────────────────────────────
+    const passes = syntaxValid
+        && newVulnerabilities.length === 0
+        && (fixEffective || !options?.vulnType);
+    return {
+        passes,
+        syntaxValid,
+        fixEffective,
+        newVulnerabilities,
+        regressions,
+        tests,
+    };
+}
+//# sourceMappingURL=fixTester.js.map

package/dist/project-map/fixTester.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixTester.js","sourceRoot":"","sources":["../../src/project-map/fixTester.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4IH,0BAsNC;AAhWD,iDAA6C;AAC7C,6CAAsD;AACtD,iDAAyD;AA2BzD,8EAA8E;AAE9E,4DAA4D;AAC5D,KAAK,UAAU,oBAAoB,CAC/B,MAAc,EACd,QAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAW,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,EAAE,IAAI,EAAE,GAAG,wDAAa,cAAc,GAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;QAC3B,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB;QAClE,4BAA4B,EAAE,2BAA2B;KAC5D,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;YACjE,IAAI,EAAE,EAAE,CAAC;gBACL,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS;oBAC7C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC;oBAC1C,CAAC,CAAC,EAAE,CAAC;gBACT,IAAI,IAAI;oBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,6DAA6D;AAC7D,SAAS,YAAY,CACjB,aAA4B,EAC5B,UAAyB,EACzB,QAAiB,EACjB,QAAiB;IAEjB,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,4DAA4D;IAC5D,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,CACtE,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,CACxE,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,aAAa,YAAY,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QAClF,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,6DAA6D;AAC7D,SAAS,YAAY,CACjB,aAA4B,EAC5B,UAAyB,EACzB,QAAiB,EACjB,QAAiB;IAEjB,MAAM,UAAU,GAAkB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,mDAAmD;IACnD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CACxF,CAAC;QACF,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAC3F,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACL,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;GAQG;AACI,KAAK,UAAU,OAAO,CACzB,YAAoB,EACpB,SAAiB,EACjB,QAAsB,EACtB,OAAwB;IAExB,MAAM,KAAK,GAAwD,EAAE,CAAC;IACtE,MAAM,kBAAkB,GAAa,EAAE,CAAC;IACxC,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,uEAAuE;IACvE,mEAAmE;IACnE,qEAAqE;IACrE,kEAAkE;IAClE,mBAAmB;IACnB,IAAI,WAAW,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAW,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,WAAW,GAAG,KAAK,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,qEAAqE;aAC/E,CAAC,CAAC;QACP,CAAC;aAAM,CAAC;YACJ,+DAA+D;YAC/D,yDAAyD;YACzD,yDAAyD;YACzD,MAAM,EAAE,IAAI,EAAE,GAAG,wDAAa,cAAc,GAAC,CAAC;YAC9C,IAAI,QAAQ,GAAI,MAAM,CAAC,IAAY,CAAC,QAAQ,KAAK,IAAI,CAAC;YACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;2BAC3C,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBACxD,QAAQ,GAAG,IAAI,CAAC;wBAChB,MAAM;oBACV,CAAC;gBACL,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACX,WAAW,GAAG,KAAK,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC;oBACP,IAAI,EAAE,cAAc;oBACpB,MAAM,EAAE,KAAK;oBACb,KAAK,EAAE,iEAAiE;iBAC3E,CAAC,CAAC;YACP,CAAC;iBAAM,CAAC;gBACJ,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;QACL,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,WAAW,GAAG,KAAK,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC,CAAC;IACP,CAAC;IAED,qDAAqD;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACf,OAAO;YACH,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,YAAY,EAAE,KAAK;YACnB,kBAAkB,EAAE,EAAE;YACtB,WAAW,EAAE,EAAE;YACf,KAAK;SACR,CAAC;IACN,CAAC;IAED,wEAAwE;IACxE,IAAI,aAAa,GAAkB,EAAE,CAAC;IACtC,IAAI,UAAU,GAAkB,EAAE,CAAC;IACnC,IAAI,CAAC;QACD,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5C,IAAA,sBAAS,EAAC,YAAY,EAAE,QAAQ,CAAC;YACjC,IAAA,sBAAS,EAAC,SAAS,EAAE,QAAQ,CAAC;SACjC,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,uBAAuB,GAAG,CAAC,OAAO,EAAE;SAC9C,CAAC,CAAC;IACP,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,YAAY,CAC7C,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAClE,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,kBAAkB,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,6BAA6B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC5D,CAAC,CAAC;QACP,CAAC;aAAM,CAAC;YACJ,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,IAAI;aACf,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,IAAI,aAAa,GAAkB,EAAE,CAAC;IACtC,IAAI,UAAU,GAAkB,EAAE,CAAC;IACnC,IAAI,CAAC;QACD,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5C,IAAA,yBAAU,EAAC,YAAY,EAAE,QAAQ,CAAC;YAClC,IAAA,yBAAU,EAAC,SAAS,EAAE,QAAQ,CAAC;SAClC,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,6BAA6B;YACnC,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,yBAAyB,GAAG,CAAC,OAAO,EAAE;SAChD,CAAC,CAAC;IACP,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,YAAY,CACzC,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAClE,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,kBAAkB,CAAC,IAAI,CACnB,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,QAAQ,GAAG,CAAC,CAC3F,CAAC;YACF,KAAK,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,+BAA+B;gBACrC,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,mCAAmC,QAAQ,CAAC,MAAM,EAAE;aAC9D,CAAC,CAAC;QACP,CAAC;aAAM,CAAC;YACJ,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,gCAAgC;gBACtC,MAAM,EAAE,IAAI;aACf,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,IAAI,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1C,oBAAoB,CAAC,YAAY,EAAE,QAAQ,CAAC;YAC5C,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC;SAC5C,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,WAAW,CAAC,IAAI,CAAC,sBAAsB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7C,CAAC,CAAC;QACP,CAAC;aAAM,CAAC;YACJ,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,iDAAiD;IACrD,CAAC;IAED,wEAAwE;IACxE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACpB,kDAAkD;QAClD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,QAAQ,CAAC;eACtE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,QAAQ,CAAC;eACxE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClE,YAAY,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC;IAC5C,CAAC;SAAM,CAAC;QACJ,mEAAmE;QACnE,YAAY,GAAG,aAAa,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM;eAChD,aAAa,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IACpD,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uCAAuC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;SAAM,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,uCAAuC;YAC7C,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,YAAY,OAAO,CAAC,QAAQ,4CAA4C;SAClF,CAAC,CAAC;IACP,CAAC;IAED,wEAAwE;IACxE,MAAM,MAAM,GAAG,WAAW;WACnB,kBAAkB,CAAC,MAAM,KAAK,CAAC;WAC/B,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE5C,OAAO;QACH,MAAM;QACN,WAAW;QACX,YAAY;QACZ,kBAAkB;QAClB,WAAW;QACX,KAAK;KACR,CAAC;AACN,CAAC"}

package/dist/project-map/guardEvaluator.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Phase E — guard effectiveness evaluator.
+ *
+ * Takes a guard (middleware function, sanitizer call, or validator) and
+ * an attack type, and returns whether the guard actually stops the attack.
+ *
+ * The evaluator reuses:
+ * - `detectAuthInFunction` from `detectors.ts` to identify auth guards
+ * - The sanitizer registry from `sanitizers.ts` to identify sanitizer guards
+ * - The pattern library in `guardPatterns.ts` to evaluate effectiveness
+ *
+ * The Juror sees these deterministic guard evaluations and doesn't have to
+ * guess whether `parseInt()` stops XSS (it doesn't) or whether `escape()`
+ * stops SQLi (it doesn't).
+ */
+import { GuardEvaluation, AttackType } from './guardPatterns';
+import type { SinkLanguage } from './sinkRegistry';
+export type { GuardEvaluation, AttackType };
+/**
+ * Evaluate a guard against a specific attack type.
+ *
+ * @param guardSource  the source text of the guard function
+ * @param guardName    the guard's display name (middleware name)
+ * @param attackType   the attack to evaluate against
+ * @param language     the source language
+ * @returns the evaluation result
+ */
+export declare function evaluateGuard(guardSource: string, guardName: string, attackType: AttackType, language: SinkLanguage): Promise<GuardEvaluation>;
+/**
+ * Evaluate multiple guards against multiple attack types.
+ *
+ * @param guards  array of { source, name } pairs
+ * @param attacks array of attack types to evaluate each guard against
+ * @param language the source language
+ * @returns flat array of evaluations (one per guard×attack pair)
+ */
+export declare function evaluateGuards(guards: Array<{
+    source: string;
+    name: string;
+}>, attacks: AttackType[], language: SinkLanguage): Promise<GuardEvaluation[]>;

package/dist/project-map/guardEvaluator.js

@@ -0,0 +1,216 @@
+"use strict";
+/**
+ * Phase E — guard effectiveness evaluator.
+ *
+ * Takes a guard (middleware function, sanitizer call, or validator) and
+ * an attack type, and returns whether the guard actually stops the attack.
+ *
+ * The evaluator reuses:
+ * - `detectAuthInFunction` from `detectors.ts` to identify auth guards
+ * - The sanitizer registry from `sanitizers.ts` to identify sanitizer guards
+ * - The pattern library in `guardPatterns.ts` to evaluate effectiveness
+ *
+ * The Juror sees these deterministic guard evaluations and doesn't have to
+ * guess whether `parseInt()` stops XSS (it doesn't) or whether `escape()`
+ * stops SQLi (it doesn't).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateGuard = evaluateGuard;
+exports.evaluateGuards = evaluateGuards;
+const parserLoader_1 = require("./parserLoader");
+const astHelpers_1 = require("./astHelpers");
+const detectors_1 = require("./detectors");
+const sanitizers_1 = require("./sanitizers");
+const guardPatterns_1 = require("./guardPatterns");
+// ── Guard identification ────────────────────────────────────────────────────
+/**
+ * Identify what type of guard a function body implements.
+ * Returns the guard type, or 'unknown' if not recognized.
+ */
+function identifyGuardType(fnRoot, source, language) {
+    const text = source.slice(fnRoot.startIndex, fnRoot.endIndex);
+    // ── 1. Auth guards ──────────────────────────────────────────────────────
+    const auth = (0, detectors_1.detectAuthInFunction)(fnRoot, source);
+    if (auth !== 'none') {
+        if (auth === 'jwt') {
+            // Check if algorithm is pinned
+            const hasAlgorithmPin = /algorithms?\s*:/i.test(text)
+                || /verifyOptions\.algorithms/i.test(text);
+            return hasAlgorithmPin ? 'auth-jwt-verify' : 'auth-jwt-verify-noalg';
+        }
+        if (auth === 'session')
+            return 'auth-session';
+        if (auth === 'api-key')
+            return 'auth-api-key';
+    }
+    // ── 2. Sanitizer calls ──────────────────────────────────────────────────
+    for (const node of (0, astHelpers_1.walk)(fnRoot)) {
+        if (node.type !== 'call_expression' && node.type !== 'call')
+            continue;
+        const p = (0, astHelpers_1.callParts)(node, source);
+        if (!p)
+            continue;
+        const sanitizer = (0, sanitizers_1.matchSanitizer)(p.method, p.receiver, language);
+        if (!sanitizer)
+            continue;
+        // Classify by sanitizer name
+        if (['parseInt', 'parseFloat', 'Number', 'int', 'float', 'Boolean', 'bool'].includes(sanitizer)) {
+            return 'sanitizer-numeric';
+        }
+        if (['escape', 'escapeHtml', 'sanitize', 'sanitizeHtml', 'clean', 'xss'].includes(sanitizer)
+            || sanitizer.includes('DOMPurify') || sanitizer.includes('bleach')
+            || sanitizer.includes('markupsafe') || sanitizer.includes('nh3')) {
+            return 'sanitizer-html';
+        }
+        if (['encodeURIComponent', 'encodeURI'].includes(sanitizer)) {
+            return 'sanitizer-url';
+        }
+    }
+    // ── 3. Parameterized query ────────────────────────────────────────────
+    // A parameterized query passes the query string (with ? placeholders)
+    // and the params as separate arguments — no string concatenation.
+    // Pattern: db.query("SELECT ... WHERE id = ?", [params]) — two args,
+    // first is a string literal with ?, second is an array/expression.
+    for (const node of (0, astHelpers_1.walk)(fnRoot)) {
+        if (node.type !== 'call_expression' && node.type !== 'call')
+            continue;
+        const p = (0, astHelpers_1.callParts)(node, source);
+        if (!p || !p.receiver)
+            continue;
+        if (['query', 'execute', 'raw', '$queryRaw'].includes(p.method)) {
+            // Check for parameterized pattern: 2+ args, first is a string
+            // literal containing ? or a named param, and no concatenation.
+            if (p.args.length >= 2) {
+                const firstArg = p.args[0];
+                const argText = source.slice(firstArg.startIndex, firstArg.endIndex);
+                const isStringLike = firstArg.type === 'string'
+                    || firstArg.type === 'template_string'
+                    || firstArg.type === 'template_literal';
+                const hasPlaceholder = argText.includes('?') || /:\w+/.test(argText);
+                const hasConcat = argText.includes('+');
+                if (isStringLike && hasPlaceholder && !hasConcat) {
+                    return 'parameterized-query';
+                }
+            }
+        }
+    }
+    // ── 4. Allowlist ────────────────────────────────────────────────────────
+    // A literal allowlist: if (['a', 'b', 'c'].includes(value))
+    if (/if\s*\(\s*\[[^\]]*\]\s*\.(includes|indexOf|has)\s*\(/.test(text)
+        || /if\s*\(\s*\w+\s+in\s+\[/.test(text)) {
+        // Check if the array is a literal (not a variable)
+        const hasLiteralArray = /\[\s*['"`][^\]]*\]\s*\.(includes|indexOf)/.test(text);
+        return hasLiteralArray ? 'allowlist-literal' : 'allowlist-dynamic';
+    }
+    // ── 5. Rate limiting ──────────────────────────────────────────────────
+    if (/rateLimit|rate_limit|RateLimit|express-rate-limit|slowDown/i.test(text)) {
+        return 'rate-limit';
+    }
+    // ── 6. Helmet ──────────────────────────────────────────────────────────
+    if (/helmet\s*\(|require\s*\(\s*['"]helmet['"]/.test(text)) {
+        return 'helmet';
+    }
+    // ── 7. CORS ────────────────────────────────────────────────────────────
+    if (/cors\s*\(|require\s*\(\s*['"]cors['"]/.test(text)) {
+        // Check if origin is '*'
+        if (/origin\s*:\s*['"]\*['"]/.test(text)) {
+            return 'cors-permissive';
+        }
+        return 'cors-strict';
+    }
+    // ── 8. Validator (zod/joi/pydantic) ────────────────────────────────────
+    if (/\.parse\s*\(|\.validate\s*\(|\.safeParse\s*\(/.test(text)
+        && /(zod|joi|yup|pydantic|schema)/i.test(text)) {
+        return 'validator';
+    }
+    return 'unknown';
+}
+// ── Evaluation ──────────────────────────────────────────────────────────────
+/**
+ * Evaluate a guard against a specific attack type.
+ *
+ * @param guardSource  the source text of the guard function
+ * @param guardName    the guard's display name (middleware name)
+ * @param attackType   the attack to evaluate against
+ * @param language     the source language
+ * @returns the evaluation result
+ */
+async function evaluateGuard(guardSource, guardName, attackType, language) {
+    const parsed = await (0, parserLoader_1.parseSource)(guardSource, language);
+    let guardType = 'unknown';
+    if (parsed) {
+        // Try to find a function body in the parsed source. The guard source
+        // may be a full function declaration or just a function body.
+        const { root } = parsed;
+        // Look for a function declaration/definition
+        let fnNode = null;
+        for (const n of (0, astHelpers_1.walk)(root)) {
+            if (['function_declaration', 'function_definition', 'method_definition',
+                'async_function_declaration', 'async_function_definition',
+                'arrow_function', 'function_expression'].includes(n.type)) {
+                fnNode = n;
+                break;
+            }
+        }
+        if (fnNode) {
+            guardType = identifyGuardType(fnNode, guardSource, language);
+        }
+        else {
+            // Parse as a bare expression/statement block
+            guardType = identifyGuardType(root, guardSource, language);
+        }
+    }
+    // Look up effectiveness
+    const effective = guardPatterns_1.GUARD_EFFECTIVENESS[guardType]?.[attackType];
+    const isEffective = effective === true;
+    const isKnown = effective !== undefined;
+    // Build reason
+    let reason;
+    let bypassExample;
+    if (isEffective) {
+        reason = guardPatterns_1.GUARD_EFFECTIVE_REASONS[guardType]?.[attackType]
+            ?? `Guard type '${guardType}' is effective against ${attackType}`;
+    }
+    else if (isKnown) {
+        // Not effective
+        reason = `Guard type '${guardType}' is NOT effective against ${attackType}`;
+        bypassExample = guardPatterns_1.GUARD_BYPASS_EXAMPLES[guardType]?.[attackType];
+    }
+    else {
+        // Unknown — guard detected but we can't determine effectiveness
+        reason = `Guard detected as '${guardType}' but effectiveness against ${attackType} is unknown`;
+        bypassExample = undefined;
+    }
+    return {
+        guardName,
+        guardType,
+        attackType,
+        effective: isEffective,
+        reason,
+        ...(bypassExample && { bypassExample }),
+    };
+}
+/**
+ * Evaluate multiple guards against multiple attack types.
+ *
+ * @param guards  array of { source, name } pairs
+ * @param attacks array of attack types to evaluate each guard against
+ * @param language the source language
+ * @returns flat array of evaluations (one per guard×attack pair)
+ */
+async function evaluateGuards(guards, attacks, language) {
+    const results = [];
+    for (const guard of guards) {
+        for (const attack of attacks) {
+            try {
+                const eval_ = await evaluateGuard(guard.source, guard.name, attack, language);
+                results.push(eval_);
+            }
+            catch {
+                // Best-effort: skip guards that fail to parse
+            }
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=guardEvaluator.js.map

package/dist/project-map/guardEvaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardEvaluator.js","sourceRoot":"","sources":["../../src/project-map/guardEvaluator.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AA0IH,sCA6DC;AAUD,wCAiBC;AAhOD,iDAA6D;AAC7D,6CAA6D;AAC7D,2CAA8D;AAC9D,6CAA8C;AAC9C,mDAGyB;AAOzB,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,iBAAiB,CACtB,MAAsB,EACtB,MAAc,EACd,QAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE9D,2EAA2E;IAC3E,MAAM,IAAI,GAAG,IAAA,gCAAoB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAClB,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACjB,+BAA+B;YAC/B,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;mBAC9C,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,OAAO,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,uBAAuB,CAAC;QACzE,CAAC;QACD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,cAAc,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,cAAc,CAAC;IAClD,CAAC;IAED,2EAA2E;IAC3E,KAAK,MAAM,IAAI,IAAI,IAAA,iBAAI,EAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACtE,MAAM,CAAC,GAAG,IAAA,sBAAS,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,SAAS,GAAG,IAAA,2BAAc,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,6BAA6B;QAC7B,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9F,OAAO,mBAAmB,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;eACrF,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;eAC/D,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,gBAAgB,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,OAAO,eAAe,CAAC;QAC3B,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,kEAAkE;IAClE,qEAAqE;IACrE,mEAAmE;IACnE,KAAK,MAAM,IAAI,IAAI,IAAA,iBAAI,EAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACtE,MAAM,CAAC,GAAG,IAAA,sBAAS,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,SAAS;QAChC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,8DAA8D;YAC9D,+DAA+D;YAC/D,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACrB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACrE,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ;uBACxC,QAAQ,CAAC,IAAI,KAAK,iBAAiB;uBACnC,QAAQ,CAAC,IAAI,KAAK,kBAAkB,CAAC;gBAC5C,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACxC,IAAI,YAAY,IAAI,cAAc,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC/C,OAAO,qBAAqB,CAAC;gBACjC,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,sDAAsD,CAAC,IAAI,CAAC,IAAI,CAAC;WAC9D,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,mDAAmD;QACnD,MAAM,eAAe,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,eAAe,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACvE,CAAC;IAED,yEAAyE;IACzE,IAAI,6DAA6D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,0EAA0E;IAC1E,IAAI,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,0EAA0E;IAC1E,IAAI,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,yBAAyB;QACzB,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,iBAAiB,CAAC;QAC7B,CAAC;QACD,OAAO,aAAa,CAAC;IACzB,CAAC;IAED,0EAA0E;IAC1E,IAAI,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC;WACvD,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,OAAO,WAAW,CAAC;IACvB,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;GAQG;AACI,KAAK,UAAU,aAAa,CAC/B,WAAmB,EACnB,SAAiB,EACjB,UAAsB,EACtB,QAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAW,EAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,SAAS,GAAc,SAAS,CAAC;IAErC,IAAI,MAAM,EAAE,CAAC;QACT,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QACxB,6CAA6C;QAC7C,IAAI,MAAM,GAA0B,IAAI,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB;gBACnE,4BAA4B,EAAE,2BAA2B;gBACzD,gBAAgB,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,MAAM,GAAG,CAAC,CAAC;gBACX,MAAM;YACV,CAAC;QACL,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACT,SAAS,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACJ,6CAA6C;YAC7C,SAAS,GAAG,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC/D,CAAC;IACL,CAAC;IAED,wBAAwB;IACxB,MAAM,SAAS,GAAG,mCAAmB,CAAC,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,SAAS,KAAK,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,SAAS,KAAK,SAAS,CAAC;IAExC,eAAe;IACf,IAAI,MAAc,CAAC;IACnB,IAAI,aAAiC,CAAC;IAEtC,IAAI,WAAW,EAAE,CAAC;QACd,MAAM,GAAG,uCAAuB,CAAC,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC;eAClD,eAAe,SAAS,0BAA0B,UAAU,EAAE,CAAC;IAC1E,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACjB,gBAAgB;QAChB,MAAM,GAAG,eAAe,SAAS,8BAA8B,UAAU,EAAE,CAAC;QAC5E,aAAa,GAAG,qCAAqB,CAAC,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACJ,gEAAgE;QAChE,MAAM,GAAG,sBAAsB,SAAS,+BAA+B,UAAU,aAAa,CAAC;QAC/F,aAAa,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED,OAAO;QACH,SAAS;QACT,SAAS;QACT,UAAU;QACV,SAAS,EAAE,WAAW;QACtB,MAAM;QACN,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;KAC1C,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,cAAc,CAChC,MAA+C,EAC/C,OAAqB,EACrB,QAAsB;IAEtB,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACL,8CAA8C;YAClD,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC"}