@securecode-ai/mcp 0.1.0 → 0.2.0

package/dist/project-map/taintTracker.js

@@ -0,0 +1,571 @@
+"use strict";
+/**
+ * Phase C — taint propagation tracker.
+ *
+ * Walks a parsed file forward, maintaining a per-scope set of tainted
+ * variables. When a source access is found (req.body, request.GET, etc.),
+ * the variable is marked tainted. Taint propagates through assignments,
+ * concatenations, and template interpolations. Sanitizer calls strip
+ * taint. When a sink (from the sink registry) is encountered, the
+ * arguments are checked for taint — if tainted, a TaintResult is recorded
+ * with the full propagation path from source to sink.
+ *
+ * Intra-function: source and sink in the same function (the common case).
+ * Inter-function: a simple first pass identifies functions that return
+ * tainted data; calls to those functions propagate taint to the result.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trackTaint = trackTaint;
+const parserLoader_1 = require("./parserLoader");
+const astHelpers_1 = require("./astHelpers");
+const sinkRegistry_1 = require("./sinkRegistry");
+const taintSources_1 = require("./taintSources");
+const sanitizers_1 = require("./sanitizers");
+function scopeGet(scope, name) {
+    let s = scope;
+    while (s) {
+        if (s.tainted.has(name))
+            return s.tainted.get(name);
+        s = s.parent;
+    }
+    return undefined;
+}
+// ── Node type sets ──────────────────────────────────────────────────────────
+const FUNCTION_NODE_TYPES = new Set([
+    'function_declaration', 'function_definition', 'method_definition',
+    'async_function_declaration', 'async_function_definition',
+    'arrow_function', 'function_expression',
+    'generator_function_declaration', 'generator_declaration',
+]);
+const CALL_NODE_TYPES = new Set(['call_expression', 'call', 'new_expression']);
+const STATEMENT_TYPES = new Set([
+    'expression_statement', 'lexical_declaration', 'variable_declaration',
+    'if_statement', 'for_statement', 'for_in_statement', 'for_each_statement',
+    'while_statement', 'do_statement', 'try_statement', 'try',
+    'return_statement', 'return',
+    'function_declaration', 'function_definition', 'method_definition',
+    'block', 'statement_block',
+    'export_statement', 'throw_statement', 'raise_statement',
+    'with_statement', 'augmented_assignment', 'assignment',
+    'decorated_definition',
+]);
+// ── Source detection ────────────────────────────────────────────────────────
+/**
+ * Check if an expression node is a source access. Returns the source text
+ * if it is, null otherwise. Checks the text of the node against source
+ * patterns (req.body, request.GET, etc.).
+ */
+function detectSource(node, sourceText, language) {
+    const text = sourceText.slice(node.startIndex, node.endIndex);
+    const match = (0, taintSources_1.matchTaintSource)(text, language);
+    return match ? text : null;
+}
+// ── Expression taint checking ───────────────────────────────────────────────
+/**
+ * Recursively check if an expression is tainted. Returns TaintInfo if
+ * tainted, null otherwise.
+ */
+function checkExpressionTaint(node, scope, sourceText, language, taintReturningFns) {
+    // 1. Check if the node text is a source
+    const srcText = detectSource(node, sourceText, language);
+    if (srcText) {
+        return {
+            source: srcText,
+            sourceLine: node.startPosition.row + 1,
+            path: [{
+                    line: node.startPosition.row + 1,
+                    variable: srcText,
+                    operation: 'source',
+                    description: `Source: ${srcText}`,
+                }],
+            sanitizersApplied: [],
+        };
+    }
+    // 2. Identifier — check if it's in the tainted set
+    if ((0, astHelpers_1.isIdentifier)(node) || node.type === 'identifier') {
+        const name = sourceText.slice(node.startIndex, node.endIndex);
+        return scopeGet(scope, name) ?? null;
+    }
+    // 3. Call expression — check sanitizer, source method, taint-returning
+    if (CALL_NODE_TYPES.has(node.type)) {
+        const p = (0, astHelpers_1.callParts)(node, sourceText);
+        if (p) {
+            // Sanitizer → taint stripped
+            const sanitizer = (0, sanitizers_1.matchSanitizer)(p.method, p.receiver, language);
+            if (sanitizer)
+                return null;
+            // Function text starts with a source (e.g. req.body.get('q'))
+            const funcText = p.receiverText
+                ? `${p.receiverText}.${p.method}`
+                : p.method;
+            const srcMatch = (0, taintSources_1.matchTaintSource)(funcText, language);
+            if (srcMatch) {
+                return {
+                    source: funcText,
+                    sourceLine: node.startPosition.row + 1,
+                    path: [{
+                            line: node.startPosition.row + 1,
+                            variable: funcText,
+                            operation: 'source',
+                            description: `Source: ${funcText}`,
+                        }],
+                    sanitizersApplied: [],
+                };
+            }
+            // Taint-returning function
+            const fnName = p.receiver ?? p.method;
+            if (taintReturningFns.has(fnName)) {
+                // Find the tainted argument to carry the source info
+                for (const arg of p.args) {
+                    const argTaint = checkExpressionTaint(arg, scope, sourceText, language, taintReturningFns);
+                    if (argTaint) {
+                        return {
+                            ...argTaint,
+                            path: [...argTaint.path, {
+                                    line: node.startPosition.row + 1,
+                                    variable: fnName,
+                                    operation: 'call-pass',
+                                    description: `${fnName}() returns tainted data`,
+                                }],
+                        };
+                    }
+                }
+                // Function is taint-returning but we can't trace the source
+                return {
+                    source: `<${fnName}>`,
+                    sourceLine: node.startPosition.row + 1,
+                    path: [{
+                            line: node.startPosition.row + 1,
+                            variable: fnName,
+                            operation: 'call-pass',
+                            description: `${fnName}() returns tainted data`,
+                        }],
+                    sanitizersApplied: [],
+                };
+            }
+        }
+        // Also check if the receiver of a method call is tainted
+        // e.g. const x = req.body; x.toString() — x is tainted, so x.toString() is tainted
+        if (node.type === 'call_expression' || node.type === 'call') {
+            const func = node.child(0);
+            if (func && (func.type === 'member_expression' || func.type === 'attribute')) {
+                const obj = func.child(0);
+                if (obj) {
+                    const objTaint = checkExpressionTaint(obj, scope, sourceText, language, taintReturningFns);
+                    if (objTaint) {
+                        return {
+                            ...objTaint,
+                            path: [...objTaint.path, {
+                                    line: node.startPosition.row + 1,
+                                    variable: sourceText.slice(func.startIndex, func.endIndex),
+                                    operation: 'call-pass',
+                                    description: `Method call on tainted receiver`,
+                                }],
+                        };
+                    }
+                }
+            }
+        }
+        return null;
+    }
+    // 4. Binary expression (concatenation) — check both operands
+    if (node.type === 'binary_expression' || node.type === 'binary_operator_expression') {
+        const left = node.child(0);
+        const right = node.child(node.childCount - 1);
+        const leftTaint = left ? checkExpressionTaint(left, scope, sourceText, language, taintReturningFns) : null;
+        if (leftTaint) {
+            return {
+                ...leftTaint,
+                path: [...leftTaint.path, {
+                        line: node.startPosition.row + 1,
+                        variable: sourceText.slice(node.startIndex, node.endIndex),
+                        operation: 'concat',
+                        description: `Concatenation with tainted data`,
+                    }],
+            };
+        }
+        const rightTaint = right ? checkExpressionTaint(right, scope, sourceText, language, taintReturningFns) : null;
+        if (rightTaint) {
+            return {
+                ...rightTaint,
+                path: [...rightTaint.path, {
+                        line: node.startPosition.row + 1,
+                        variable: sourceText.slice(node.startIndex, node.endIndex),
+                        operation: 'concat',
+                        description: `Concatenation with tainted data`,
+                    }],
+            };
+        }
+        return null;
+    }
+    // 5. Template literal — check interpolations
+    if (node.type === 'template_literal' || node.type === 'template_string') {
+        for (const child of node.namedChildren) {
+            if (child.type === 'template_substitution' || child.type === 'template_expr') {
+                const expr = child.namedChildren[0];
+                if (expr) {
+                    const taint = checkExpressionTaint(expr, scope, sourceText, language, taintReturningFns);
+                    if (taint) {
+                        return {
+                            ...taint,
+                            path: [...taint.path, {
+                                    line: node.startPosition.row + 1,
+                                    variable: sourceText.slice(node.startIndex, node.endIndex),
+                                    operation: 'template',
+                                    description: `Template interpolation with tainted data`,
+                                }],
+                        };
+                    }
+                }
+            }
+        }
+        return null;
+    }
+    // 6. Member expression — check if the object is tainted
+    if (node.type === 'member_expression' || node.type === 'attribute') {
+        const obj = node.child(0);
+        if (obj) {
+            return checkExpressionTaint(obj, scope, sourceText, language, taintReturningFns);
+        }
+    }
+    // 7. Subscript expression — check if the object is tainted (req.body['q'])
+    if (node.type === 'subscript_expression' || node.type === 'subscript') {
+        const obj = node.child(0);
+        if (obj) {
+            return checkExpressionTaint(obj, scope, sourceText, language, taintReturningFns);
+        }
+    }
+    // 8. Await / parenthesized / as — unwrap
+    if (node.type === 'await_expression' || node.type === 'await'
+        || node.type === 'parenthesized_expression' || node.type === 'non_null_expression'
+        || node.type === 'as_expression') {
+        const inner = node.namedChildren[0];
+        if (inner) {
+            return checkExpressionTaint(inner, scope, sourceText, language, taintReturningFns);
+        }
+    }
+    // 9. Python augmented assignment (x += tainted)
+    if (node.type === 'augmented_assignment') {
+        const right = node.child(node.childCount - 1);
+        if (right) {
+            return checkExpressionTaint(right, scope, sourceText, language, taintReturningFns);
+        }
+    }
+    return null;
+}
+// ── Sink matching ──────────────────────────────────────────────────────────
+/** Match a call's (receiver, method) against a single `call` matcher. */
+function matchCallMatcher(matcher, receiver, method) {
+    if (method !== matcher.method)
+        return false;
+    if (matcher.receiver === undefined)
+        return receiver === null;
+    if (matcher.receiver === '*')
+        return true;
+    return receiver === matcher.receiver;
+}
+/** Check if a call node matches any sink definition. Returns the def + args. */
+function matchSink(node, sourceText, language) {
+    if (!CALL_NODE_TYPES.has(node.type))
+        return null;
+    const p = (0, astHelpers_1.callParts)(node, sourceText);
+    if (!p)
+        return null;
+    // Handle tagged template literals (queryRaw`...${x}...`)
+    let args = p.args;
+    const lastChild = node.child(node.childCount - 1);
+    if (lastChild && (lastChild.type === 'template_literal' || lastChild.type === 'template_string')) {
+        args = [lastChild];
+    }
+    for (const def of sinkRegistry_1.SINK_REGISTRY) {
+        if (!def.languages.includes(language))
+            continue;
+        for (const matcher of def.matchers) {
+            if (matcher.kind !== 'call')
+                continue;
+            if (matchCallMatcher(matcher, p.receiver, p.method)) {
+                return { def, args, line: p.line };
+            }
+        }
+    }
+    return null;
+}
+// ── Statement processing ───────────────────────────────────────────────────
+/** Extract variable names from a destructuring pattern (object/array). */
+function patternNames(pattern, sourceText) {
+    const names = [];
+    for (const n of (0, astHelpers_1.walk)(pattern)) {
+        if (n.type === 'shorthand_property_identifier_pattern'
+            || n.type === 'shorthand_property_identifier') {
+            names.push(sourceText.slice(n.startIndex, n.endIndex));
+            continue;
+        }
+        if (n.type === 'pair_pattern' || n.type === 'pair') {
+            const value = n.namedChildren[n.namedChildren.length - 1];
+            if (value && (0, astHelpers_1.isIdentifier)(value)) {
+                names.push(sourceText.slice(value.startIndex, value.endIndex));
+            }
+        }
+    }
+    return names;
+}
+/**
+ * Process a single variable declarator: `const x = expr` or `const { a, b } = expr`.
+ * If the RHS is tainted, the LHS variable(s) are marked tainted in the scope.
+ */
+function processDeclarator(decl, scope, sourceText, language, taintReturningFns) {
+    const lhs = decl.child(0);
+    const rhs = decl.child(decl.childCount - 1);
+    if (!lhs || !rhs || lhs === rhs)
+        return;
+    const taint = checkExpressionTaint(rhs, scope, sourceText, language, taintReturningFns);
+    if (!taint)
+        return;
+    if ((0, astHelpers_1.isIdentifier)(lhs) || lhs.type === 'identifier') {
+        const name = sourceText.slice(lhs.startIndex, lhs.endIndex);
+        scope.tainted.set(name, {
+            ...taint,
+            path: [...taint.path, {
+                    line: decl.startPosition.row + 1,
+                    variable: name,
+                    operation: 'assign',
+                    description: `${name} = ${sourceText.slice(rhs.startIndex, rhs.endIndex)}`,
+                }],
+        });
+    }
+    else if (lhs.type === 'object_pattern' || lhs.type === 'array_pattern'
+        || lhs.type === 'object' || lhs.type === 'list_pattern') {
+        for (const name of patternNames(lhs, sourceText)) {
+            scope.tainted.set(name, {
+                ...taint,
+                path: [...taint.path, {
+                        line: decl.startPosition.row + 1,
+                        variable: name,
+                        operation: 'assign',
+                        description: `const { ${name} } = ${sourceText.slice(rhs.startIndex, rhs.endIndex)}`,
+                    }],
+            });
+        }
+    }
+}
+/**
+ * Process an expression statement. Handles:
+ * - Assignments: `x = tainted` → update scope
+ * - Sink calls: `exec(tainted)` → record result
+ */
+function processExpression(node, scope, sourceText, language, taintReturningFns, onSink) {
+    // Assignment: x = expr or x += expr
+    if (node.type === 'assignment_expression' || node.type === 'assignment'
+        || node.type === 'augmented_assignment') {
+        const lhs = node.child(0);
+        const rhs = node.child(node.childCount - 1);
+        if (!lhs || !rhs || lhs === rhs)
+            return;
+        const taint = checkExpressionTaint(rhs, scope, sourceText, language, taintReturningFns);
+        if (taint && (0, astHelpers_1.isIdentifier)(lhs)) {
+            const name = sourceText.slice(lhs.startIndex, lhs.endIndex);
+            scope.tainted.set(name, {
+                ...taint,
+                path: [...taint.path, {
+                        line: node.startPosition.row + 1,
+                        variable: name,
+                        operation: 'assign',
+                        description: `${name} = ${sourceText.slice(rhs.startIndex, rhs.endIndex)}`,
+                    }],
+            });
+        }
+        return;
+    }
+    // Sink call
+    const sinkMatch = matchSink(node, sourceText, language);
+    if (sinkMatch) {
+        for (const arg of sinkMatch.args) {
+            const taint = checkExpressionTaint(arg, scope, sourceText, language, taintReturningFns);
+            if (taint) {
+                onSink({
+                    source: taint.source,
+                    sourceLine: taint.sourceLine,
+                    sink: sinkMatch.def.id,
+                    sinkLine: sinkMatch.line + 1,
+                    canonicalType: sinkMatch.def.canonicalType,
+                    propagationPath: [...taint.path, {
+                            line: sinkMatch.line + 1,
+                            variable: sourceText.slice(arg.startIndex, arg.endIndex),
+                            operation: 'sink-arg',
+                            description: `${sinkMatch.def.id}(${sourceText.slice(arg.startIndex, arg.endIndex)})`,
+                        }],
+                    isTainted: true,
+                });
+            }
+        }
+    }
+}
+/** Find the body node of a function. Returns null for expression-body arrows. */
+function functionBody(fn) {
+    for (const c of fn.namedChildren) {
+        if (c.type === 'statement_block' || c.type === 'block')
+            return c;
+    }
+    return null;
+}
+/** Get the name of a function node. */
+function functionName(fn, sourceText) {
+    const id = fn.namedChildren.find(c => (0, astHelpers_1.isIdentifier)(c));
+    if (id)
+        return sourceText.slice(id.startIndex, id.endIndex);
+    const parent = fn.parent;
+    if (parent && (parent.type === 'lexical_declaration' || parent.type === 'variable_declaration' || parent.type === 'assignment')) {
+        const name = parent.child(0);
+        if (name && (0, astHelpers_1.isIdentifier)(name))
+            return sourceText.slice(name.startIndex, name.endIndex);
+    }
+    return null;
+}
+/**
+ * Process a scope (function body or module level). Walks named children in
+ * order, tracking taint and calling onSink when a tainted sink is found.
+ */
+function processScope(bodyNode, scope, sourceText, language, taintReturningFns, onSink, onReturn) {
+    for (const stmt of bodyNode.namedChildren) {
+        // Variable declaration
+        if (stmt.type === 'lexical_declaration' || stmt.type === 'variable_declaration') {
+            for (const decl of stmt.namedChildren) {
+                if (decl.type === 'variable_declarator') {
+                    // Check if the RHS is an arrow/function — recurse into it
+                    const rhs = decl.child(decl.childCount - 1);
+                    if (rhs && FUNCTION_NODE_TYPES.has(rhs.type)) {
+                        const fnName = sourceText.slice((decl.child(0) ?? decl).startIndex, (decl.child(0) ?? decl).endIndex);
+                        const body = functionBody(rhs);
+                        if (body) {
+                            const childScope = { tainted: new Map(), parent: scope };
+                            processScope(body, childScope, sourceText, language, taintReturningFns, onSink, onReturn);
+                        }
+                        continue;
+                    }
+                    processDeclarator(decl, scope, sourceText, language, taintReturningFns);
+                }
+            }
+            continue;
+        }
+        // Expression statement
+        if (stmt.type === 'expression_statement') {
+            const expr = stmt.namedChildren[0];
+            if (expr)
+                processExpression(expr, scope, sourceText, language, taintReturningFns, onSink);
+            continue;
+        }
+        // Python assignment (not inside expression_statement)
+        if (stmt.type === 'assignment' || stmt.type === 'augmented_assignment') {
+            processExpression(stmt, scope, sourceText, language, taintReturningFns, onSink);
+            continue;
+        }
+        // Return statement
+        if (stmt.type === 'return_statement' || stmt.type === 'return') {
+            const expr = stmt.namedChildren[0];
+            if (expr) {
+                const taint = checkExpressionTaint(expr, scope, sourceText, language, taintReturningFns);
+                onReturn(taint);
+            }
+            else {
+                onReturn(null);
+            }
+            continue;
+        }
+        // Function declaration — recurse with new scope
+        if (FUNCTION_NODE_TYPES.has(stmt.type)) {
+            const body = functionBody(stmt);
+            if (body) {
+                const childScope = { tainted: new Map(), parent: scope };
+                processScope(body, childScope, sourceText, language, taintReturningFns, onSink, onReturn);
+            }
+            continue;
+        }
+        // Export statement — recurse into the declaration
+        if (stmt.type === 'export_statement') {
+            for (const child of stmt.namedChildren) {
+                if (STATEMENT_TYPES.has(child.type)) {
+                    // Recursively process the exported declaration
+                    processScope({ namedChildren: [child] }, scope, sourceText, language, taintReturningFns, onSink, onReturn);
+                }
+            }
+            continue;
+        }
+        // Control flow — recurse into body
+        if (stmt.type === 'if_statement' || stmt.type === 'for_statement'
+            || stmt.type === 'for_in_statement' || stmt.type === 'for_each_statement'
+            || stmt.type === 'while_statement' || stmt.type === 'do_statement'
+            || stmt.type === 'try_statement' || stmt.type === 'try'
+            || stmt.type === 'with_statement' || stmt.type === 'block'
+            || stmt.type === 'statement_block'
+            || stmt.type === 'decorated_definition') {
+            for (const child of stmt.namedChildren) {
+                if (child.type === 'statement_block' || child.type === 'block'
+                    || STATEMENT_TYPES.has(child.type)) {
+                    processScope(child.type === 'statement_block' || child.type === 'block' ? child : { namedChildren: [child] }, scope, sourceText, language, taintReturningFns, onSink, onReturn);
+                }
+            }
+            continue;
+        }
+    }
+}
+// ── First pass: identify taint-returning functions ─────────────────────────
+/**
+ * Walk the AST and identify functions that return tainted data. A function
+ * is taint-returning if any return statement in its body returns a source
+ * access or a tainted variable.
+ */
+function findTaintReturningFunctions(root, sourceText, language) {
+    const result = new Set();
+    for (const node of (0, astHelpers_1.walk)(root)) {
+        if (!FUNCTION_NODE_TYPES.has(node.type))
+            continue;
+        const name = functionName(node, sourceText);
+        if (!name)
+            continue;
+        const body = functionBody(node);
+        if (!body)
+            continue;
+        const scope = { tainted: new Map(), parent: null };
+        let returnsTainted = false;
+        processScope(body, scope, sourceText, language, new Set(), () => { }, (taint) => {
+            if (taint)
+                returnsTainted = true;
+        });
+        if (returnsTainted)
+            result.add(name);
+    }
+    return result;
+}
+// ── Main entry point ───────────────────────────────────────────────────────
+/**
+ * Track taint propagation through source code. Returns a TaintResult for
+ * every sink where tainted data reaches an argument.
+ *
+ * @param source   the file's source text
+ * @param language  the grammar to parse with
+ * @returns taint results, one per tainted sink argument. Empty when the
+ *          grammar is missing, the file fails to parse, or no tainted data
+ *          reaches any sink (best-effort: never throws).
+ */
+async function trackTaint(source, language) {
+    const parsed = await (0, parserLoader_1.parseSource)(source, language);
+    if (!parsed)
+        return [];
+    const { root } = parsed;
+    // First pass: identify taint-returning functions
+    const taintReturningFns = findTaintReturningFunctions(root, source, language);
+    // Second pass: track taint and record results at sinks
+    const results = [];
+    const onSink = (result) => {
+        // Dedup by (source, sink, sinkLine)
+        const key = `${result.source}:${result.sink}:${result.sinkLine}`;
+        if (!results.some(r => `${r.source}:${r.sink}:${r.sinkLine}` === key)) {
+            results.push(result);
+        }
+    };
+    // Process module level
+    const moduleScope = { tainted: new Map(), parent: null };
+    processScope(root, moduleScope, source, language, taintReturningFns, onSink, () => { });
+    return results;
+}
+//# sourceMappingURL=taintTracker.js.map

package/dist/project-map/taintTracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taintTracker.js","sourceRoot":"","sources":["../../src/project-map/taintTracker.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AA4nBH,gCA0BC;AAppBD,iDAA6D;AAC7D,6CAEsB;AACtB,iDAA0F;AAC1F,iDAAkD;AAClD,6CAA8C;AAmC9C,SAAS,QAAQ,CAAC,KAAY,EAAE,IAAY;IACxC,IAAI,CAAC,GAAiB,KAAK,CAAC;IAC5B,OAAO,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,+EAA+E;AAE/E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAChC,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB;IAClE,4BAA4B,EAAE,2BAA2B;IACzD,gBAAgB,EAAE,qBAAqB;IACvC,gCAAgC,EAAE,uBAAuB;CAC5D,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE/E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC5B,sBAAsB,EAAE,qBAAqB,EAAE,sBAAsB;IACrE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,oBAAoB;IACzE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK;IACzD,kBAAkB,EAAE,QAAQ;IAC5B,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB;IAClE,OAAO,EAAE,iBAAiB;IAC1B,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB;IACxD,gBAAgB,EAAE,sBAAsB,EAAE,YAAY;IACtD,sBAAsB;CACzB,CAAC,CAAC;AAEH,+EAA+E;AAE/E;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAoB,EAAE,UAAkB,EAAE,QAAsB;IAClF,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAA,+BAAgB,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,oBAAoB,CACzB,IAAoB,EACpB,KAAY,EACZ,UAAkB,EAClB,QAAsB,EACtB,iBAA8B;IAE9B,wCAAwC;IACxC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,OAAO,EAAE,CAAC;QACV,OAAO;YACH,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;YACtC,IAAI,EAAE,CAAC;oBACH,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,QAAQ,EAAE,OAAO;oBACjB,SAAS,EAAE,QAAQ;oBACnB,WAAW,EAAE,WAAW,OAAO,EAAE;iBACpC,CAAC;YACF,iBAAiB,EAAE,EAAE;SACxB,CAAC;IACN,CAAC;IAED,mDAAmD;IACnD,IAAI,IAAA,yBAAY,EAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,uEAAuE;IACvE,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,IAAA,sBAAS,EAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE,CAAC;YACJ,6BAA6B;YAC7B,MAAM,SAAS,GAAG,IAAA,2BAAc,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS;gBAAE,OAAO,IAAI,CAAC;YAE3B,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY;gBAC3B,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,EAAE;gBACjC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACf,MAAM,QAAQ,GAAG,IAAA,+BAAgB,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACtD,IAAI,QAAQ,EAAE,CAAC;gBACX,OAAO;oBACH,MAAM,EAAE,QAAQ;oBAChB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBACtC,IAAI,EAAE,CAAC;4BACH,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;4BAChC,QAAQ,EAAE,QAAQ;4BAClB,SAAS,EAAE,QAAQ;4BACnB,WAAW,EAAE,WAAW,QAAQ,EAAE;yBACrC,CAAC;oBACF,iBAAiB,EAAE,EAAE;iBACxB,CAAC;YACN,CAAC;YAED,2BAA2B;YAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC;YACtC,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,qDAAqD;gBACrD,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;oBACvB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;oBAC3F,IAAI,QAAQ,EAAE,CAAC;wBACX,OAAO;4BACH,GAAG,QAAQ;4BACX,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE;oCACrB,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oCAChC,QAAQ,EAAE,MAAM;oCAChB,SAAS,EAAE,WAAW;oCACtB,WAAW,EAAE,GAAG,MAAM,yBAAyB;iCAClD,CAAC;yBACL,CAAC;oBACN,CAAC;gBACL,CAAC;gBACD,4DAA4D;gBAC5D,OAAO;oBACH,MAAM,EAAE,IAAI,MAAM,GAAG;oBACrB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBACtC,IAAI,EAAE,CAAC;4BACH,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;4BAChC,QAAQ,EAAE,MAAM;4BAChB,SAAS,EAAE,WAAW;4BACtB,WAAW,EAAE,GAAG,MAAM,yBAAyB;yBAClD,CAAC;oBACF,iBAAiB,EAAE,EAAE;iBACxB,CAAC;YACN,CAAC;QACL,CAAC;QACD,yDAAyD;QACzD,mFAAmF;QACnF,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;gBAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,GAAG,EAAE,CAAC;oBACN,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;oBAC3F,IAAI,QAAQ,EAAE,CAAC;wBACX,OAAO;4BACH,GAAG,QAAQ;4BACX,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE;oCACrB,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oCAChC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;oCAC1D,SAAS,EAAE,WAAW;oCACtB,WAAW,EAAE,iCAAiC;iCACjD,CAAC;yBACL,CAAC;oBACN,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,6DAA6D;IAC7D,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,IAAI,KAAK,4BAA4B,EAAE,CAAC;QAClF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3G,IAAI,SAAS,EAAE,CAAC;YACZ,OAAO;gBACH,GAAG,SAAS;gBACZ,IAAI,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE;wBACtB,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;wBAChC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;wBAC1D,SAAS,EAAE,QAAQ;wBACnB,WAAW,EAAE,iCAAiC;qBACjD,CAAC;aACL,CAAC;QACN,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9G,IAAI,UAAU,EAAE,CAAC;YACb,OAAO;gBACH,GAAG,UAAU;gBACb,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE;wBACvB,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;wBAChC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;wBAC1D,SAAS,EAAE,QAAQ;wBACnB,WAAW,EAAE,iCAAiC;qBACjD,CAAC;aACL,CAAC;QACN,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,6CAA6C;IAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;gBACpC,IAAI,IAAI,EAAE,CAAC;oBACP,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;oBACzF,IAAI,KAAK,EAAE,CAAC;wBACR,OAAO;4BACH,GAAG,KAAK;4BACR,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE;oCAClB,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oCAChC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;oCAC1D,SAAS,EAAE,UAAU;oCACrB,WAAW,EAAE,0CAA0C;iCAC1D,CAAC;yBACL,CAAC;oBACN,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,wDAAwD;IACxD,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,GAAG,EAAE,CAAC;YACN,OAAO,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,GAAG,EAAE,CAAC;YACN,OAAO,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;IAED,yCAAyC;IACzC,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;WACtD,IAAI,CAAC,IAAI,KAAK,0BAA0B,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB;WAC/E,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACvF,CAAC;IACL,CAAC;IAED,gDAAgD;IAChD,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACvF,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E,yEAAyE;AACzE,SAAS,gBAAgB,CACrB,OAA+C,EAC/C,QAAuB,EACvB,MAAc;IAEd,IAAI,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,KAAK,IAAI,CAAC;IAC7D,IAAI,OAAO,CAAC,QAAQ,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC;AACzC,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CACd,IAAoB,EACpB,UAAkB,EAClB,QAAsB;IAEtB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,IAAA,sBAAS,EAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpB,yDAAyD;IACzD,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAClB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAClD,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,kBAAkB,IAAI,SAAS,CAAC,IAAI,KAAK,iBAAiB,CAAC,EAAE,CAAC;QAC/F,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,4BAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QAChD,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjC,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YACtC,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACvC,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E,0EAA0E;AAC1E,SAAS,YAAY,CAAC,OAAuB,EAAE,UAAkB;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,IAAI,KAAK,uCAAuC;eAC/C,CAAC,CAAC,IAAI,KAAK,+BAA+B,EAAE,CAAC;YAChD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACvD,SAAS;QACb,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1D,IAAI,KAAK,IAAI,IAAA,yBAAY,EAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACnE,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CACtB,IAAoB,EACpB,KAAY,EACZ,UAAkB,EAClB,QAAsB,EACtB,iBAA8B;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO;IAExC,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IACxF,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,IAAI,IAAA,yBAAY,EAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5D,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;YACpB,GAAG,KAAK;YACR,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE;oBAClB,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,QAAQ,EAAE,IAAI;oBACd,SAAS,EAAE,QAAQ;oBACnB,WAAW,EAAE,GAAG,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;iBAC7E,CAAC;SACL,CAAC,CAAC;IACP,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe;WACjE,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;YAC/C,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;gBACpB,GAAG,KAAK;gBACR,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE;wBAClB,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;wBAChC,QAAQ,EAAE,IAAI;wBACd,SAAS,EAAE,QAAQ;wBACnB,WAAW,EAAE,WAAW,IAAI,QAAQ,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;qBACvF,CAAC;aACL,CAAC,CAAC;QACP,CAAC;IACL,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACtB,IAAoB,EACpB,KAAY,EACZ,UAAkB,EAClB,QAAsB,EACtB,iBAA8B,EAC9B,MAAqC;IAErC,oCAAoC;IACpC,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;WAChE,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG;YAAE,OAAO;QACxC,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACxF,IAAI,KAAK,IAAI,IAAA,yBAAY,EAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5D,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;gBACpB,GAAG,KAAK;gBACR,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE;wBAClB,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;wBAChC,QAAQ,EAAE,IAAI;wBACd,SAAS,EAAE,QAAQ;wBACnB,WAAW,EAAE,GAAG,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;qBAC7E,CAAC;aACL,CAAC,CAAC;QACP,CAAC;QACD,OAAO;IACX,CAAC;IAED,YAAY;IACZ,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,SAAS,EAAE,CAAC;QACZ,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;YACxF,IAAI,KAAK,EAAE,CAAC;gBACR,MAAM,CAAC;oBACH,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE;oBACtB,QAAQ,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC;oBAC5B,aAAa,EAAE,SAAS,CAAC,GAAG,CAAC,aAAa;oBAC1C,eAAe,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE;4BAC7B,IAAI,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC;4BACxB,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC;4BACxD,SAAS,EAAE,UAAU;4BACrB,WAAW,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG;yBACxF,CAAC;oBACF,SAAS,EAAE,IAAI;iBAClB,CAAC,CAAC;YACP,CAAC;QACL,CAAC;IACL,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,SAAS,YAAY,CAAC,EAAkB;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,uCAAuC;AACvC,SAAS,YAAY,CAAC,EAAkB,EAAE,UAAkB;IACxD,MAAM,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,yBAAY,EAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,EAAE;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;IACzB,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,qBAAqB,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAsB,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;QAC9H,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,IAAI,IAAA,yBAAY,EAAC,IAAI,CAAC;YAAE,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CACjB,QAAwB,EACxB,KAAY,EACZ,UAAkB,EAClB,QAAsB,EACtB,iBAA8B,EAC9B,MAAqC,EACrC,QAA2C;IAE3C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxC,uBAAuB;QACvB,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC9E,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpC,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBACtC,0DAA0D;oBAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;oBAC5C,IAAI,GAAG,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAC3B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,EAClC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CACnC,CAAC;wBACF,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;wBAC/B,IAAI,IAAI,EAAE,CAAC;4BACP,MAAM,UAAU,GAAU,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;4BAChE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;wBAC9F,CAAC;wBACD,SAAS;oBACb,CAAC;oBACD,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;gBAC5E,CAAC;YACL,CAAC;YACD,SAAS;QACb,CAAC;QAED,uBAAuB;QACvB,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,IAAI;gBAAE,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;YAC1F,SAAS;QACb,CAAC;QAED,sDAAsD;QACtD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACrE,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;YAChF,SAAS;QACb,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,IAAI,EAAE,CAAC;gBACP,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;gBACzF,QAAQ,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACJ,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;YACD,SAAS;QACb,CAAC;QAED,gDAAgD;QAChD,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,IAAI,EAAE,CAAC;gBACP,MAAM,UAAU,GAAU,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBAChE,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC9F,CAAC;YACD,SAAS;QACb,CAAC;QAED,kDAAkD;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACnC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACrC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,+CAA+C;oBAC/C,YAAY,CAAC,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,EAAS,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACtH,CAAC;YACL,CAAC;YACD,SAAS;QACb,CAAC;QAED,mCAAmC;QACnC,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe;eAC1D,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB;eACtE,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;eAC/D,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;eACpD,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;eACvD,IAAI,CAAC,IAAI,KAAK,iBAAiB;eAC/B,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;uBACvD,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrC,YAAY,CACR,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,EAAS,EACtG,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CACnE,CAAC;gBACN,CAAC;YACL,CAAC;YACD,SAAS;QACb,CAAC;IACL,CAAC;AACL,CAAC;AAED,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,2BAA2B,CAChC,IAAoB,EACpB,UAAkB,EAClB,QAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,MAAM,KAAK,GAAU,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1D,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3E,IAAI,KAAK;gBAAE,cAAc,GAAG,IAAI,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,cAAc;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;GASG;AACI,KAAK,UAAU,UAAU,CAC5B,MAAc,EACd,QAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAW,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAExB,iDAAiD;IACjD,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE9E,uDAAuD;IACvD,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,MAAmB,EAAE,EAAE;QACnC,oCAAoC;QACpC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACL,CAAC,CAAC;IAEF,uBAAuB;IACvB,MAAM,WAAW,GAAU,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChE,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEvF,OAAO,OAAO,CAAC;AACnB,CAAC"}

package/dist/tools/scan.js

@@ -3,6 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.toolScan = toolScan;
 const client_1 = require("../api/client");
 const files_1 = require("../utils/files");
+const sinkFinder_1 = require("../project-map/sinkFinder");
+const taintTracker_1 = require("../project-map/taintTracker");
+const guardEvaluator_1 = require("../project-map/guardEvaluator");
+const parserLoader_1 = require("../project-map/parserLoader");
 async function toolScan(ctx, args) {
     const client = new client_1.ApiClient({ baseUrl: ctx.apiUrl, token: ctx.apiToken });
     let code = args.code;
@@ -19,11 +23,51 @@ async function toolScan(ctx, args) {
     if (!language) {
         throw Object.assign(new Error('Provide language or filePath with a known extension.'), { code: -32602 });
     }
+    // Phase B/C/E: AST-based sink finder + taint tracker + guard evaluator.
+    // Runs locally via tree-sitter and attaches deterministic facts to the
+    // scan request. The MCP has no related-files infrastructure, so the
+    // guard evaluator only evaluates guards found in the scanned file itself.
+    let deterministicFacts;
+    if (filePath) {
+        const grammar = (0, parserLoader_1.grammarForFile)(filePath);
+        if (grammar !== 'unknown') {
+            try {
+                const [sinks, taint] = await Promise.all([
+                    (0, sinkFinder_1.findSinks)(code, grammar),
+                    (0, taintTracker_1.trackTaint)(code, grammar),
+                ]);
+                // Phase E: evaluate guards from the scanned file itself against
+                // the attack types found by the sink finder + taint tracker.
+                let guards;
+                const attackTypes = new Set();
+                for (const s of sinks)
+                    attackTypes.add(s.canonicalType);
+                for (const t of taint)
+                    attackTypes.add(t.canonicalType);
+                if (attackTypes.size > 0) {
+                    guards = await (0, guardEvaluator_1.evaluateGuards)([{ source: code, name: filePath }], [...attackTypes], grammar);
+                    if (guards.length === 0)
+                        guards = undefined;
+                }
+                if (sinks.length > 0 || taint.length > 0 || (guards && guards.length > 0)) {
+                    deterministicFacts = {
+                        ...(sinks.length > 0 && { sinks }),
+                        ...(taint.length > 0 && { taint }),
+                        ...(guards && { guards }),
+                    };
+                }
+            }
+            catch {
+                // Best-effort: tree-sitter may be unavailable.
+            }
+        }
+    }
     const data = await client.postJson('/scan', {
         code,
         language,
         ...(filePath ? { filePath } : {}),
         scanDepth: 'auto',
+        ...(deterministicFacts && { deterministicFacts }),
     });
     const findings = data.scanType === 'advanced' && data.finalFindings
         ? data.finalFindings