@sikkuumiii/defuse 0.0.0-stage → 0.5.0

package/dist/src/taint/project.js

@@ -0,0 +1,617 @@
+/**
+ * THE PROJECT INDEX  (cross-file resolution)
+ * ==========================================
+ *
+ * Up to now the tracer could follow a value anywhere inside one file and no
+ * further. `helper(dirty)` where `helper` lives in `./helpers.js` was the end of
+ * the road, and on real code that is where most of the road is: applications put
+ * their database access in `db.js`, their escaping in `util/html.py`, their
+ * command runners in `Shell.java`.
+ *
+ * This module answers one question: **"file F calls a function named N - which
+ * file, if any, is that?"**
+ *
+ * THE RULE IT PLAYS BY: answer only when the answer is unambiguous.
+ *
+ * If two imported modules both define `sanitize`, we say nothing and record
+ * that we declined. Picking one at random would let the tool print a
+ * step-by-step "proof" through a function that never runs - which is worse than
+ * printing nothing, because it looks like evidence. The count of declined
+ * resolutions is reported in every scan.
+ *
+ * HOW IMPORTS ARE FOUND, per language:
+ *
+ *   JS/TS   `import x from './a'` and `require('./a')`, resolved relative to the
+ *           importing file, trying the usual extensions and `/index`.
+ *   Python  `from .a import x`, `from pkg.a import x`, `import pkg.a` - resolved
+ *           against the files actually present in the scan.
+ *   Java    `import com.x.Bar;` resolves to a file named `Bar.java`, PLUS every
+ *           file in the same directory, because Java classes in the same
+ *           package see each other with no import at all.
+ *   Go      every file in the same directory, because that is one package. Go
+ *           imports name packages rather than files, and resolving those needs
+ *           module metadata we do not read.
+ *
+ * WHAT IT DOES NOT DO, stated here and in the scan report:
+ *   - It does not check that the function is actually EXPORTED. A module-private
+ *     helper with the same name as an exported one could be entered.
+ *   - It does not follow re-exports (`export * from './a'`).
+ *   - It does not resolve node_modules, third-party packages, or aliases from
+ *     tsconfig `paths` / webpack config.
+ *   - Dynamic imports and computed requires are invisible.
+ */
+import { basenameOf, dirnameOf, joinPath, resolveFrom, toPosix } from '../core/paths.js';
+import { nodeAtRange } from '../parse/tree-store.js';
+import { collectFunctions } from './tracer.js';
+import { hasModifier } from './java-scope.js';
+const JAVA_TYPE_DECLARATIONS = new Set([
+    'class_declaration', 'interface_declaration', 'enum_declaration', 'record_declaration',
+    'annotation_type_declaration',
+]);
+export function javaTypeFacts(root) {
+    /*
+     * A dotted name read from its identifiers, not its text - so a comment
+     * between `import` and the name is not part of the name. A regex over the
+     * line missed such an import entirely, and the class it named lost to one in
+     * the same package that the import outranks (tests/probes/p08).
+     */
+    const dotted = (n) => {
+        const parts = [];
+        const visit = (x) => {
+            if (x.type === 'identifier')
+                parts.push(x.text ?? '');
+            for (const c of x.namedChildren)
+                if (c && c.type !== 'block_comment' && c.type !== 'line_comment')
+                    visit(c);
+        };
+        if (n)
+            visit(n);
+        return parts.join('.');
+    };
+    let packageName = '';
+    const types = [];
+    const singleTypeImports = [];
+    const staticImports = [];
+    let staticOnDemand = false;
+    for (const child of root.namedChildren) {
+        if (!child)
+            continue;
+        if (child.type === 'package_declaration') {
+            packageName = dotted(child.namedChildren.find((c) => c?.type === 'scoped_identifier' || c?.type === 'identifier'));
+        }
+        else if (JAVA_TYPE_DECLARATIONS.has(child.type)) {
+            const name = child.childForFieldName('name')?.text;
+            if (name)
+                types.push({ name, kind: child.type });
+        }
+        else if (child.type === 'import_declaration') {
+            const isStatic = child.children.some((c) => c?.type === 'static');
+            const onDemand = child.namedChildren.some((c) => c?.type === 'asterisk');
+            const name = dotted(child.namedChildren.find((c) => c?.type === 'scoped_identifier' || c?.type === 'identifier'));
+            if (isStatic && onDemand)
+                staticOnDemand = true;
+            else if (isStatic)
+                staticImports.push(name.split('.').pop() ?? '');
+            else if (!onDemand && name)
+                singleTypeImports.push(name);
+        }
+    }
+    /*
+     * Nested types count for "is this type in the scan?": a superclass that is
+     * a nested class of this or another file is as able to supply members as a
+     * top-level one (tests/probes/j05, j06).
+     */
+    const allTypeNames = root
+        .descendantsOfType([...JAVA_TYPE_DECLARATIONS])
+        .map((n) => n?.childForFieldName('name')?.text ?? '')
+        .filter(Boolean);
+    return { packageName, types, singleTypeImports, staticImports, staticOnDemand, allTypeNames };
+}
+/** Turn a file's functions into coordinates, using the tracer's own definition. */
+export function indexFunctions(root, language) {
+    const indexed = new Map();
+    for (const [name, fn] of collectFunctions(root, language)) {
+        indexed.set(name, {
+            name: fn.name,
+            params: fn.params,
+            minArgs: fn.minArgs,
+            maxArgs: fn.maxArgs,
+            bodyStart: fn.body.startIndex,
+            bodyEnd: fn.body.endIndex,
+            bodyType: fn.body.type,
+        });
+    }
+    return indexed;
+}
+/* -------------------------------------------------------------------------- *
+ * Import extraction - from the syntax tree, not from a text search, for the
+ * same reason the rules use the tree: a `require('./db')` inside a comment or a
+ * string is not an import.
+ * -------------------------------------------------------------------------- */
+const IMPORT_NODES = {
+    javascript: ['import_statement', 'call_expression'],
+    typescript: ['import_statement', 'call_expression'],
+    python: ['import_statement', 'import_from_statement'],
+    /*
+     * `scoped_type_identifier` is here because an import statement is not the
+     * only way Java names another file.
+     *
+     *     new org.owasp.benchmark.helpers.SeparateClassRequest(request)
+     *
+     * names a class as precisely as any import does and produces no
+     * import_declaration at all, so the edge was never built and the call was
+     * never followed.
+     *
+     * This was not a corner. It was EVERY ONE of the 69 cases the OWASP
+     * benchmark scored as a complete miss - 48 xss, 20 cmdi, 1 sqli, all of them
+     * a request wrapped in a helper class referenced by its full name. Proven by
+     * adding a single import line to one test case and changing nothing else,
+     * which turned a silent file into a finding.
+     *
+     * A complete miss is the only failure mode that gets somebody hacked, and
+     * this one was a hundred percent of ours.
+     */
+    java: ['import_declaration', 'scoped_type_identifier'],
+    go: [],
+    // PHP's require/include are function-like statements, and Composer autoloading
+    // resolves classes with no import line at all. Cross-file tracing in PHP is
+    // therefore NOT implemented - stated here rather than half-attempted.
+    php: [],
+    /*
+     * C and C++ resolve calls at LINK time, not through anything written in the
+     * source, and that is a harder problem than it first looks.
+     *
+     * `#include` brings in DECLARATIONS, not definitions - the body of the
+     * function lives in a .c file the header never names, chosen by a Makefile
+     * we do not read. So following an include would lead to a prototype and stop.
+     *
+     * Same-directory resolution, which is what makes Java and Go work above, is
+     * actively unsafe here: `static` gives a C function FILE scope, and every
+     * large C project has a dozen different `static int init(void)` definitions
+     * sitting in the same folder. Matching by name would let the tracer walk into
+     * a function the caller provably cannot see, and print a step-by-step proof
+     * through it. That is the exact failure this project exists to refuse, so
+     * cross-file tracing in the C family is NOT implemented and says so.
+     */
+    c: [],
+    cpp: [],
+};
+function unquote(raw) {
+    return raw.replace(/^[a-zA-Z]?["'`]/, '').replace(/["'`]$/, '');
+}
+/** The raw module specifiers this file mentions, e.g. "./db", "app.helpers". */
+export function importSpecifiers(root, language) {
+    const wanted = new Set(IMPORT_NODES[language]);
+    if (wanted.size === 0)
+        return [];
+    const specifiers = [];
+    /*
+     * Six levels is enough for every language whose edges are declarations at
+     * the top of the file. Java's are not: a fully-qualified type reference sits
+     * inside a method body, which is twenty-odd levels down, so the walk stopped
+     * short of the very thing it needed to see.
+     *
+     * 48 is past any hand-written nesting and still far under the tracer's own
+     * MAX_AST_DEPTH of 400, and it applies only to Java - nothing else pays for
+     * it.
+     */
+    const maxDepth = language === 'java' ? 48 : 6;
+    const visit = (node, depth) => {
+        if (depth > maxDepth)
+            return;
+        if (wanted.has(node.type)) {
+            if (node.type === 'scoped_type_identifier') {
+                /*
+                 * `a.b.C` parses as scoped_type_identifier nested inside
+                 * scoped_type_identifier: the whole name, then `a.b`, then `a`. Only
+                 * the outermost is the class being named; the inner ones are package
+                 * fragments and would each try to resolve as a class of their own.
+                 *
+                 * The resolver below already requires exactly one file to match the
+                 * final segment, so a fragment that matches nothing is harmless and a
+                 * name that matches two files is declined rather than guessed. This
+                 * check is about not asking the question, rather than about surviving
+                 * the answer.
+                 */
+                if (node.parent?.type !== 'scoped_type_identifier') {
+                    specifiers.push((node.text ?? '').trim());
+                }
+            }
+            else if (node.type === 'call_expression') {
+                // require('./db') - only when the callee really is `require`.
+                const callee = node.childForFieldName('function');
+                if (callee?.text === 'require') {
+                    const args = node.childForFieldName('arguments');
+                    const first = args?.namedChildren.find((c) => c !== null);
+                    if (first)
+                        specifiers.push(unquote(first.text ?? ''));
+                }
+            }
+            else if (node.type === 'import_from_statement' &&
+                /^\.+$/.test(node.childForFieldName('module_name')?.text ?? '')) {
+                /*
+                 * `from . import runner, shell` names no module in the `from` part: the
+                 * imported NAMES are the modules (runner.py, shell/__init__.py). Read
+                 * as just ".", it resolved to the package folder and never to a file -
+                 * so every edge in a package written this way was lost. One specifier
+                 * per name, `.runner`, resolves them like `from .runner import x`.
+                 * ponytail: a name defined in the package's own __init__.py rather than
+                 * a module of that name stays unresolved; add a fallback when it shows.
+                 */
+                const dots = node.childForFieldName('module_name')?.text ?? '.';
+                const names = node.childrenForFieldName('name').filter((n) => n !== null);
+                if (names.length === 0)
+                    specifiers.push(dots); // `from . import *`: the package itself
+                for (const name of names) {
+                    const module = name.type === 'aliased_import' ? name.childForFieldName('name') : name;
+                    if (module?.text)
+                        specifiers.push(`${dots}${module.text}`);
+                }
+            }
+            else {
+                const source = node.childForFieldName('source') ??
+                    node.childForFieldName('module_name') ??
+                    node.childForFieldName('name') ??
+                    null;
+                const raw = (source ?? node).text ?? '';
+                specifiers.push(unquote(raw.replace(/^import\s+|;$/g, '').trim()));
+            }
+        }
+        for (const child of node.namedChildren)
+            if (child)
+                visit(child, depth + 1);
+    };
+    visit(root, 0);
+    return specifiers.filter(Boolean);
+}
+const JS_EXTENSIONS = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts'];
+/** Turn a specifier into a path we actually have, or null. */
+/*
+ * Every known path by its file name, built once per scan. Java resolves each
+ * `a.b.C` by looking for C.java, and BenchmarkJava names a class in full
+ * thousands of times - filtering all 2,766 paths for every one of those was
+ * the single largest cost in its scan.
+ */
+const basenameIndex = new WeakMap();
+function byBasename(known) {
+    let index = basenameIndex.get(known);
+    if (!index) {
+        index = new Map();
+        for (const p of known) {
+            const name = basenameOf(p);
+            const list = index.get(name);
+            if (list)
+                list.push(p);
+            else
+                index.set(name, [p]);
+        }
+        basenameIndex.set(known, index);
+    }
+    return index;
+}
+function resolveSpecifier(specifier, fromFile, known) {
+    const tryAll = (base) => {
+        if (known.has(base))
+            return base;
+        /**
+         * TypeScript's ESM convention: source says `import './languages.js'` but the
+         * file on disk is `languages.ts`. The compiler rewrites nothing, so a
+         * resolver that only tries the literal specifier finds nothing - which is
+         * exactly what happened the first time Defuse scanned its own source and
+         * reported zero import edges.
+         */
+        const rewritten = base.replace(/\.(js|mjs|cjs)$/, '');
+        if (rewritten !== base) {
+            for (const extension of JS_EXTENSIONS) {
+                if (known.has(rewritten + extension))
+                    return rewritten + extension;
+            }
+        }
+        for (const extension of JS_EXTENSIONS) {
+            if (known.has(base + extension))
+                return base + extension;
+            if (known.has(joinPath(base, `index${extension}`))) {
+                return joinPath(base, `index${extension}`);
+            }
+        }
+        return null;
+    };
+    if (fromFile.language === 'javascript' || fromFile.language === 'typescript') {
+        // Only relative specifiers. A bare 'express' is a package, not our code.
+        if (!specifier.startsWith('.'))
+            return null;
+        return tryAll(resolveFrom(fromFile.directory, specifier));
+    }
+    if (fromFile.language === 'python') {
+        const leadingDots = /^\.+/.exec(specifier)?.[0].length ?? 0;
+        const body = specifier.slice(leadingDots).replace(/\./g, '/');
+        // A module is a file (`shell.py`) or a package folder (`shell/__init__.py`).
+        if (leadingDots > 0) {
+            let base = fromFile.directory;
+            for (let i = 1; i < leadingDots; i++)
+                base = dirnameOf(base);
+            const candidate = body ? joinPath(base, body) : base;
+            if (body && known.has(`${candidate}.py`))
+                return `${candidate}.py`;
+            return known.has(`${candidate}/__init__.py`) ? `${candidate}/__init__.py` : null;
+        }
+        // Absolute-ish: match any known file whose path ends with the module path.
+        const asFile = `${body}.py`;
+        const asPackage = `${body}/__init__.py`;
+        const matches = [...known].filter((p) => p === asFile || p === asPackage || p.endsWith(`/${asFile}`) || p.endsWith(`/${asPackage}`));
+        return matches.length === 1 ? (matches[0] ?? null) : null;
+    }
+    if (fromFile.language === 'java') {
+        // `com.example.Helper` -> a file called Helper.java, if there is exactly one.
+        const className = specifier.split('.').pop() ?? '';
+        if (!className || className === '*')
+            return null;
+        const matches = byBasename(known).get(`${className}.java`) ?? [];
+        return matches.length === 1 ? (matches[0] ?? null) : null;
+    }
+    return null;
+}
+/**
+ * @param files  one record per scanned file, with functions and import
+ *               specifiers ALREADY extracted from its tree.
+ * @param store  where trees come from. Only touched when a resolution actually
+ *               succeeds, which on real projects is a small fraction of files -
+ *               the index itself is built without a single tree in hand.
+ */
+export function buildProjectIndex(files, store) {
+    const byPath = new Map();
+    // Resolution happens in normalised space; lookups map back to the original.
+    const known = new Set(files.map((f) => toPosix(f.path)));
+    const originalOf = new Map(files.map((f) => [toPosix(f.path), f.path]));
+    for (const file of files) {
+        byPath.set(file.path, {
+            path: file.path,
+            posix: toPosix(file.path),
+            directory: dirnameOf(file.path),
+            language: file.language,
+            functions: file.functions,
+            imports: new Set(),
+            javaTypes: file.javaTypes,
+        });
+    }
+    // Second pass: resolve specifiers now that every path is known.
+    let importEdges = 0;
+    let importsUnresolved = 0;
+    for (const file of files) {
+        const entry = byPath.get(file.path);
+        if (!entry)
+            continue;
+        for (const specifier of file.importSpecifiers) {
+            const resolvedPosix = resolveSpecifier(specifier, entry, known);
+            const resolved = resolvedPosix ? originalOf.get(resolvedPosix) : undefined;
+            if (resolved && resolved !== file.path) {
+                entry.imports.add(resolved);
+                importEdges++;
+            }
+            else if (!/^[a-z@][\w@/.-]*$/i.test(specifier) || specifier.startsWith('.')) {
+                // A RELATIVE import that resolved to nothing means the file it names is
+                // outside the scan. A bare specifier (`express`, `@angular/core`) is a
+                // package and is expected not to resolve - counting those would drown
+                // the real signal in node_modules noise.
+                importsUnresolved++;
+            }
+        }
+    }
+    // Same-package visibility: Java and Go files in one directory see each other
+    // with no import statement at all, so the directory IS the import edge.
+    const byDirectory = new Map();
+    for (const entry of byPath.values()) {
+        if (entry.language !== 'java' && entry.language !== 'go')
+            continue;
+        const list = byDirectory.get(entry.directory) ?? [];
+        list.push(entry.path);
+        byDirectory.set(entry.directory, list);
+    }
+    /**
+     * Function name -> the files that define it.
+     *
+     * The first version of resolve() walked every sibling file in the directory
+     * looking for the name. That is fine for a normal package and catastrophic
+     * for OWASP's benchmark, which puts 2,766 Java files in ONE directory: every
+     * unresolved call scanned all 2,766 siblings, and a 12-second scan became 60.
+     *
+     * Indexing by name first turns that inner loop from "all files in the
+     * package" into "the handful of files that define this exact name".
+     */
+    const byFunctionName = new Map();
+    for (const entry of byPath.values()) {
+        for (const name of entry.functions.keys()) {
+            const list = byFunctionName.get(name);
+            if (list)
+                list.push(entry);
+            else
+                byFunctionName.set(name, [entry]);
+        }
+    }
+    /** Every Java type name declared in the scan, of every kind, nested ones included. */
+    const typeNames = new Set();
+    for (const entry of byPath.values())
+        for (const t of entry.javaTypes?.allTypeNames ?? [])
+            typeNames.add(t);
+    let resolved = 0;
+    let ambiguous = 0;
+    let relocationsFailed = 0;
+    let functionsIndexed = 0;
+    for (const entry of byPath.values())
+        functionsIndexed += entry.functions.size;
+    return {
+        resolve(fromPath, name) {
+            const from = byPath.get(fromPath);
+            if (!from)
+                return null;
+            // Start from "who defines this name at all", then keep only the ones
+            // this file can actually see.
+            const definers = byFunctionName.get(name);
+            if (!definers)
+                return null;
+            const samePackage = from.language === 'java' || from.language === 'go';
+            const hits = definers.filter((candidate) => candidate.path !== fromPath &&
+                candidate.language === from.language &&
+                (from.imports.has(candidate.path) ||
+                    (samePackage && candidate.directory === from.directory)));
+            if (hits.length === 0)
+                return null;
+            if (hits.length > 1) {
+                ambiguous++;
+                return null; // several files define it - we do not guess.
+            }
+            const winner = hits[0];
+            const indexed = winner?.functions.get(name);
+            if (!winner || !indexed)
+                return null;
+            /* ---- materialise: coordinates back into a live syntax node ----
+             *
+             * This is the only place in the scan that can pull a tree back off disk,
+             * and it is deliberately the LAST thing that happens - after the file has
+             * been chosen and the ambiguity check has passed. Resolving first and
+             * parsing second means a project with thousands of files that never
+             * resolve into each other never re-parses anything.
+             *
+             * The pin lasts until the caller releases it, because the Node handed
+             * back here points into this tree's memory and nothing else keeps it
+             * alive.                                                               */
+            store.pin(winner.path);
+            const tree = store.get(winner.path);
+            const body = nodeAtRange(tree.rootNode, indexed.bodyStart, indexed.bodyEnd, indexed.bodyType);
+            if (!body) {
+                relocationsFailed++;
+                return null;
+            }
+            resolved++;
+            return {
+                path: winner.path,
+                fn: { name: indexed.name, params: indexed.params, minArgs: indexed.minArgs, maxArgs: indexed.maxArgs, body },
+            };
+        },
+        /*
+         * `Utils.getOSCommandString("echo")` - A STATIC CALL, NAMED THROUGH ITS CLASS.
+         *
+         * resolve() above answers by function NAME, which is right for the tracer:
+         * it only ever follows taint INTO a function, and entering the wrong one
+         * can at worst report a flow that looks odd. The constant proof asks the
+         * opposite question - "is what comes back fixed?" - and a wrong answer
+         * there deletes a finding. So this answers only when Java itself leaves no
+         * choice:
+         *
+         *   - the receiver names a class: `a.b.Utils` by its full name - where
+         *     `a` must look like a package and not a type - or `Utils` through a
+         *     single-type import or, failing that, the caller's own package. An
+         *     import-on-demand (`import a.b.*;`) is not followed;
+         *   - exactly ONE file in the scan declares that package and a top-level
+         *     class of that name - two copies is two candidates, and neither wins;
+         *   - that class declares exactly one method of the name, and it is
+         *     static. An overload is chosen by argument types, which nobody here
+         *     reads; an inherited method lives in a class this does not look for.
+         *
+         * The caller's side - a local variable named `Utils` hides the class - is
+         * checked where the call is, in rules/lib/strings.ts.
+         */
+        staticMethod(fromPath, receiver, methodName, supertypes = [], allowInstance = false) {
+            const from = byPath.get(fromPath);
+            const facts = from?.javaTypes;
+            if (!from || from.language !== 'java' || !facts)
+                return null;
+            const dotted = receiver.replace(/\s+/g, '');
+            if (!/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/.test(dotted))
+                return null;
+            const segments = dotted.split('.');
+            const first = segments[0] ?? '';
+            const className = segments[segments.length - 1] ?? '';
+            /*
+             * Names that reach this file without a declaration in it: a static import
+             * of a member called `first` (a nested type or a field - tests/probes/p04,
+             * p05), any `import static a.b.C.*;`, and members inherited from a
+             * supertype declared in the scan (p06). Each could be what `first` means.
+             * A supertype from OUTSIDE the scan - HttpServlet, say - is not read; the
+             * SQL rule's limitations say so.
+             */
+            if (facts.staticOnDemand || facts.staticImports.includes(first))
+                return null;
+            if (supertypes.some((t) => t.split('.').some((part) => typeNames.has(part))))
+                return null;
+            let packageName;
+            if (segments.length > 1) {
+                /*
+                 * `Wrapper.Inner` is a package Wrapper's class Inner ONLY if no type
+                 * called Wrapper is in scope - a type outranks a package (JLS 6.5.2),
+                 * and then Inner is Wrapper's nested class. Types in scope include
+                 * library ones this scan never sees, so the first segment must look
+                 * like a package: not capitalised (the convention every package
+                 * follows), not a type of ANY kind anywhere in the scan (an interface
+                 * called `app` - p07), not imported by name.
+                 */
+                if (/^[A-Z]/.test(first) ||
+                    typeNames.has(first) ||
+                    facts.singleTypeImports.some((i) => i === first || i.endsWith(`.${first}`))) {
+                    return null;
+                }
+                packageName = segments.slice(0, -1).join('.');
+            }
+            else {
+                const imported = facts.singleTypeImports.filter((i) => i.endsWith(`.${className}`));
+                if (imported.length > 1)
+                    return null;
+                packageName = imported[0]
+                    ? imported[0].slice(0, imported[0].length - className.length - 1)
+                    : facts.packageName;
+            }
+            // Every kind of type counts as a candidate: a class and an interface
+            // with one full name are two candidates, and neither wins (p09).
+            const hits = [...byPath.values()].filter((f) => f.language === 'java' &&
+                f.javaTypes?.packageName === packageName &&
+                f.javaTypes.types.some((t) => t.name === className));
+            if (hits.length !== 1 || !hits[0])
+                return null;
+            const winner = hits[0];
+            const declared = winner.javaTypes?.types.filter((t) => t.name === className) ?? [];
+            if (declared.length !== 1 || declared[0]?.kind !== 'class_declaration')
+                return null;
+            store.pin(winner.path);
+            const root = store.get(winner.path).rootNode;
+            const klass = root.namedChildren.find((c) => c?.type === 'class_declaration' && c.childForFieldName('name')?.text === className);
+            if (!klass) {
+                relocationsFailed++;
+                return null;
+            }
+            /*
+             * A class that inherits from anything can inherit a method of this name
+             * - a more specific overload, or the only one that takes this many
+             * arguments - and that is the one that runs (p01, p02, p03).
+             */
+            if (klass.childForFieldName('superclass'))
+                return null;
+            // An instance method can also come from an interface's default method.
+            if (allowInstance && klass.childForFieldName('interfaces'))
+                return null;
+            const methods = (klass.childForFieldName('body')?.namedChildren ?? []).filter((m) => m?.type === 'method_declaration' && m.childForFieldName('name')?.text === methodName);
+            const method = methods.length === 1 ? methods[0] : undefined;
+            // Static - or, when the caller holds a `new X(...)` and so knows the
+            // object is exactly an X, an instance method (strings.ts, heldCreation).
+            if (!method || (!allowInstance && !hasModifier(method, 'static')))
+                return null;
+            // A private method cannot be called from another class at all.
+            if (winner.path !== fromPath && hasModifier(method, 'private'))
+                return null;
+            return { path: winner.path, method };
+        },
+        javaTypeInScan: (simpleName) => typeNames.has(simpleName),
+        noteAmbiguous() {
+            ambiguous++;
+        },
+        stats: () => ({
+            filesIndexed: byPath.size,
+            functionsIndexed,
+            importEdges,
+            importsUnresolved,
+            resolved,
+            ambiguous,
+            relocationsFailed,
+        }),
+    };
+}
+//# sourceMappingURL=project.js.map

package/dist/src/taint/project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../../../src/taint/project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,EAAE,WAAW,EAAkB,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAA0B,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA8D9C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,mBAAmB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,oBAAoB;IACtF,6BAA6B;CAC9B,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,IAAU;IACtC;;;;;OAKG;IACH,MAAM,MAAM,GAAG,CAAC,CAA0B,EAAU,EAAE;QACpD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,CAAC,CAAO,EAAQ,EAAE;YAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACtD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;oBAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9G,CAAC,CAAC;QACF,IAAI,CAAC;YAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC;IACF,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACzC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,mBAAmB,IAAI,CAAC,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC;QACrH,CAAC;aAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;YACnD,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC;YACzE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,mBAAmB,IAAI,CAAC,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC;YAClH,IAAI,QAAQ,IAAI,QAAQ;gBAAE,cAAc,GAAG,IAAI,CAAC;iBAC3C,IAAI,QAAQ;gBAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;iBAC9D,IAAI,CAAC,QAAQ,IAAI,IAAI;gBAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD;;;;OAIG;IACH,MAAM,YAAY,GAAG,IAAI;SACtB,iBAAiB,CAAC,CAAC,GAAG,sBAAsB,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;SACpD,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AAChG,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAC5B,IAAU,EACV,QAAoB;IAEpB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;YAChB,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU;YAC7B,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ;YACzB,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAuED;;;;gFAIgF;AAEhF,MAAM,YAAY,GAA0C;IAC1D,UAAU,EAAE,CAAC,kBAAkB,EAAE,iBAAiB,CAAC;IACnD,UAAU,EAAE,CAAC,kBAAkB,EAAE,iBAAiB,CAAC;IACnD,MAAM,EAAE,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,EAAE,CAAC,oBAAoB,EAAE,wBAAwB,CAAC;IACtD,EAAE,EAAE,EAAE;IACN,+EAA+E;IAC/E,4EAA4E;IAC5E,sEAAsE;IACtE,GAAG,EAAE,EAAE;IACP;;;;;;;;;;;;;;;OAeG;IACH,CAAC,EAAE,EAAE;IACL,GAAG,EAAE,EAAE;CACR,CAAC;AAEF,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,IAAU,EAAE,QAAoB;IAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC;;;;;;;;;OASG;IACH,MAAM,QAAQ,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9C,MAAM,KAAK,GAAG,CAAC,IAAU,EAAE,KAAa,EAAQ,EAAE;QAChD,IAAI,KAAK,GAAG,QAAQ;YAAE,OAAO;QAE7B,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBAC3C;;;;;;;;;;;mBAWG;gBACH,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,wBAAwB,EAAE,CAAC;oBACnD,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBAC3C,8DAA8D;gBAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBAClD,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;oBACjD,MAAM,KAAK,GAAG,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAa,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;oBACrE,IAAI,KAAK;wBAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;iBAAM,IACL,IAAI,CAAC,IAAI,KAAK,uBAAuB;gBACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,EAC/D,CAAC;gBACD;;;;;;;;mBAQG;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,IAAI,IAAI,GAAG,CAAC;gBAChE,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAa,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;gBACrF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,wCAAwC;gBACvF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACtF,IAAI,MAAM,EAAE,IAAI;wBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GACV,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;oBAChC,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC;oBACrC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;oBAC9B,IAAI,CAAC;gBACP,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa;YAAE,IAAI,KAAK;gBAAE,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACf,OAAO,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAErF,8DAA8D;AAC9D;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,OAAO,EAA8C,CAAC;AAChF,SAAS,UAAU,CAAC,KAA0B;IAC5C,IAAI,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;gBAClB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CACvB,SAAiB,EACjB,QAAqB,EACrB,KAA0B;IAE1B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;QAC7C,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEjC;;;;;;WAMG;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;gBACtC,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;oBAAE,OAAO,SAAS,GAAG,SAAS,CAAC;YACrE,CAAC;QACH,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC;gBAAE,OAAO,IAAI,GAAG,SAAS,CAAC;YACzD,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;gBACnD,OAAO,QAAQ,CAAC,IAAI,EAAE,QAAQ,SAAS,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC7E,yEAAyE;QACzE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9D,6EAA6E;QAC7E,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE;gBAAE,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrD,IAAI,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,KAAK,CAAC;gBAAE,OAAO,GAAG,SAAS,KAAK,CAAC;YACnE,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;QACnF,CAAC;QACD,2EAA2E;QAC3E,MAAM,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC;QAC5B,MAAM,SAAS,GAAG,GAAG,IAAI,cAAc,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC,CAClG,CAAC;QACF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACjC,8EAA8E;QAC9E,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS,OAAO,CAAC,IAAI,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAkC,EAClC,KAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,4EAA4E;IAC5E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAExE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YACpB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YACzB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,GAAG,EAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9C,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,IAAI,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACvC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC5B,WAAW,EAAE,CAAC;YAChB,CAAC;iBAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9E,wEAAwE;gBACxE,uEAAuE;gBACvE,sEAAsE;gBACtE,yCAAyC;gBACzC,iBAAiB,EAAE,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;YAAE,SAAS;QACnE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAyB,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;gBACtB,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,YAAY,IAAI,EAAE;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAE3G,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE;QAAE,gBAAgB,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;IAE9E,OAAO;QACL,OAAO,CAAC,QAAgB,EAAE,IAAY;YACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,qEAAqE;YACrE,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAE3B,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;YACvE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAC1B,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,QAAQ;gBAC3B,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBACpC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;oBAC/B,CAAC,WAAW,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAC7D,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,SAAS,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,CAAC,6CAA6C;YAC5D,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,OAAO,GAAG,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAErC;;;;;;;;;;sFAU0E;YAC1E,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,WAAW,CACtB,IAAI,CAAC,QAAQ,EACb,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,iBAAiB,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,QAAQ,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE;aAC7G,CAAC;QACJ,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;WAsBG;QACH,YAAY,CACV,QAAgB,EAChB,QAAgB,EAChB,UAAkB,EAClB,aAAgC,EAAE,EAClC,aAAa,GAAG,KAAK;YAErB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,EAAE,SAAS,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,2CAA2C,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAEtD;;;;;;;eAOG;YACH,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7E,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAE1F,IAAI,WAAmB,CAAC;YACxB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB;;;;;;;;mBAQG;gBACH,IACE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;oBACpB,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;oBACpB,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,EAC3E,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;gBACpF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACrC,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC;oBACvB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;oBACjE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;YACxB,CAAC;YAED,qEAAqE;YACrE,iEAAiE;YACjE,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,MAAM;gBACrB,CAAC,CAAC,SAAS,EAAE,WAAW,KAAK,WAAW;gBACxC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CACtD,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YACnF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,mBAAmB;gBAAE,OAAO,IAAI,CAAC;YAEpF,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CACnC,CAAC,CAAC,EAAa,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,mBAAmB,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,SAAS,CACrG,CAAC;YACF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,iBAAiB,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YACD;;;;eAIG;YACH,IAAI,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvD,uEAAuE;YACvE,IAAI,aAAa,IAAI,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxE,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,CAC3E,CAAC,CAAC,EAAa,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,UAAU,CACvG,CAAC;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7D,qEAAqE;YACrE,yEAAyE;YACzE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/E,+DAA+D;YAC/D,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;QAED,cAAc,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;QAEjE,aAAa;YACX,SAAS,EAAE,CAAC;QACd,CAAC;QAED,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACZ,YAAY,EAAE,MAAM,CAAC,IAAI;YACzB,gBAAgB;YAChB,WAAW;YACX,iBAAiB;YACjB,QAAQ;YACR,SAAS;YACT,iBAAiB;SAClB,CAAC;KACH,CAAC;AACJ,CAAC"}