@securecode-ai/mcp 0.5.4 → 0.5.6

package/dist/attack/fixVerifyLoop.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Fix verification loop — re-runs the exploit verification against the
+ * proposed fixed code to prove the fix actually closed the vulnerability.
+ *
+ * After the fixer generates `fixed_code` + `replace_range`, we:
+ *   1. Merge the fixed code into the original file (in memory).
+ *   2. Run local syntax validation (if available).
+ *   3. Call /verify/generate with the FIXED code and the same vulnerability context.
+ *   4. Execute the generated test in the existing sandbox.
+ *   5. Call /verify/analyze.
+ *   6. Compare the original and fixed verdicts to determine if the fix closed the issue.
+ *
+ * Closure semantics (conservative by default):
+ *   - Original PROVEN + Fixed UNPROVEN  → closed
+ *   - Original PROVEN + Fixed PROVEN    → still-vulnerable
+ *   - Original PROVEN + Fixed INCONCLUSIVE → inconclusive
+ *   - Anything else → inconclusive (don't claim closure without proof)
+ *
+ * The loop uses a SEPARATE, smaller budget (FIX_VERIFY_DEFAULTS) so a single
+ * fix verification cannot consume the entire original scan verification budget.
+ */
+import type { ApiClient } from '../api/client';
+import { VerifyBudgetTracker, defaultFixVerifyBudget, type VerifyBudget, type FixVerificationStatus } from './agentScanProtocol';
+import { mergeFixedCode, type ReplaceRange } from './fixCodeMerge';
+import { type VerifyFinding } from './verifyLoop';
+export interface FixVerifyLoopOptions {
+    finding: VerifyFinding;
+    originalCode: string;
+    fixedCode: string;
+    replaceRange: ReplaceRange;
+    filePath: string;
+    relatedFiles: Array<{
+        filePath: string;
+        content: string;
+        relationship: string;
+    }>;
+    workspaceRoot: string;
+    language: string;
+    client: ApiClient;
+    originalVerdict: 'PROVEN' | 'UNPROVEN' | 'INCONCLUSIVE' | 'SKIPPED';
+    signal?: AbortSignal;
+    budgetTracker?: VerifyBudgetTracker;
+    onProgress?: (round: number, maxRounds: number, message: string) => void;
+}
+export interface FixVerifyLoopResult {
+    status: FixVerificationStatus;
+    reason: string;
+    originalVerdict: 'PROVEN' | 'UNPROVEN' | 'INCONCLUSIVE' | 'SKIPPED';
+    fixedVerdict?: 'PROVEN' | 'UNPROVEN' | 'INCONCLUSIVE';
+    roundsUsed: number;
+    fixedCodeHash: string;
+    testOutput?: string;
+}
+export declare function runFixVerifyLoop(opts: FixVerifyLoopOptions): Promise<FixVerifyLoopResult>;
+export { mergeFixedCode, defaultFixVerifyBudget, type VerifyBudget };

package/dist/attack/fixVerifyLoop.js

@@ -0,0 +1,187 @@
+"use strict";
+/**
+ * Fix verification loop — re-runs the exploit verification against the
+ * proposed fixed code to prove the fix actually closed the vulnerability.
+ *
+ * After the fixer generates `fixed_code` + `replace_range`, we:
+ *   1. Merge the fixed code into the original file (in memory).
+ *   2. Run local syntax validation (if available).
+ *   3. Call /verify/generate with the FIXED code and the same vulnerability context.
+ *   4. Execute the generated test in the existing sandbox.
+ *   5. Call /verify/analyze.
+ *   6. Compare the original and fixed verdicts to determine if the fix closed the issue.
+ *
+ * Closure semantics (conservative by default):
+ *   - Original PROVEN + Fixed UNPROVEN  → closed
+ *   - Original PROVEN + Fixed PROVEN    → still-vulnerable
+ *   - Original PROVEN + Fixed INCONCLUSIVE → inconclusive
+ *   - Anything else → inconclusive (don't claim closure without proof)
+ *
+ * The loop uses a SEPARATE, smaller budget (FIX_VERIFY_DEFAULTS) so a single
+ * fix verification cannot consume the entire original scan verification budget.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultFixVerifyBudget = exports.mergeFixedCode = void 0;
+exports.runFixVerifyLoop = runFixVerifyLoop;
+const crypto = __importStar(require("crypto"));
+const agentScanProtocol_1 = require("./agentScanProtocol");
+Object.defineProperty(exports, "defaultFixVerifyBudget", { enumerable: true, get: function () { return agentScanProtocol_1.defaultFixVerifyBudget; } });
+const fixCodeMerge_1 = require("./fixCodeMerge");
+Object.defineProperty(exports, "mergeFixedCode", { enumerable: true, get: function () { return fixCodeMerge_1.mergeFixedCode; } });
+const verifyLoop_1 = require("./verifyLoop");
+const PER_FIX_MAX_ROUNDS = 3;
+async function runFixVerifyLoop(opts) {
+    const fixedCodeHash = crypto.createHash('sha256').update(opts.fixedCode).digest('hex').slice(0, 16);
+    // 1. Merge the fixed code into the original file.
+    const mergeResult = (0, fixCodeMerge_1.mergeFixedCode)(opts.originalCode, opts.fixedCode, opts.replaceRange);
+    if (!mergeResult.ok) {
+        return {
+            status: 'syntax-invalid',
+            reason: `Fixed code merge failed: ${mergeResult.error}`,
+            originalVerdict: opts.originalVerdict,
+            roundsUsed: 0,
+            fixedCodeHash,
+        };
+    }
+    const mergedCode = mergeResult.mergedCode;
+    // 2. Use a dedicated fix verification budget if none provided.
+    const tracker = opts.budgetTracker ?? new agentScanProtocol_1.VerifyBudgetTracker((0, agentScanProtocol_1.defaultFixVerifyBudget)());
+    // 3. Abort check.
+    if (opts.signal?.aborted) {
+        return {
+            status: 'cancelled',
+            reason: 'Fix verification cancelled by user before starting.',
+            originalVerdict: opts.originalVerdict,
+            roundsUsed: 0,
+            fixedCodeHash,
+        };
+    }
+    // 4. Run the verify loop against the MERGED (fixed) code.
+    //    Pass verificationPhase: 'fix' so the API knows this is a fix-verification
+    //    call, not an initial finding verification.
+    const maxRounds = Math.min(PER_FIX_MAX_ROUNDS, tracker.budget.maxRoundsPerFinding);
+    const result = await (0, verifyLoop_1.runVerifyLoop)({
+        finding: opts.finding,
+        filePath: opts.filePath,
+        code: mergedCode,
+        relatedFiles: opts.relatedFiles,
+        workspaceRoot: opts.workspaceRoot,
+        language: opts.language,
+        client: opts.client,
+        budgetTracker: tracker,
+        signal: opts.signal,
+        verificationPhase: 'fix',
+        onProgress: opts.onProgress,
+    });
+    // 5. Map the verify loop result to a fix verification status.
+    const fixedVerdict = result.verdict;
+    // Handle special sub-verdicts that short-circuit the closure decision.
+    if (result.subVerdict === 'sandbox-unavailable') {
+        return {
+            status: 'sandbox-unavailable',
+            reason: `Fix verification could not run: no local sandbox (Docker or Deno) available. ${result.reason}`,
+            originalVerdict: opts.originalVerdict,
+            fixedVerdict,
+            roundsUsed: result.roundsUsed,
+            fixedCodeHash,
+            testOutput: result.testOutput,
+        };
+    }
+    if (result.subVerdict === 'cancelled' || result.subVerdict === 'aborted') {
+        return {
+            status: 'cancelled',
+            reason: 'Fix verification cancelled by user.',
+            originalVerdict: opts.originalVerdict,
+            fixedVerdict,
+            roundsUsed: result.roundsUsed,
+            fixedCodeHash,
+            testOutput: result.testOutput,
+        };
+    }
+    // 6. Determine closure based on original vs fixed verdicts.
+    //    Conservative: only claim "closed" when the original was PROVEN and the
+    //    fixed code is UNPROVEN. Everything else is inconclusive or still-vulnerable.
+    return determineClosureStatus(opts.originalVerdict, fixedVerdict, result.reason, result.roundsUsed, fixedCodeHash, result.testOutput);
+}
+function determineClosureStatus(originalVerdict, fixedVerdict, reason, roundsUsed, fixedCodeHash, testOutput) {
+    // Original was PROVEN — the exploit reproduced against the original code.
+    if (originalVerdict === 'PROVEN') {
+        if (fixedVerdict === 'UNPROVEN') {
+            return {
+                status: 'closed',
+                reason: `Original exploit reproduced; the same exploit did NOT reproduce against the proposed fixed code. ${reason}`,
+                originalVerdict,
+                fixedVerdict,
+                roundsUsed,
+                fixedCodeHash,
+                testOutput,
+            };
+        }
+        if (fixedVerdict === 'PROVEN') {
+            return {
+                status: 'still-vulnerable',
+                reason: `The exploit still reproduced against the proposed fixed code. ${reason}`,
+                originalVerdict,
+                fixedVerdict,
+                roundsUsed,
+                fixedCodeHash,
+                testOutput,
+            };
+        }
+        // fixedVerdict === 'INCONCLUSIVE'
+        return {
+            status: 'inconclusive',
+            reason: `Fix verification was inconclusive — could not determine if the fix closed the vulnerability. ${reason}`,
+            originalVerdict,
+            fixedVerdict,
+            roundsUsed,
+            fixedCodeHash,
+            testOutput,
+        };
+    }
+    // Original was UNPROVEN or INCONCLUSIVE or SKIPPED — we can't claim the fix
+    // closed anything because we never proved the original was exploitable.
+    return {
+        status: 'inconclusive',
+        reason: `Cannot determine fix closure: the original finding was ${originalVerdict} (not PROVEN). Fix verification ran ${roundsUsed} round(s) and returned ${fixedVerdict}. ${reason}`,
+        originalVerdict,
+        fixedVerdict,
+        roundsUsed,
+        fixedCodeHash,
+        testOutput,
+    };
+}
+//# sourceMappingURL=fixVerifyLoop.js.map

package/dist/attack/fixVerifyLoop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixVerifyLoop.js","sourceRoot":"","sources":["../../src/attack/fixVerifyLoop.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8CH,4CAgFC;AA3HD,+CAAiC;AAKjC,2DAK6B;AA4KJ,uGA/KrB,0CAAsB,OA+KqB;AA1K/C,iDAAmE;AA0K1D,+FA1KA,6BAAc,OA0KA;AAzKvB,6CAAiE;AA4BjE,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEtB,KAAK,UAAU,gBAAgB,CAAC,IAA0B;IAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEpG,kDAAkD;IAClD,MAAM,WAAW,GAAG,IAAA,6BAAc,EAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO;YACH,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,4BAA4B,WAAW,CAAC,KAAK,EAAE;YACvD,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,UAAU,EAAE,CAAC;YACb,aAAa;SAChB,CAAC;IACN,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;IAE1C,+DAA+D;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,uCAAmB,CAAC,IAAA,0CAAsB,GAAE,CAAC,CAAC;IAExF,kBAAkB;IAClB,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACvB,OAAO;YACH,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,qDAAqD;YAC7D,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,UAAU,EAAE,CAAC;YACb,aAAa;SAChB,CAAC;IACN,CAAC;IAED,0DAA0D;IAC1D,+EAA+E;IAC/E,gDAAgD;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAEnF,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAa,EAAC;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,aAAa,EAAE,OAAO;QACtB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,iBAAiB,EAAE,KAAK;QACxB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC9B,CAAC,CAAC;IAEH,8DAA8D;IAC9D,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC;IAEpC,uEAAuE;IACvE,IAAI,MAAM,CAAC,UAAU,KAAK,qBAAqB,EAAE,CAAC;QAC9C,OAAO;YACH,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,gFAAgF,MAAM,CAAC,MAAM,EAAE;YACvG,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,YAAY;YACZ,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,aAAa;YACb,UAAU,EAAE,MAAM,CAAC,UAAU;SAChC,CAAC;IACN,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACvE,OAAO;YACH,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,qCAAqC;YAC7C,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,YAAY;YACZ,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,aAAa;YACb,UAAU,EAAE,MAAM,CAAC,UAAU;SAChC,CAAC;IACN,CAAC;IAED,4DAA4D;IAC5D,4EAA4E;IAC5E,kFAAkF;IAClF,OAAO,sBAAsB,CAAC,IAAI,CAAC,eAAe,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;AAC1I,CAAC;AAED,SAAS,sBAAsB,CAC3B,eAAmE,EACnE,YAAoD,EACpD,MAAc,EACd,UAAkB,EAClB,aAAqB,EACrB,UAAmB;IAEnB,0EAA0E;IAC1E,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;YAC9B,OAAO;gBACH,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,oGAAoG,MAAM,EAAE;gBACpH,eAAe;gBACf,YAAY;gBACZ,UAAU;gBACV,aAAa;gBACb,UAAU;aACb,CAAC;QACN,CAAC;QACD,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO;gBACH,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,iEAAiE,MAAM,EAAE;gBACjF,eAAe;gBACf,YAAY;gBACZ,UAAU;gBACV,aAAa;gBACb,UAAU;aACb,CAAC;QACN,CAAC;QACD,kCAAkC;QAClC,OAAO;YACH,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,gGAAgG,MAAM,EAAE;YAChH,eAAe;YACf,YAAY;YACZ,UAAU;YACV,aAAa;YACb,UAAU;SACb,CAAC;IACN,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,OAAO;QACH,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,0DAA0D,eAAe,uCAAuC,UAAU,0BAA0B,YAAY,KAAK,MAAM,EAAE;QACrL,eAAe;QACf,YAAY;QACZ,UAAU;QACV,aAAa;QACb,UAAU;KACb,CAAC;AACN,CAAC"}

package/dist/attack/investigationProfiles.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Target-specific investigation profiles.
+ *
+ * Different file types require different investigation steps. An HTTP route
+ * handler needs route discovery and policy checks; a utility function needs
+ * caller inventory and security-sensitive branch review. Using the wrong
+ * checklist wastes steps on irrelevant tools (e.g., get_endpoints on a
+ * file with no routes) and misses required steps for the actual target type.
+ */
+import type { InvestigationStep } from './investigationState';
+import type { EvidenceRequirement } from './evidenceLedger';
+export interface InvestigationProfile {
+    name: string;
+    requiredSteps: InvestigationStep[];
+    description: string;
+    requirements: EvidenceRequirement[];
+}
+export declare const HTTP_ROUTE_PROFILE: InvestigationProfile;
+export declare const WEBSOCKET_RPC_PROFILE: InvestigationProfile;
+export declare const AUTH_SERVICE_PROFILE: InvestigationProfile;
+export declare const GENERIC_UTILITY_PROFILE: InvestigationProfile;
+export interface ProfileSelectionInput {
+    filePath: string;
+    architectureContext?: string;
+    endpointContext?: string;
+}
+/**
+ * Select an investigation profile based on the target file path and context.
+ *
+ * Heuristics:
+ *   - File path contains "ws", "websocket", "rpc", "socket" → WebSocket RPC
+ *   - File path contains "auth", "login", "token", "session", "credential" → Auth Service
+ *   - Architecture context mentions "endpoint", "route", "handler", "express", "fastify" → HTTP Route
+ *   - Otherwise → Generic Utility
+ */
+export declare function selectInvestigationProfile(input: ProfileSelectionInput): InvestigationProfile;

package/dist/attack/investigationProfiles.js

@@ -0,0 +1,144 @@
+"use strict";
+/**
+ * Target-specific investigation profiles.
+ *
+ * Different file types require different investigation steps. An HTTP route
+ * handler needs route discovery and policy checks; a utility function needs
+ * caller inventory and security-sensitive branch review. Using the wrong
+ * checklist wastes steps on irrelevant tools (e.g., get_endpoints on a
+ * file with no routes) and misses required steps for the actual target type.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GENERIC_UTILITY_PROFILE = exports.AUTH_SERVICE_PROFILE = exports.WEBSOCKET_RPC_PROFILE = exports.HTTP_ROUTE_PROFILE = void 0;
+exports.selectInvestigationProfile = selectInvestigationProfile;
+exports.HTTP_ROUTE_PROFILE = {
+    name: 'http-route',
+    requiredSteps: [
+        'initial-read',
+        'route-discovery',
+        'policy-check',
+        'auth-symbol-search',
+        'cross-file-flow',
+        'config-inspection',
+        'all-handlers-reviewed',
+        'candidates-verified',
+    ],
+    description: 'HTTP route handler — requires route discovery, policy check, auth search, cross-file flow, config inspection, authorization analysis, and all-handlers-reviewed.',
+    requirements: [
+        { id: 'http-initial-read', description: 'Read the target file source', acceptedKinds: ['source-range'], requiredTools: ['read_file'], minimumCount: 1 },
+        { id: 'http-route-discovery', description: 'Discover routes/endpoints', acceptedKinds: ['handler-inventory'], requiredTools: ['get_endpoints'], minimumCount: 1 },
+        { id: 'http-policy-check', description: 'Check policy on route handlers', acceptedKinds: ['policy-result'], requiredTools: ['check_policy'], minimumCount: 1 },
+        { id: 'http-auth-search', description: 'Find authentication symbols', acceptedKinds: ['symbol-definition', 'symbol-reference'], requiredTools: ['search_code'], minimumCount: 1 },
+        { id: 'http-cross-file-flow', description: 'Trace cross-file data flow', acceptedKinds: ['cross-file-flow'], requiredTools: ['trace_flow_cross_file', 'trace_flow'], minimumCount: 1 },
+        { id: 'http-config-inspection', description: 'Inspect security configuration', acceptedKinds: ['config-result'], requiredTools: ['read_config'], minimumCount: 1, acceptsNegative: true },
+        { id: 'http-all-handlers', description: 'Review all discovered handlers', acceptedKinds: ['handler-inventory'], minimumCount: 2 },
+        { id: 'http-authz-check', description: 'Verify authorization on authenticated vs unauthenticated paths', acceptedKinds: ['policy-result', 'guard-result'], requiredTools: ['check_policy', 'check_guard'], minimumCount: 1, acceptsNegative: true },
+        { id: 'http-csrf-check', description: 'Verify CSRF/origin checks on mutation endpoints', acceptedKinds: ['guard-result', 'policy-result'], requiredTools: ['check_guard', 'check_policy'], minimumCount: 1, acceptsNegative: true },
+        { id: 'http-threat-model', description: 'Establish threat model: is the attacker in scope for this endpoint?', acceptedKinds: ['threat-model-result', 'config-result'], requiredTools: ['read_config', 'search_code'], minimumCount: 1, acceptsNegative: true },
+        { id: 'http-config-reachability', description: 'Verify configuration-dependent claims: is the unsafe config reachable in production?', acceptedKinds: ['reachability-result', 'config-result'], requiredTools: ['read_config', 'search_code'], minimumCount: 1, acceptsNegative: true },
+    ],
+};
+exports.WEBSOCKET_RPC_PROFILE = {
+    name: 'websocket-rpc',
+    requiredSteps: [
+        'initial-read',
+        'route-discovery',
+        'auth-symbol-search',
+        'ownership-analysis',
+        'cross-file-flow',
+        'config-inspection',
+        'all-handlers-reviewed',
+        'candidates-verified',
+    ],
+    description: 'WebSocket RPC handler — requires method inventory, connection auth, per-method authorization, ownership analysis, command execution tracing, and rate-limit check.',
+    requirements: [
+        { id: 'ws-initial-read', description: 'Read the target file source', acceptedKinds: ['source-range'], requiredTools: ['read_file'], minimumCount: 1 },
+        { id: 'ws-method-inventory', description: 'Inventory RPC methods', acceptedKinds: ['handler-inventory'], requiredTools: ['get_endpoints', 'search_code'], minimumCount: 1 },
+        { id: 'ws-auth-search', description: 'Find authentication symbols', acceptedKinds: ['symbol-definition', 'symbol-reference'], requiredTools: ['search_code'], minimumCount: 1 },
+        { id: 'ws-ownership-analysis', description: 'Trace ownership for resource methods', acceptedKinds: ['cross-file-flow', 'symbol-reference'], requiredTools: ['trace_flow_cross_file', 'search_code'], minimumCount: 1 },
+        { id: 'ws-cross-file-flow', description: 'Trace cross-file data flow', acceptedKinds: ['cross-file-flow'], requiredTools: ['trace_flow_cross_file'], minimumCount: 1 },
+        { id: 'ws-config-inspection', description: 'Inspect security configuration', acceptedKinds: ['config-result'], requiredTools: ['read_config'], minimumCount: 1, acceptsNegative: true },
+        { id: 'ws-all-handlers', description: 'Review all RPC methods', acceptedKinds: ['handler-inventory'], minimumCount: 2 },
+        { id: 'ws-per-method-authz', description: 'Verify per-method authorization (owner vs client roles)', acceptedKinds: ['guard-result', 'policy-result'], requiredTools: ['check_guard', 'check_policy'], minimumCount: 1, acceptsNegative: true },
+        { id: 'ws-cmd-execution', description: 'Trace command execution paths (execFile, spawn, child_process)', acceptedKinds: ['cross-file-flow', 'source-range'], requiredTools: ['trace_flow_cross_file', 'trace_flow'], minimumCount: 1, acceptsNegative: true },
+        { id: 'ws-threat-model', description: 'Establish threat model: are untrusted local processes in scope? Is the binding address exposed?', acceptedKinds: ['threat-model-result', 'config-result'], requiredTools: ['read_config', 'search_code'], minimumCount: 1, acceptsNegative: true },
+        { id: 'ws-cmd-capability', description: 'Verify command capability: trace untrusted input to a real execution sink, verify per-method authorization and argument validation', acceptedKinds: ['capability-result', 'cross-file-flow'], requiredTools: ['trace_flow_cross_file', 'trace_flow'], minimumCount: 1, acceptsNegative: true },
+    ],
+};
+exports.AUTH_SERVICE_PROFILE = {
+    name: 'auth-service',
+    requiredSteps: [
+        'initial-read',
+        'auth-symbol-search',
+        'cross-file-flow',
+        'config-inspection',
+        'tests-found',
+        'all-handlers-reviewed',
+        'candidates-verified',
+    ],
+    description: 'Authentication service — requires caller inventory, token issue/verify, role analysis, credential lifecycle, session revocation, bootstrap token handling, config inspection, and tests.',
+    requirements: [
+        { id: 'auth-initial-read', description: 'Read the target file source', acceptedKinds: ['source-range'], requiredTools: ['read_file'], minimumCount: 1 },
+        { id: 'auth-symbol-search', description: 'Find auth function definitions', acceptedKinds: ['symbol-definition', 'symbol-reference'], requiredTools: ['search_code'], minimumCount: 1 },
+        { id: 'auth-cross-file-flow', description: 'Trace credential flow across files', acceptedKinds: ['cross-file-flow'], requiredTools: ['trace_flow_cross_file'], minimumCount: 1 },
+        { id: 'auth-config-inspection', description: 'Inspect auth configuration', acceptedKinds: ['config-result'], requiredTools: ['read_config'], minimumCount: 1, acceptsNegative: true },
+        { id: 'auth-tests-found', description: 'Find tests for auth code', acceptedKinds: ['test-location'], requiredTools: ['find_tests'], minimumCount: 1, acceptsNegative: true },
+        { id: 'auth-all-handlers', description: 'Review all auth operations', acceptedKinds: ['handler-inventory'], minimumCount: 1 },
+        { id: 'auth-credential-lifecycle', description: 'Verify credential lifecycle (issue, verify, revoke, expire)', acceptedKinds: ['guard-result', 'cross-file-flow'], requiredTools: ['check_guard', 'trace_flow_cross_file'], minimumCount: 1, acceptsNegative: true },
+        { id: 'auth-bootstrap-token', description: 'Verify bootstrap/pairing token handling', acceptedKinds: ['guard-result', 'policy-result'], requiredTools: ['check_guard', 'check_policy'], minimumCount: 1, acceptsNegative: true },
+        { id: 'auth-threat-model', description: 'Establish threat model: is the attacker in scope for the auth flow?', acceptedKinds: ['threat-model-result', 'config-result'], requiredTools: ['read_config', 'search_code'], minimumCount: 1, acceptsNegative: true },
+        { id: 'auth-config-reachability', description: 'Verify configuration-dependent claims: is the auth config reachable in production?', acceptedKinds: ['reachability-result', 'config-result'], requiredTools: ['read_config', 'search_code'], minimumCount: 1, acceptsNegative: true },
+    ],
+};
+exports.GENERIC_UTILITY_PROFILE = {
+    name: 'generic-utility',
+    requiredSteps: [
+        'initial-read',
+        'cross-file-flow',
+        'tests-found',
+        'candidates-verified',
+    ],
+    description: 'Generic utility — requires initial read, caller inventory, security-sensitive branch review, tests, and verification.',
+    requirements: [
+        { id: 'util-initial-read', description: 'Read the target file source', acceptedKinds: ['source-range'], requiredTools: ['read_file'], minimumCount: 1 },
+        { id: 'util-cross-file-flow', description: 'Trace data flow to sensitive sinks', acceptedKinds: ['cross-file-flow'], requiredTools: ['trace_flow_cross_file', 'trace_flow'], minimumCount: 1, acceptsNegative: true },
+        { id: 'util-tests-found', description: 'Find tests for the utility', acceptedKinds: ['test-location'], requiredTools: ['find_tests'], minimumCount: 1, acceptsNegative: true },
+        { id: 'util-threat-model', description: 'Establish threat model: is the attacker in scope for this code path?', acceptedKinds: ['threat-model-result', 'config-result'], requiredTools: ['read_config', 'search_code'], minimumCount: 1, acceptsNegative: true },
+    ],
+};
+/**
+ * Select an investigation profile based on the target file path and context.
+ *
+ * Heuristics:
+ *   - File path contains "ws", "websocket", "rpc", "socket" → WebSocket RPC
+ *   - File path contains "auth", "login", "token", "session", "credential" → Auth Service
+ *   - Architecture context mentions "endpoint", "route", "handler", "express", "fastify" → HTTP Route
+ *   - Otherwise → Generic Utility
+ */
+function selectInvestigationProfile(input) {
+    const filePathLower = (input.filePath || '').toLowerCase();
+    const archContextRaw = input.architectureContext;
+    const archContext = (typeof archContextRaw === 'string' ? archContextRaw : '').toLowerCase();
+    const endpointContextRaw = input.endpointContext;
+    const endpointContext = (typeof endpointContextRaw === 'string' ? endpointContextRaw : '').toLowerCase();
+    // WebSocket RPC detection
+    if (/(ws|websocket|rpc|socket|wss)/i.test(filePathLower) ||
+        /websocket|rpc\s+method|socket\.io/i.test(archContext)) {
+        return exports.WEBSOCKET_RPC_PROFILE;
+    }
+    // Authentication service detection
+    if (/(auth|login|token|session|credential|password|jwt|oauth)/i.test(filePathLower) ||
+        /auth.*service|token.*issue|credential.*lifecycle/i.test(archContext)) {
+        return exports.AUTH_SERVICE_PROFILE;
+    }
+    // HTTP route detection — check if the file is referenced in endpoint context
+    // or the architecture context mentions routes/endpoints
+    if (endpointContext.includes(input.filePath.toLowerCase()) ||
+        /\b(endpoint|route|handler|express|fastify|router|app\.(get|post|put|delete|patch))\b/i.test(archContext) ||
+        /\b(route|controller|handler|middleware)s?\b/i.test(filePathLower)) {
+        return exports.HTTP_ROUTE_PROFILE;
+    }
+    // Default: generic utility
+    return exports.GENERIC_UTILITY_PROFILE;
+}
+//# sourceMappingURL=investigationProfiles.js.map

package/dist/attack/investigationProfiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"investigationProfiles.js","sourceRoot":"","sources":["../../src/attack/investigationProfiles.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AA8HH,gEA6BC;AA/IY,QAAA,kBAAkB,GAAyB;IACpD,IAAI,EAAE,YAAY;IAClB,aAAa,EAAE;QACX,cAAc;QACd,iBAAiB;QACjB,cAAc;QACd,oBAAoB;QACpB,iBAAiB;QACjB,mBAAmB;QACnB,uBAAuB;QACvB,qBAAqB;KACxB;IACD,WAAW,EAAE,kKAAkK;IAC/K,YAAY,EAAE;QACV,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,6BAA6B,EAAE,aAAa,EAAE,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QACvJ,EAAE,EAAE,EAAE,sBAAsB,EAAE,WAAW,EAAE,2BAA2B,EAAE,aAAa,EAAE,CAAC,mBAAmB,CAAC,EAAE,aAAa,EAAE,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QACjK,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,gCAAgC,EAAE,aAAa,EAAE,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QAC9J,EAAE,EAAE,EAAE,kBAAkB,EAAE,WAAW,EAAE,6BAA6B,EAAE,aAAa,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QACjL,EAAE,EAAE,EAAE,sBAAsB,EAAE,WAAW,EAAE,4BAA4B,EAAE,aAAa,EAAE,CAAC,iBAAiB,CAAC,EAAE,aAAa,EAAE,CAAC,uBAAuB,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QACtL,EAAE,EAAE,EAAE,wBAAwB,EAAE,WAAW,EAAE,gCAAgC,EAAE,aAAa,EAAE,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QACzL,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,gCAAgC,EAAE,aAAa,EAAE,CAAC,mBAAmB,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QACjI,EAAE,EAAE,EAAE,kBAAkB,EAAE,WAAW,EAAE,gEAAgE,EAAE,aAAa,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QACnP,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,iDAAiD,EAAE,aAAa,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QACnO,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,qEAAqE,EAAE,aAAa,EAAE,CAAC,qBAAqB,EAAE,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QAC/P,EAAE,EAAE,EAAE,0BAA0B,EAAE,WAAW,EAAE,sFAAsF,EAAE,aAAa,EAAE,CAAC,qBAAqB,EAAE,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;KAC1R;CACJ,CAAC;AAEW,QAAA,qBAAqB,GAAyB;IACvD,IAAI,EAAE,eAAe;IACrB,aAAa,EAAE;QACX,cAAc;QACd,iBAAiB;QACjB,oBAAoB;QACpB,oBAAoB;QACpB,iBAAiB;QACjB,mBAAmB;QACnB,uBAAuB;QACvB,qBAAqB;KACxB;IACD,WAAW,EAAE,oKAAoK;IACjL,YAAY,EAAE;QACV,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,6BAA6B,EAAE,aAAa,EAAE,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QACrJ,EAAE,EAAE,EAAE,qBAAqB,EAAE,WAAW,EAAE,uBAAuB,EAAE,aAAa,EAAE,CAAC,mBAAmB,CAAC,EAAE,aAAa,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QAC3K,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,6BAA6B,EAAE,aAAa,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QAC/K,EAAE,EAAE,EAAE,uBAAuB,EAAE,WAAW,EAAE,sCAAsC,EAAE,aAAa,EAAE,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,EAAE,aAAa,EAAE,CAAC,uBAAuB,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QACtN,EAAE,EAAE,EAAE,oBAAoB,EAAE,WAAW,EAAE,4BAA4B,EAAE,aAAa,EAAE,CAAC,iBAAiB,CAAC,EAAE,aAAa,EAAE,CAAC,uBAAuB,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QACtK,EAAE,EAAE,EAAE,sBAAsB,EAAE,WAAW,EAAE,gCAAgC,EAAE,aAAa,EAAE,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QACvL,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,wBAAwB,EAAE,aAAa,EAAE,CAAC,mBAAmB,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QACvH,EAAE,EAAE,EAAE,qBAAqB,EAAE,WAAW,EAAE,yDAAyD,EAAE,aAAa,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QAC/O,EAAE,EAAE,EAAE,kBAAkB,EAAE,WAAW,EAAE,gEAAgE,EAAE,aAAa,EAAE,CAAC,iBAAiB,EAAE,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC,uBAAuB,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QAC7P,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,iGAAiG,EAAE,aAAa,EAAE,CAAC,qBAAqB,EAAE,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QACzR,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,oIAAoI,EAAE,aAAa,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,EAAE,aAAa,EAAE,CAAC,uBAAuB,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;KAC1U;CACJ,CAAC;AAEW,QAAA,oBAAoB,GAAyB;IACtD,IAAI,EAAE,cAAc;IACpB,aAAa,EAAE;QACX,cAAc;QACd,oBAAoB;QACpB,iBAAiB;QACjB,mBAAmB;QACnB,aAAa;QACb,uBAAuB;QACvB,qBAAqB;KACxB;IACD,WAAW,EAAE,0LAA0L;IACvM,YAAY,EAAE;QACV,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,6BAA6B,EAAE,aAAa,EAAE,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QACvJ,EAAE,EAAE,EAAE,oBAAoB,EAAE,WAAW,EAAE,gCAAgC,EAAE,aAAa,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QACtL,EAAE,EAAE,EAAE,sBAAsB,EAAE,WAAW,EAAE,oCAAoC,EAAE,aAAa,EAAE,CAAC,iBAAiB,CAAC,EAAE,aAAa,EAAE,CAAC,uBAAuB,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QAChL,EAAE,EAAE,EAAE,wBAAwB,EAAE,WAAW,EAAE,4BAA4B,EAAE,aAAa,EAAE,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QACrL,EAAE,EAAE,EAAE,kBAAkB,EAAE,WAAW,EAAE,0BAA0B,EAAE,aAAa,EAAE,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QAC5K,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,4BAA4B,EAAE,aAAa,EAAE,CAAC,mBAAmB,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QAC7H,EAAE,EAAE,EAAE,2BAA2B,EAAE,WAAW,EAAE,6DAA6D,EAAE,aAAa,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,EAAE,uBAAuB,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QACpQ,EAAE,EAAE,EAAE,sBAAsB,EAAE,WAAW,EAAE,yCAAyC,EAAE,aAAa,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QAChO,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,qEAAqE,EAAE,aAAa,EAAE,CAAC,qBAAqB,EAAE,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QAC/P,EAAE,EAAE,EAAE,0BAA0B,EAAE,WAAW,EAAE,oFAAoF,EAAE,aAAa,EAAE,CAAC,qBAAqB,EAAE,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;KACxR;CACJ,CAAC;AAEW,QAAA,uBAAuB,GAAyB;IACzD,IAAI,EAAE,iBAAiB;IACvB,aAAa,EAAE;QACX,cAAc;QACd,iBAAiB;QACjB,aAAa;QACb,qBAAqB;KACxB;IACD,WAAW,EAAE,uHAAuH;IACpI,YAAY,EAAE;QACV,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,6BAA6B,EAAE,aAAa,EAAE,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;QACvJ,EAAE,EAAE,EAAE,sBAAsB,EAAE,WAAW,EAAE,oCAAoC,EAAE,aAAa,EAAE,CAAC,iBAAiB,CAAC,EAAE,aAAa,EAAE,CAAC,uBAAuB,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QACrN,EAAE,EAAE,EAAE,kBAAkB,EAAE,WAAW,EAAE,4BAA4B,EAAE,aAAa,EAAE,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QAC9K,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,sEAAsE,EAAE,aAAa,EAAE,CAAC,qBAAqB,EAAE,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;KACnQ;CACJ,CAAC;AAQF;;;;;;;;GAQG;AACH,SAAgB,0BAA0B,CAAC,KAA4B;IACnE,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,mBAAmB,CAAC;IACjD,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7F,MAAM,kBAAkB,GAAG,KAAK,CAAC,eAAe,CAAC;IACjD,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAEzG,0BAA0B;IAC1B,IAAI,gCAAgC,CAAC,IAAI,CAAC,aAAa,CAAC;QACpD,oCAAoC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACzD,OAAO,6BAAqB,CAAC;IACjC,CAAC;IAED,mCAAmC;IACnC,IAAI,2DAA2D,CAAC,IAAI,CAAC,aAAa,CAAC;QAC/E,mDAAmD,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,OAAO,4BAAoB,CAAC;IAChC,CAAC;IAED,6EAA6E;IAC7E,wDAAwD;IACxD,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtD,uFAAuF,CAAC,IAAI,CAAC,WAAW,CAAC;QACzG,8CAA8C,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACrE,OAAO,0BAAkB,CAAC;IAC9B,CAAC;IAED,2BAA2B;IAC3B,OAAO,+BAAuB,CAAC;AACnC,CAAC"}