@securecode-ai/mcp 0.4.0 → 0.4.2

package/dist/project-map/crossFileTaintTracker.js

@@ -0,0 +1,429 @@
+"use strict";
+/**
+ * Cross-file taint tracker — follows taint across file boundaries.
+ *
+ * The single-file `trackTaint` engine finds source→sink flows within one
+ * file. This module extends that to multi-file flows by:
+ *
+ *   1. Parsing the entry file's imports (collectImports)
+ *   2. Resolving each import to a file on disk (resolveModulePath)
+ *   3. Indexing each imported function: does it return tainted data?
+ *      Does it propagate taint through a specific parameter?
+ *   4. Running taint tracking on the entry file with the cross-file
+ *      function index, so calls to imported functions that propagate
+ *      taint are recognised.
+ *
+ * Limits prevent runaway analysis on large codebases:
+ *   maxDepth (3)  — how many import hops to follow
+ *   maxFiles (10) — total files parsed per trace
+ *   maxFunctionBodySize (5000 chars) — skip oversized functions
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trackTaintCrossFile = trackTaintCrossFile;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const parserLoader_1 = require("./parserLoader");
+const astHelpers_1 = require("./astHelpers");
+const taintTracker_1 = require("./taintTracker");
+// ── Constants ───────────────────────────────────────────────────────────────
+const DEFAULT_MAX_DEPTH = 3;
+const DEFAULT_MAX_FILES = 10;
+const MAX_FUNCTION_BODY_SIZE = 5000;
+const FUNCTION_NODE_TYPES = new Set([
+    'function_declaration', 'function_definition', 'method_definition',
+    'async_function_declaration', 'async_function_definition',
+    'arrow_function', 'function_expression',
+    'generator_function_declaration', 'generator_declaration',
+]);
+/**
+ * Build a map of `functionName → FunctionAnalysis` for all exported
+ * functions in the file. Each function is analyzed to determine whether
+ * it returns tainted data and which parameters propagate taint.
+ */
+async function indexFileFunctions(source, language, file) {
+    const out = new Map();
+    const parsed = await (0, parserLoader_1.parseSource)(source, language);
+    if (!parsed)
+        return out;
+    const { root } = parsed;
+    for (const node of (0, astHelpers_1.walk)(root)) {
+        if (!FUNCTION_NODE_TYPES.has(node.type))
+            continue;
+        const name = functionName(node, source);
+        if (!name)
+            continue;
+        // Skip functions that are too large
+        const bodyText = source.slice(node.startIndex, node.endIndex);
+        if (bodyText.length > MAX_FUNCTION_BODY_SIZE)
+            continue;
+        const params = extractParams(node, source);
+        const line = node.startPosition.row + 1;
+        // Analyze: seed each parameter as tainted, check if the function
+        // returns tainted data from any param
+        const taintThroughParams = new Set();
+        let returnsTainted = false;
+        for (let i = 0; i < params.length; i++) {
+            const seedName = params[i];
+            if (!seedName)
+                continue;
+            // Run taint tracking on just this function body with the param
+            // seeded as a source. If any result mentions this param as the
+            // source, the function propagates taint through it.
+            const flows = await trackTaintWithSeed(source, language, seedName, node);
+            if (flows.length > 0) {
+                taintThroughParams.add(i);
+                returnsTainted = true; // if it reaches a sink it could also be returned
+            }
+        }
+        // Also check if the function returns tainted data directly
+        // (e.g. `return req.body` without going through a sink)
+        if (!returnsTainted) {
+            returnsTainted = checkReturnsTainted(node, source, language);
+        }
+        out.set(name, { name, file, line, params, returnsTainted, taintThroughParams });
+    }
+    return out;
+}
+/**
+ * Check if a function returns tainted data by examining return statements.
+ * Looks for returns of taint sources (req.body, etc.) or tainted variables.
+ */
+function checkReturnsTainted(fnNode, source, language) {
+    let found = false;
+    for (const child of (0, astHelpers_1.walk)(fnNode)) {
+        if (child.type !== 'return_statement' && child.type !== 'return')
+            continue;
+        // Skip the function's own return type annotation
+        if (child.parent && FUNCTION_NODE_TYPES.has(child.parent.type) && child === child.parent.namedChildren[0])
+            continue;
+        const expr = child.namedChildren.find(c => c.type !== 'return' && c.type !== 'return_statement');
+        if (!expr)
+            continue;
+        const text = source.slice(expr.startIndex, expr.endIndex);
+        // Simple heuristic: if the return expression contains a known source pattern
+        // like req.body, request.GET, etc.
+        if (isTaintSourceText(text, language)) {
+            found = true;
+            break;
+        }
+    }
+    return found;
+}
+/**
+ * Check if text looks like a taint source (req.body, request.GET, etc.)
+ * without needing a full AST parse.
+ */
+function isTaintSourceText(text, language) {
+    const patterns = [];
+    if (language === 'python') {
+        patterns.push('request.GET', 'request.POST', 'request.args', 'request.form', 'request.json', 'request.body', 'request.headers', 'request.cookies', 'request.values', 'request.data', 'request.META', 'request.FILES', 'sys.argv', 'os.environ', 'os.getenv');
+    }
+    else {
+        patterns.push('req.body', 'req.query', 'req.params', 'req.headers', 'req.cookies', 'req.files', 'request.body', 'request.query', 'request.params', 'request.headers', 'request.cookies', 'ctx.body', 'ctx.query', 'ctx.params', 'ctx.headers', 'event.body', 'req.json', 'request.json');
+    }
+    return patterns.some(p => text.includes(p));
+}
+/**
+ * Run taint tracking on a file with a parameter seeded as a taint source.
+ * Uses the seedParams option of trackTaint to pre-taint the parameter
+ * at module scope, so it propagates into the function's scope.
+ */
+async function trackTaintWithSeed(source, language, seedParam, fnNode) {
+    const results = await (0, taintTracker_1.trackTaint)(source, language, [seedParam]);
+    // Filter: only keep results where the source involves our seed
+    return results.filter(r => r.source === `<param:${seedParam}>` ||
+        r.propagationPath.some(p => p.variable === seedParam && p.operation === 'source'));
+}
+/** Extract parameter names from a function node. */
+function extractParams(fnNode, source) {
+    const params = [];
+    for (const child of fnNode.namedChildren) {
+        if (child.type === 'parameters' || child.type === 'formal_parameters' || child.type === 'parameter_list') {
+            for (const param of child.namedChildren) {
+                if ((0, astHelpers_1.isIdentifier)(param)) {
+                    // Plain identifier: `name` (JS/Python)
+                    params.push(source.slice(param.startIndex, param.endIndex));
+                }
+                else if (param.type === 'required_parameter') {
+                    // TypeScript required parameter: `name: string` — take the identifier
+                    const id = param.namedChildren.find(c => (0, astHelpers_1.isIdentifier)(c));
+                    if (id)
+                        params.push(source.slice(id.startIndex, id.endIndex));
+                }
+                else if (param.type === 'shorthand_property_identifier_pattern' || param.type === 'shorthand_property_identifier') {
+                    params.push(source.slice(param.startIndex, param.endIndex));
+                }
+                else if (param.type === 'assignment_pattern') {
+                    // default param: `x = 'default'` — take the left side
+                    const left = param.namedChildren[0];
+                    if (left && (0, astHelpers_1.isIdentifier)(left)) {
+                        params.push(source.slice(left.startIndex, left.endIndex));
+                    }
+                }
+                else if (param.type === 'identifier' || param.type === 'typed_parameter') {
+                    params.push(source.slice(param.startIndex, param.endIndex));
+                }
+                else if (param.type === 'typed_parameter') {
+                    // Python typed param: `name: str`
+                    const id = param.namedChildren.find(c => (0, astHelpers_1.isIdentifier)(c));
+                    if (id)
+                        params.push(source.slice(id.startIndex, id.endIndex));
+                }
+                // Skip rest params, destructuring patterns — too complex for now
+            }
+            break;
+        }
+    }
+    return params;
+}
+/** Get the name of a function node (mirrors taintTracker's functionName). */
+function functionName(fn, source) {
+    const id = fn.namedChildren.find(c => (0, astHelpers_1.isIdentifier)(c));
+    if (id)
+        return source.slice(id.startIndex, id.endIndex);
+    const parent = fn.parent;
+    if (parent && (parent.type === 'lexical_declaration' || parent.type === 'variable_declaration' || parent.type === 'assignment')) {
+        const name = parent.child(0);
+        if (name && (0, astHelpers_1.isIdentifier)(name))
+            return source.slice(name.startIndex, name.endIndex);
+    }
+    return null;
+}
+// ── Language detection ──────────────────────────────────────────────────────
+function toSinkLanguage(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    const map = {
+        '.js': 'javascript', '.jsx': 'javascript', '.mjs': 'javascript', '.cjs': 'javascript',
+        '.ts': 'typescript', '.tsx': 'tsx',
+        '.py': 'python',
+    };
+    return map[ext] || null;
+}
+// ── Main entry point ───────────────────────────────────────────────────────
+/**
+ * Track taint propagation across file boundaries.
+ *
+ * Parses the entry file, resolves its imports, indexes imported functions
+ * for taint behavior, then runs taint tracking with cross-file knowledge.
+ *
+ * Returns CrossFileTaintResult[] with full file:line paths.
+ */
+async function trackTaintCrossFile(opts) {
+    const maxDepth = opts.maxDepth ?? DEFAULT_MAX_DEPTH;
+    const maxFiles = opts.maxFiles ?? DEFAULT_MAX_FILES;
+    const entryAbs = path.resolve(opts.workspaceRoot, opts.filePath);
+    const language = toSinkLanguage(opts.filePath);
+    if (!language)
+        return [];
+    const entrySource = fs.readFileSync(entryAbs, 'utf8');
+    const entryParsed = await (0, parserLoader_1.parseSource)(entrySource, language);
+    if (!entryParsed)
+        return [];
+    // 1. Collect imports from the entry file
+    const imports = (0, astHelpers_1.collectImports)(entryParsed.root, entrySource);
+    // imports = Map { localName -> moduleSpec }
+    // 2. Build a function index from imported files
+    const functionIndex = new Map();
+    const visitedFiles = new Set([opts.filePath]);
+    const filesToIndex = [];
+    for (const [localName, moduleSpec] of imports) {
+        filesToIndex.push({ spec: moduleSpec, fromFile: opts.filePath, depth: 0 });
+    }
+    let filesParsed = 1;
+    while (filesToIndex.length > 0 && filesParsed < maxFiles) {
+        const { spec, fromFile, depth } = filesToIndex.shift();
+        if (depth >= maxDepth)
+            continue;
+        const resolvedFile = (0, astHelpers_1.resolveModulePath)(spec, path.resolve(opts.workspaceRoot, fromFile), opts.workspaceRoot);
+        if (!resolvedFile)
+            continue; // node_modules or unresolvable
+        if (visitedFiles.has(resolvedFile))
+            continue; // cycle guard
+        visitedFiles.add(resolvedFile);
+        const resolvedAbs = path.resolve(opts.workspaceRoot, resolvedFile);
+        let source;
+        try {
+            source = fs.readFileSync(resolvedAbs, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        const fileLang = toSinkLanguage(resolvedFile);
+        if (!fileLang)
+            continue;
+        const index = await indexFileFunctions(source, fileLang, resolvedFile);
+        for (const [name, analysis] of index) {
+            functionIndex.set(name, analysis);
+        }
+        filesParsed++;
+        // Queue deeper imports (depth+1) if we haven't hit the limit
+        if (depth + 1 < maxDepth) {
+            const parsed = await (0, parserLoader_1.parseSource)(source, fileLang);
+            if (parsed) {
+                const deeperImports = (0, astHelpers_1.collectImports)(parsed.root, source);
+                for (const [_, deeperSpec] of deeperImports) {
+                    filesToIndex.push({ spec: deeperSpec, fromFile: resolvedFile, depth: depth + 1 });
+                }
+            }
+        }
+    }
+    // 3. Run single-file taint tracking on the entry file
+    const entryFlows = await (0, taintTracker_1.trackTaint)(entrySource, language);
+    if (entryFlows.length === 0) {
+        // No flows in the entry file — check if any imported functions
+        // have sinks that could be reached through tainted parameters
+        return checkImportedFunctionSinks(functionIndex, imports, opts.workspaceRoot, language);
+    }
+    // 4. Convert single-file results to cross-file results
+    //    For now: if the entry file has flows, report them with the entry file
+    //    as both source and sink file. If the flow involves a call to an
+    //    indexed function, add the cross-file step.
+    const results = [];
+    for (const flow of entryFlows) {
+        const steps = [];
+        let sourceFile = opts.filePath;
+        let sinkFile = opts.filePath;
+        for (const step of flow.propagationPath) {
+            // Check if this step involves a call to an indexed function
+            const callMatch = step.description.match(/^([\w$]+)\(\)/);
+            if (callMatch && (step.operation === 'call-pass' || step.operation === 'sink-arg')) {
+                const fnName = callMatch[1];
+                const analysis = functionIndex.get(fnName);
+                if (analysis && analysis.file !== opts.filePath) {
+                    // This step crosses a file boundary
+                    steps.push({
+                        file: opts.filePath,
+                        line: step.line,
+                        variable: step.variable,
+                        operation: 'call-cross-file',
+                        description: `${fnName}() in ${analysis.file}:${analysis.line} ${analysis.returnsTainted ? 'returns tainted data' : 'propagates taint'}`,
+                    });
+                    sourceFile = analysis.file;
+                    continue;
+                }
+            }
+            steps.push({
+                file: opts.filePath,
+                line: step.line,
+                variable: step.variable,
+                operation: step.operation === 'source' ? 'source' : 'sink-arg',
+                description: step.description,
+            });
+        }
+        results.push({
+            source: flow.source,
+            sourceLine: flow.sourceLine,
+            sourceFile,
+            sink: flow.sink,
+            sinkLine: flow.sinkLine,
+            sinkFile,
+            canonicalType: flow.canonicalType,
+            crossFileSteps: steps,
+        });
+    }
+    // 5. Also check imported functions for sinks reachable through params
+    const importedSinks = await checkImportedFunctionSinks(functionIndex, imports, opts.workspaceRoot, language);
+    results.push(...importedSinks);
+    // Dedup by (source, sink, sinkFile, sinkLine)
+    const seen = new Set();
+    const deduped = [];
+    for (const r of results) {
+        const key = `${r.source}:${r.sink}:${r.sinkFile}:${r.sinkLine}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            deduped.push(r);
+        }
+    }
+    return deduped;
+}
+/**
+ * Check imported functions for sinks reachable through tainted parameters.
+ * If an imported function has a sink in its body and the caller passes
+ * tainted data to the relevant parameter, that's a cross-file flow.
+ */
+async function checkImportedFunctionSinks(functionIndex, imports, workspaceRoot, language) {
+    const results = [];
+    for (const [name, analysis] of functionIndex) {
+        if (analysis.taintThroughParams.size === 0)
+            continue;
+        // This function has sinks reachable through params.
+        // Read its source and run trackTaint with all params seeded to find sinks.
+        const fileAbs = path.resolve(workspaceRoot, analysis.file);
+        let source;
+        try {
+            source = fs.readFileSync(fileAbs, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        // Seed all params of this function as taint sources
+        const flows = await (0, taintTracker_1.trackTaint)(source, language, analysis.params);
+        for (const flow of flows) {
+            // Only include flows where the source is a seeded parameter
+            const isParamSource = analysis.params.includes(flow.source.replace('<param:', '').replace('>', '')) ||
+                flow.propagationPath.some(p => p.operation === 'source' && analysis.params.includes(p.variable));
+            if (!isParamSource)
+                continue;
+            results.push({
+                source: `${name}() param: ${flow.source}`,
+                sourceLine: analysis.line,
+                sourceFile: analysis.file,
+                sink: flow.sink,
+                sinkLine: flow.sinkLine,
+                sinkFile: analysis.file,
+                canonicalType: flow.canonicalType,
+                crossFileSteps: [
+                    {
+                        file: analysis.file,
+                        line: analysis.line,
+                        variable: name,
+                        operation: 'call-cross-file',
+                        description: `${name}() called with tainted data — param "${flow.source}" reaches sink`,
+                    },
+                    {
+                        file: analysis.file,
+                        line: flow.sinkLine,
+                        variable: flow.sink,
+                        operation: 'sink-arg',
+                        description: `${flow.sink}(${flow.propagationPath[flow.propagationPath.length - 1]?.variable || ''})`,
+                    },
+                ],
+            });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=crossFileTaintTracker.js.map

package/dist/project-map/crossFileTaintTracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crossFileTaintTracker.js","sourceRoot":"","sources":["../../src/project-map/crossFileTaintTracker.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsQH,kDAgJC;AApZD,uCAAyB;AACzB,2CAA6B;AAC7B,iDAA6D;AAC7D,6CAA0H;AAC1H,iDAA0E;AA+B1E,+EAA+E;AAE/E,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAChC,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB;IAClE,4BAA4B,EAAE,2BAA2B;IACzD,gBAAgB,EAAE,qBAAqB;IACvC,gCAAgC,EAAE,uBAAuB;CAC5D,CAAC,CAAC;AAgBH;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAC7B,MAAc,EACd,QAAsB,EACtB,IAAY;IAEZ,MAAM,GAAG,GAAG,IAAI,GAAG,EAA4B,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAW,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAExB,KAAK,MAAM,IAAI,IAAI,IAAA,iBAAI,EAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAElD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,oCAAoC;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,sBAAsB;YAAE,SAAS;QAEvD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,CAAC;QAExC,iEAAiE;QACjE,sCAAsC;QACtC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,IAAI,cAAc,GAAG,KAAK,CAAC;QAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,+DAA+D;YAC/D,+DAA+D;YAC/D,oDAAoD;YACpD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnB,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC1B,cAAc,GAAG,IAAI,CAAC,CAAC,iDAAiD;YAC5E,CAAC;QACL,CAAC;QAED,2DAA2D;QAC3D,wDAAwD;QACxD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,cAAc,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjE,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CACxB,MAAsB,EACtB,MAAc,EACd,QAAsB;IAEtB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,IAAA,iBAAI,EAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QAC3E,iDAAiD;QACjD,IAAI,KAAK,CAAC,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;YAAE,SAAS;QAEpH,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;QACjG,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1D,6EAA6E;QAC7E,mCAAmC;QACnC,IAAI,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpC,KAAK,GAAG,IAAI,CAAC;YACb,MAAM;QACV,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAsB;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EACvE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EACpE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EACjE,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACJ,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAC9D,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAC3D,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EACtD,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EACpD,YAAY,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAC7B,MAAc,EACd,QAAsB,EACtB,SAAiB,EACjB,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,IAAA,yBAAU,EAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAChE,+DAA+D;IAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACtB,CAAC,CAAC,MAAM,KAAK,UAAU,SAAS,GAAG;QACnC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CACpF,CAAC;AACN,CAAC;AAED,oDAAoD;AACpD,SAAS,aAAa,CAAC,MAAsB,EAAE,MAAc;IACzD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACvG,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACtC,IAAI,IAAA,yBAAY,EAAC,KAAK,CAAC,EAAE,CAAC;oBACtB,uCAAuC;oBACvC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAChE,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;oBAC7C,sEAAsE;oBACtE,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,yBAAY,EAAC,CAAC,CAAC,CAAC,CAAC;oBAC1D,IAAI,EAAE;wBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAClE,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,uCAAuC,IAAI,KAAK,CAAC,IAAI,KAAK,+BAA+B,EAAE,CAAC;oBAClH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAChE,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;oBAC7C,sDAAsD;oBACtD,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;oBACpC,IAAI,IAAI,IAAI,IAAA,yBAAY,EAAC,IAAI,CAAC,EAAE,CAAC;wBAC7B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAC9D,CAAC;gBACL,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACzE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAChE,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBAC1C,kCAAkC;oBAClC,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,yBAAY,EAAC,CAAC,CAAC,CAAC,CAAC;oBAC1D,IAAI,EAAE;wBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAClE,CAAC;gBACD,iEAAiE;YACrE,CAAC;YACD,MAAM;QACV,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,EAAkB,EAAE,MAAc;IACpD,MAAM,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAA,yBAAY,EAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;IACzB,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,qBAAqB,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAsB,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;QAC9H,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,IAAI,IAAA,yBAAY,EAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,cAAc,CAAC,QAAgB;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,GAAG,GAAiC;QACtC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY;QACrF,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK;QAClC,KAAK,EAAE,QAAQ;KAClB,CAAC;IACF,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAE9E;;;;;;;GAOG;AACI,KAAK,UAAU,mBAAmB,CACrC,IAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAEpD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzB,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,IAAA,0BAAW,EAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAE5B,yCAAyC;IACzC,MAAM,OAAO,GAAG,IAAA,2BAAc,EAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9D,4CAA4C;IAE5C,gDAAgD;IAChD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,MAAM,YAAY,GAA6D,EAAE,CAAC;IAElF,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC;QAC5C,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,GAAG,QAAQ,EAAE,CAAC;QACvD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,KAAK,EAAG,CAAC;QACxD,IAAI,KAAK,IAAI,QAAQ;YAAE,SAAS;QAEhC,MAAM,YAAY,GAAG,IAAA,8BAAiB,EAClC,IAAI,EACJ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAC1C,IAAI,CAAC,aAAa,CACrB,CAAC;QACF,IAAI,CAAC,YAAY;YAAE,SAAS,CAAC,+BAA+B;QAC5D,IAAI,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,SAAS,CAAC,cAAc;QAC5D,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAE/B,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QACnE,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACD,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAErB,MAAM,QAAQ,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACvE,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;YACnC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QACD,WAAW,EAAE,CAAC;QAEd,6DAA6D;QAC7D,IAAI,KAAK,GAAG,CAAC,GAAG,QAAQ,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAW,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACnD,IAAI,MAAM,EAAE,CAAC;gBACT,MAAM,aAAa,GAAG,IAAA,2BAAc,EAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC1D,KAAK,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,aAAa,EAAE,CAAC;oBAC1C,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtF,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,sDAAsD;IACtD,MAAM,UAAU,GAAG,MAAM,IAAA,yBAAU,EAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,+DAA+D;QAC/D,8DAA8D;QAC9D,OAAO,0BAA0B,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC5F,CAAC;IAED,uDAAuD;IACvD,2EAA2E;IAC3E,qEAAqE;IACrE,gDAAgD;IAChD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAoB,EAAE,CAAC;QAClC,IAAI,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE7B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACtC,4DAA4D;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC1D,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,WAAW,IAAI,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC,EAAE,CAAC;gBACjF,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC3C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC9C,oCAAoC;oBACpC,KAAK,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,IAAI,CAAC,QAAQ;wBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,SAAS,EAAE,iBAAiB;wBAC5B,WAAW,EAAE,GAAG,MAAM,SAAS,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,kBAAkB,EAAE;qBAC3I,CAAC,CAAC;oBACH,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;oBAC3B,SAAS;gBACb,CAAC;YACL,CAAC;YAED,KAAK,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU;gBAC9D,WAAW,EAAE,IAAI,CAAC,WAAW;aAChC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU;YACV,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ;YACR,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,cAAc,EAAE,KAAK;SACxB,CAAC,CAAC;IACP,CAAC;IAED,sEAAsE;IACtE,MAAM,aAAa,GAAG,MAAM,0BAA0B,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC7G,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;IAE/B,8CAA8C;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,0BAA0B,CACrC,aAA4C,EAC5C,OAA4B,EAC5B,aAAqB,EACrB,QAAsB;IAEtB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAE3C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC;QAC3C,IAAI,QAAQ,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC;YAAE,SAAS;QAErD,oDAAoD;QACpD,2EAA2E;QAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACD,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAErB,oDAAoD;QACpD,MAAM,KAAK,GAAG,MAAM,IAAA,yBAAU,EAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,4DAA4D;YAC5D,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/F,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAErG,IAAI,CAAC,aAAa;gBAAE,SAAS;YAE7B,OAAO,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,GAAG,IAAI,aAAa,IAAI,CAAC,MAAM,EAAE;gBACzC,UAAU,EAAE,QAAQ,CAAC,IAAI;gBACzB,UAAU,EAAE,QAAQ,CAAC,IAAI;gBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,cAAc,EAAE;oBACZ;wBACI,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,QAAQ,EAAE,IAAI;wBACd,SAAS,EAAE,iBAAiB;wBAC5B,WAAW,EAAE,GAAG,IAAI,wCAAwC,IAAI,CAAC,MAAM,gBAAgB;qBAC1F;oBACD;wBACI,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,IAAI,EAAE,IAAI,CAAC,QAAQ;wBACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,SAAS,EAAE,UAAU;wBACrB,WAAW,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE,GAAG;qBACxG;iBACJ;aACJ,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC"}

package/dist/project-map/endpointDiscovery.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Endpoint discovery — scans the workspace for HTTP route handler definitions
+ * across all supported frameworks.
+ *
+ * Uses ripgrep (via searchCode) for speed. Detects:
+ *   - Next.js App Router:  export async function GET/POST/PATCH/DELETE/PUT
+ *   - Express:             app.get/post/patch/delete/put('path', handler)
+ *                          router.get/post/...('path', handler)
+ *   - FastAPI:             @app.get/post/...("/path")
+ *                          @router.get/post/...("/path")
+ *   - Flask:               @app.route("/path")  @app.get/post/...("/path")
+ *   - Django:              path('url', views.handler)  re_path(...)
+ *
+ * Returns a compact list of { method, path, file, line, framework } entries.
+ */
+export interface DiscoveredEndpoint {
+    method: string;
+    path: string;
+    file: string;
+    line: number;
+    framework: string;
+}
+export declare function discoverEndpoints(workspaceRoot: string, glob?: string): Promise<DiscoveredEndpoint[]>;
+export declare function formatEndpoints(endpoints: DiscoveredEndpoint[]): string;

package/dist/project-map/endpointDiscovery.js

@@ -0,0 +1,101 @@
+"use strict";
+/**
+ * Endpoint discovery — scans the workspace for HTTP route handler definitions
+ * across all supported frameworks.
+ *
+ * Uses ripgrep (via searchCode) for speed. Detects:
+ *   - Next.js App Router:  export async function GET/POST/PATCH/DELETE/PUT
+ *   - Express:             app.get/post/patch/delete/put('path', handler)
+ *                          router.get/post/...('path', handler)
+ *   - FastAPI:             @app.get/post/...("/path")
+ *                          @router.get/post/...("/path")
+ *   - Flask:               @app.route("/path")  @app.get/post/...("/path")
+ *   - Django:              path('url', views.handler)  re_path(...)
+ *
+ * Returns a compact list of { method, path, file, line, framework } entries.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.discoverEndpoints = discoverEndpoints;
+exports.formatEndpoints = formatEndpoints;
+const searchCode_1 = require("../utils/searchCode");
+const HTTP_METHODS = ['GET', 'POST', 'PATCH', 'DELETE', 'PUT'];
+// Patterns to search for. Each entry has a regex and a framework label.
+const PATTERNS = [
+    // Next.js App Router: export async function GET / POST / etc.
+    { regex: 'export\\s+async\\s+function\\s+(GET|POST|PATCH|DELETE|PUT)\\b', framework: 'nextjs' },
+    // Express: app.METHOD( or router.METHOD(
+    { regex: '(app|router)\\.(get|post|patch|delete|put)\\s*\\(', framework: 'express' },
+    // Express: app.all(
+    { regex: '(app|router)\\.all\\s*\\(', framework: 'express' },
+    // FastAPI: @app.get( / @router.get(
+    { regex: '@(app|router)\\.(get|post|patch|delete|put)\\s*\\(', framework: 'fastapi' },
+    // Flask: @app.route(
+    { regex: '@app\\.route\\s*\\(', framework: 'flask' },
+    // Flask 2.0: @app.get( / @app.post( etc
+    { regex: '@app\\.(get|post|patch|delete|put)\\s*\\(', framework: 'flask' },
+    // Django: path('url', views.handler)
+    { regex: '(re_)?path\\s*\\(\\s*[\'"]', framework: 'django' },
+];
+function extractMethod(text, framework) {
+    const upper = text.toUpperCase();
+    for (const m of HTTP_METHODS) {
+        if (upper.includes(m))
+            return m;
+    }
+    if (framework === 'flask' && text.includes('.route('))
+        return '*';
+    if (framework === 'django')
+        return '*';
+    if (upper.includes('.ALL('))
+        return '*';
+    return '?';
+}
+function extractPath(text) {
+    // Try to find a string literal (single or double quoted) in the line
+    const match = text.match(/['"`]([^'"`]+)['"`]/);
+    return match ? match[1] : '';
+}
+async function discoverEndpoints(workspaceRoot, glob) {
+    const allEndpoints = [];
+    const seen = new Set(); // dedup by file:line
+    for (const { regex, framework } of PATTERNS) {
+        try {
+            const result = await (0, searchCode_1.searchCode)(workspaceRoot, regex, glob);
+            for (const hit of result.hits) {
+                const key = `${hit.path}:${hit.line}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                allEndpoints.push({
+                    method: extractMethod(hit.text, framework),
+                    path: extractPath(hit.text),
+                    file: hit.path,
+                    line: hit.line,
+                    framework,
+                });
+            }
+        }
+        catch {
+            // ripgrep not available — skip this pattern
+        }
+    }
+    // Sort by file, then line
+    allEndpoints.sort((a, b) => {
+        if (a.file !== b.file)
+            return a.file.localeCompare(b.file);
+        return a.line - b.line;
+    });
+    return allEndpoints;
+}
+function formatEndpoints(endpoints) {
+    if (endpoints.length === 0) {
+        return 'No HTTP route handlers found in the workspace.';
+    }
+    const lines = [`Found ${endpoints.length} endpoint(s):`];
+    for (const ep of endpoints) {
+        const pathStr = ep.path ? ` ${ep.path}` : '';
+        lines.push(`  ${ep.method.padEnd(6)} ${ep.file}:${ep.line} [${ep.framework}]${pathStr}`);
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=endpointDiscovery.js.map

package/dist/project-map/endpointDiscovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpointDiscovery.js","sourceRoot":"","sources":["../../src/project-map/endpointDiscovery.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAiDH,8CAmCC;AAED,0CAWC;AA/FD,oDAA4D;AAU5D,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAU,CAAC;AAExE,wEAAwE;AACxE,MAAM,QAAQ,GAA2C;IACrD,8DAA8D;IAC9D,EAAE,KAAK,EAAE,+DAA+D,EAAE,SAAS,EAAE,QAAQ,EAAE;IAC/F,yCAAyC;IACzC,EAAE,KAAK,EAAE,mDAAmD,EAAE,SAAS,EAAE,SAAS,EAAE;IACpF,oBAAoB;IACpB,EAAE,KAAK,EAAE,2BAA2B,EAAE,SAAS,EAAE,SAAS,EAAE;IAC5D,oCAAoC;IACpC,EAAE,KAAK,EAAE,oDAAoD,EAAE,SAAS,EAAE,SAAS,EAAE;IACrF,qBAAqB;IACrB,EAAE,KAAK,EAAE,qBAAqB,EAAE,SAAS,EAAE,OAAO,EAAE;IACpD,wCAAwC;IACxC,EAAE,KAAK,EAAE,2CAA2C,EAAE,SAAS,EAAE,OAAO,EAAE;IAC1E,qCAAqC;IACrC,EAAE,KAAK,EAAE,4BAA4B,EAAE,SAAS,EAAE,QAAQ,EAAE;CAC/D,CAAC;AAEF,SAAS,aAAa,CAAC,IAAY,EAAE,SAAiB;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,SAAS,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,GAAG,CAAC;IAClE,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACvC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC;IACxC,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC7B,qEAAqE;IACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjC,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACnC,aAAqB,EACrB,IAAa;IAEb,MAAM,YAAY,GAAyB,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,qBAAqB;IAErD,KAAK,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1C,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAA,uBAAU,EAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC5D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACtC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAEd,YAAY,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;oBAC1C,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC3B,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,SAAS;iBACZ,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,4CAA4C;QAChD,CAAC;IACL,CAAC;IAED,0BAA0B;IAC1B,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC;AACxB,CAAC;AAED,SAAgB,eAAe,CAAC,SAA+B;IAC3D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,gDAAgD,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,SAAS,SAAS,CAAC,MAAM,eAAe,CAAC,CAAC;IACnE,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/project-map/guardEvaluator.js

@@ -123,6 +123,43 @@ function identifyGuardType(fnRoot, source, language) {
         && /(zod|joi|yup|pydantic|schema)/i.test(text)) {
         return 'validator';
     }
+    // ── 9. Python-specific guards ─────────────────────────────────────────
+    if (language === 'python') {
+        // Python allowlist: if x in {'a', 'b'} or if x in ('a', 'b') or if x in ['a', 'b']
+        if (/if\s+\w+\s+in\s*[\(\{\[]\s*['"][^\])}]*[\])}]/.test(text)) {
+            const hasLiteralSet = /in\s*[\(\{\[]\s*['"][^)\]}]*['"]\s*[,)\]}]/.test(text);
+            return hasLiteralSet ? 'allowlist-literal' : 'allowlist-dynamic';
+        }
+        // Python parameterized query: cursor.execute("...%s...", [params]) or
+        // cursor.execute("...:name...", {...}) or session.execute(text("...:name..."), {...})
+        for (const node of (0, astHelpers_1.walk)(fnRoot)) {
+            if (node.type !== 'call' && node.type !== 'call_expression')
+                continue;
+            const p = (0, astHelpers_1.callParts)(node, source);
+            if (!p || !p.receiver)
+                continue;
+            if (['execute', 'executemany', 'execute_many'].includes(p.method)) {
+                if (p.args.length >= 2) {
+                    const firstArg = p.args[0];
+                    const argText = source.slice(firstArg.startIndex, firstArg.endIndex);
+                    const isStringLike = firstArg.type === 'string';
+                    const hasPlaceholder = argText.includes('%s') || /:\w+/.test(argText);
+                    const hasConcat = argText.includes(' + ') || argText.includes('% ') || argText.includes('.format(');
+                    if (isStringLike && hasPlaceholder && !hasConcat) {
+                        return 'parameterized-query';
+                    }
+                }
+            }
+        }
+        // Python constant-time comparison: secrets.compare_digest or hmac.compare_digest
+        if (/compare_digest|secrets\.compare|hmac\.compare/.test(text)) {
+            return 'auth-api-key'; // constant-time comparison = auth guard
+        }
+        // Python rate limiting: flask_limiter, slowapi, ratelimit decorator
+        if (/flask_limiter|Limiter|slowapi|ratelimit|@limiter|@rate_limit/i.test(text)) {
+            return 'rate-limit';
+        }
+    }
     return 'unknown';
 }
 // ── Evaluation ──────────────────────────────────────────────────────────────