@sikkuumiii/defuse 0.0.0-stage → 0.5.0

package/dist/src/core/analyze.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze.js","sourceRoot":"","sources":["../../../src/core/analyze.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,mBAAmB,EAAuB,MAAM,eAAe,CAAC;AACzE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAGhB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAoC,MAAM,oBAAoB,CAAC;AACnG,OAAO,EACL,eAAe,EACf,yBAAyB,GAE1B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,aAAa,GAGd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AA8J7E;;;;GAIG;AACH,MAAM,WAAW,GAAG,kDAAkD,CAAC;AAEvE,SAAS,iBAAiB,CACxB,WAA8B,EAC9B,IAAY;IAEZ,wEAAwE;IACxE,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,aAAa,GACjB,+MAA+M,CAAC;AAClN,+EAA+E;AAC/E,+EAA+E;AAC/E,sEAAsE;AAEtE;;;;;GAKG;AACH,MAAM,cAAc,GAClB,8IAA8I,CAAC;AAEjJ,mGAAmG;AACnG,SAAS,iBAAiB,CAAC,IAAU;IACnC,0EAA0E;IAC1E,0EAA0E;IAC1E,+EAA+E;IAC/E,IAAI,EAAE,GAAgB,IAAI,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;QAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;IAC3E,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,MAAM,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;IACzE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC/F,CAAC;AAED,+EAA+E;AAC/E,SAAS,SAAS,CAAC,OAAgB;IACjC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;AACpH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAA6B,EAC7B,UAA0B,EAAE;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,8DAA8D;IAC9D,gBAAgB,EAAE,CAAC;IACnB,MAAM,UAAU,EAAE,CAAC;IAEnB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,YAAY,GAAc,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,UAAU,GAAwE,EAAE,CAAC;IAC3F,MAAM,WAAW,GAAwE,EAAE,CAAC;IAC5F,MAAM,aAAa,GAAoB,EAAE,CAAC;IAC1C,MAAM,eAAe,GAAsB,EAAE,CAAC;IAC9C,MAAM,uBAAuB,GAAsB,EAAE,CAAC;IACtD,MAAM,sBAAsB,GAAsB,EAAE,CAAC;IACrD,kFAAkF;IAClF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,+EAA+E;IAC/E,MAAM,WAAW,GAAG;QAClB,cAAc,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC;QAC5E,YAAY,EAAE,CAAC;KAChB,CAAC;IACF,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,aAAa,GAAuB,EAAE,CAAC;IAC7C,MAAM,UAAU,GAA2B,EAAE,CAAC;IAE9C,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEpF;;;;;;;;;;;;;;;;;;;;;;gFAsB4E;IAC5E,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC,CAAC;IAOpF,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,YAAY,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAE5C,0EAA0E;QAC1E,qDAAqD;QACrD,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI;YACvB,QAAQ,EAAE,UAAU;YACpB,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC;YAC3C,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC;YACpD,SAAS,EAAE,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAClE,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAEhF,WAAW,EAAE,CAAC;QACd,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,+EAA+E;IAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,YAAoB,EAAU,EAAE,CAAC,YAAY,CAAC,CAAC;IAExF;;gFAE4E;IAC5E;;;;;;;;;;;;;;;OAeG;IACH,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACrD,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,gBAAgB,GAAG,2BAA2B,CAAC;IAE9D,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC;IACzD,MAAM,kBAAkB,GAAG,OAAO,CAAC,WAAW;QAC5C,CAAC,CAAC,wCAAwC;QAC1C,CAAC,CAAC,cAAc,CAAC,gBAAgB,GAAG,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB;YAC9E,GAAG,2BAA2B,GAAG,OAAO,uDAAuD,CAAC;IACpG,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1F,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,uCAAuC;IACvC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtD,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,WAAmB,EAAY,EAAE;QAChD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvE,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAE7E;;;;;;;;;;oFAU4E;QAC5E,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,IAAI,GAAe,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QAEzE,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAEzC,MAAM,OAAO,GAAgB;YAC3B,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC1B,IAAI,EAAE,CAAC,IAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE;YACnE,SAAS,EAAE,CAAC,MAAc,EAAE,IAAU,EAAE,MAAc,EAAE,EAAE;gBACxD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,CAAC;gBACxC,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC/C,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,OAAO;gBACxC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC5B,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,YAAY,EAAE,YAAY;gBACxB,CAAC,CAAC,CAAC,QAAgB,EAAE,MAAc,EAAE,UAA8B,EAAE,aAAuB,EAAE,EAAE;oBAC5F,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;oBAC7F,OAAO,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;gBAClE,CAAC;gBACH,CAAC,CAAC,SAAS;YACb,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC/F,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3D,cAAc,IAAI,MAAM,CAAC,MAAM,CAAC;QAEhC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAExF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAqB,CAAC;oBAAE,SAAS;gBAEjE,IAAI,GAAG,CAAC;gBACR,IAAI,CAAC;oBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACnC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,uEAAuE;oBACvE,aAAa,CAAC,IAAI,CAAC;wBACjB,IAAI,EAAE,QAAQ;wBACd,MAAM,EAAE;4BACN;gCACE,IAAI,EAAE,OAAO;gCACb,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;gCACtC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;gCAC3C,IAAI,EAAE,SAAS,IAAI,CAAC,EAAE,YAAa,KAAe,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;6BAC3E;yBACF;qBACF,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,GAAG;oBAAE,SAAS;gBAEnB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBAErD,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACtE,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,EAAE,CAAC;oBACjF,YAAY,CAAC,IAAI,CAAC;wBAChB,IAAI,EAAE,WAAW;wBACjB,IAAI,EAAE,QAAQ,CAAC,SAAS;wBACxB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,mBAAmB;qBACnD,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBAED;;;;;;;;;;;;;;;;;;;;;;;mBAuBG;gBACH,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzC,MAAM,QAAQ,GAAG,CAAC,CAAW,EAAY,EAAE,CACzC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAE3E,MAAM,OAAO,GAAG,gBAAgB,CAAC;oBAC/B,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;oBACjD,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,QAAQ;oBACR,SAAS,EACP,GAAG,CAAC,SAAS;wBACb,CAAC,UAAU;4BACT,CAAC,CAAC,yEAAyE;gCACzE,6EAA6E;gCAC7E,8EAA8E;gCAC9E,sEAAsE;4BACxE,CAAC,CAAC,EAAE,CAAC;oBACT,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW;iBACjD,CAAC,CAAC;gBAEH,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC/B,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACpC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED;;;;;;;gFAOwE;QACxE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QACzE,WAAW,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;QAC1D,WAAW,CAAC,gBAAgB,IAAI,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC9D,WAAW,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;QAC1D,WAAW,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;QAC1D,WAAW,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QAEtD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACvC,uBAAuB,CAAC,IAAI,CAAC;gBAC3B,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,WAAW;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;gBACrC,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACpC,sBAAsB,CAAC,IAAI,CAAC;gBAC1B,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,WAAW;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;gBACrC,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACvC,eAAe,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,WAAW;gBACpC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;gBACvC,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,4EAA4E;QAC5E,qDAAqD;QACrD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpC,aAAa,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,KAAK,CAAC,QAAQ,IAAI,WAAW;gBACnC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;gBAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD,CAAC,CAAC;YACH,WAAW,CAAC,IAAI,CAAC;gBACf,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,IAAI,WAAW;gBACnC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;gBAC3C,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,MAAM,gBAAgB,GAAG,CACvB,CAA+B,EAC/B,IAAY,EACN,EAAE;YACR,UAAU,CAAC,IAAI,CAAC;gBACd,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,IAAI;gBACJ,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;gBACvC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;aACpC,CAAC,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzB,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;oBACvB,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;oBAC7B,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,oEAAoE;YACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;YAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC5E,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,EAAE,CAAC;gBACrF,YAAY,CAAC,IAAI,CAAC;oBAChB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,QAAQ,CAAC,SAAS;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,mBAAmB;iBACnD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAC9B,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YAClD,MAAM,cAAc,GAClB,UAAU,CAAC,MAAM,GAAG,CAAC;gBACnB,CAAC,CAAC,6BAA6B,UAAU,CAAC,MAAM,+BAA+B;oBAC7E,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC;oBACrF,yFAAyF;gBAC3F,CAAC,CAAC,EAAE,CAAC;YACT;;;;;;;;;;;;;;;;;;;;;;;;eAwBG;YACH;;;;;;;;;;;;;eAaG;YACH;;;;;;;;eAQG;YACH;;;;;;;;;;eAUG;YACH,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC/F,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzE,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,KAAK,SAAS,CAAC;gBACzD,MAAM,UAAU,GAAG,gBAAgB,CAAC;oBAClC,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;oBACpC,OAAO,EAAE,OAAO;wBACd,CAAC,CAAC,eAAe,IAAI,CAAC,MAAM,oFAAoF;wBAChH,CAAC,CAAC,eAAe,IAAI,CAAC,MAAM,mEAAmE,KAAK,KAAK;oBAC3G,QAAQ;oBACR,SAAS,EAAE,OAAO;wBAChB,CAAC,CAAC,kBAAkB,IAAI,CAAC,MAAM,cAAc,IAAI,CAAC,eAAe,gCAAgC;4BAC/F,+FAA+F;4BAC/F,0FAA0F;4BAC1F,+FAA+F;4BAC/F,iGAAiG;wBACnG,CAAC,CAAC,kBAAkB,IAAI,CAAC,MAAM,cAAc,IAAI,CAAC,eAAe,iCAAiC;4BAChG,qBAAqB,KAAK,mEAAmE;4BAC7F,mGAAmG;4BACnG,8FAA8F;4BAC9F,2FAA2F;4BAC3F,2DAA2D;oBAC/D,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAC;gBACH,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;gBAClC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACnB,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAC9B,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACnC,CAAC;gBACD,SAAS;YACX,CAAC;YACD;;;;;;;;;eASG;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC3G,MAAM,UAAU,GAAG,gBAAgB,CAAC;oBAClC,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;oBAClD,OAAO,EAAE,IAAI,CAAC,WAAW;wBACvB,CAAC,CAAC,sBAAsB,IAAI,CAAC,MAAM,sDAAsD;wBACzF,CAAC,CAAC,sBAAsB,IAAI,CAAC,MAAM,kCAAkC;oBACvE,QAAQ;oBACR,SAAS,EAAE,IAAI,CAAC,WAAW;wBACzB,CAAC,CAAC,kBAAkB,IAAI,CAAC,MAAM,cAAc,IAAI,CAAC,eAAe,2BAA2B;4BAC1F,8FAA8F;4BAC9F,8FAA8F;4BAC9F,gGAAgG;4BAChG,0FAA0F;wBAC5F,CAAC,CAAC,oCAAoC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;4BAC5D,CAAC,CAAC,kBAAkB,IAAI,CAAC,MAAM,cAAc,IAAI,CAAC,eAAe,uBAAuB;gCACtF,MAAM,WAAW,4EAA4E;gCAC7F,+FAA+F;gCAC/F,+FAA+F;gCAC/F,uDAAuD;4BACzD,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;gCACtC,CAAC,CAAC,kBAAkB,IAAI,CAAC,MAAM,cAAc,IAAI,CAAC,eAAe,6BAA6B;oCAC5F,MAAM,WAAW,6EAA6E;oCAC9F,4FAA4F;oCAC5F,+FAA+F;gCACnG,CAAC,CAAC,kBAAkB,IAAI,CAAC,MAAM,cAAc,IAAI,CAAC,eAAe,WAAW,WAAW,KAAK;oCAC1F,gGAAgG;oCAChG,0FAA0F;oCAC1F,sFAAsF;oBAC5F,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAC;gBACH,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;gBAClC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACnB,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAC9B,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACnC,CAAC;gBACD,SAAS;YACX,CAAC;YACD;;;;;;;;eAQG;YACH,8EAA8E;YAC9E,0EAA0E;YAC1E,0DAA0D;YAC1D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAW,EAAE;gBACpC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;gBAC9E,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5E,OAAO,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC;YACrH,CAAC,CAAC;YACF,kFAAkF;YAClF,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,6DAA6D,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3K,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,YAAY,IAAI,WAAW,EAAE,CAAC;gBAClF,MAAM,UAAU,GAAG,gBAAgB,CAAC;oBAChC,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,4CAA4C,IAAI,CAAC,MAAM,cAAc,IAAI,CAAC,eAAe,EAAE;oBACpG,QAAQ;oBACR,SAAS,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,cAAc;wBACzE,CAAC,CAAC,kBAAkB,IAAI,CAAC,MAAM,cAAc,IAAI,CAAC,eAAe,qBAAqB;4BACpF,mFAAmF;4BACnF,iFAAiF;4BACjF,mFAAmF;4BACnF,4CAA4C;wBAC9C,CAAC,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,cAAc;4BAC5D,CAAC,CAAC,kBAAkB,IAAI,CAAC,MAAM,cAAc,IAAI,CAAC,eAAe,6BAA6B;gCAC5F,aAAa,WAAW,qEAAqE;gCAC7F,6FAA6F;gCAC7F,oEAAoE,WAAW,aAAa;4BAC9F,CAAC,CAAC,IAAI,CAAC,aAAa;gCACpB,CAAC,CAAC,kBAAkB,IAAI,CAAC,MAAM,gBAAgB,IAAI,CAAC,eAAe,YAAY;oCAC/E,+EAA+E;oCAC/E,6EAA6E;oCAC7E,6EAA6E;oCAC7E,+EAA+E;oCAC/E,4DAA4D;gCAC5D,CAAC,CAAC,kBAAkB,IAAI,CAAC,MAAM,gBAAgB,IAAI,CAAC,eAAe,YAAY;oCAC7E,6EAA6E;oCAC7E,8EAA8E;oCAC9E,8EAA8E;oCAC9E,6EAA6E;oCAC7E,4CAA4C;oBAChD,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAC;gBACL,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;gBAClC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACnB,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAC9B;;;;;;;;;;;;;;uBAcG;oBACH,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACnC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,mBAAmB,CAAC;gBAClC,cAAc,EAAE,IAAI,CAAC,WAAW;gBAChC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,mCAAmC,IAAI,CAAC,MAAM,cAAc,IAAI,CAAC,eAAe,EAAE;gBAC3F,QAAQ;gBACR,SAAS,EACP,UAAU,IAAI,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GACzC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;oBAC3D,CAAC,CAAC,4BAA4B;oBAC9B,CAAC,CAAC,EACN,wBAAwB;oBACxB,KAAK,IAAI,CAAC,MAAM,oDAAoD,IAAI,CAAC,eAAe,GAAG;oBAC3F,2BAA2B,IAAI,CAAC,IAAI,uDAAuD;oBAC3F,2DAA2D;gBAC7D,WAAW,EACT,qFAAqF;oBACrF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,yFAAyF;oBACzF,wFAAwF;oBACxF,6EAA6E;oBAC7E,sDAAsD,GAAG,cAAc;gBACzE,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YAC/B,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACjC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,yEAAyE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,yDAAyD;YACzD,UAAU,CAAC,IAAI,CAAC;gBACd,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;gBAC1C,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;aACvC,CAAC,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;oBACvB,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;oBAC7B,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED;;;;;;;;;oFAS4E;QAC5E,KAAK,CAAC,UAAU,EAAE,CAAC;IACrB,CAAC;IAED,qEAAqE;IACrE,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IACrC,KAAK,CAAC,UAAU,EAAE,CAAC;IAEnB;;;;;;;8EAO0E;IAC1E,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAW,EAAE,CACjD,UAAU,CAAC,IAAI,CACb,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAC/B,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI;QACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK;QACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,CAC1C,CAAC;IAEJ,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAW,EAAE,CAChD,WAAW,CAAC,IAAI,CACd,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAC/B,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI;QACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK;QACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,CAC1C,CAAC;IAEJ,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IACjE,MAAM,mBAAmB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,mBAAmB,GAAG,YAAY,CAAC,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC;IAC7E,MAAM,WAAW,GAAc,CAAC,GAAG,YAAY,EAAE,GAAG,mBAAmB,CAAC,CAAC;IAEzE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;QACxC,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAChC,OAAO,CAAC,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,wEAAwE;IACxE,0DAA0D;IAC1D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgF,CAAC;IACtG,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE;QAC/B,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAC5D,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjF,uEAAuE;YACvE,yEAAyE;YACzE,sBAAsB;YACtB,IAAI,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QAC1D,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,aAAa;QAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAE/D,MAAM,SAAS,GAAe,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI;QACJ,gBAAgB,EAAE,KAAK,CAAC,QAAQ;QAChC,QAAQ,EAAE,KAAK,CAAC,GAAG;QACnB,kBAAkB,EAAE,KAAK,CAAC,KAAK;QAC/B,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;KAClD,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhD,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,aAAa;QACb,eAAe;QACf,uBAAuB;QACvB,sBAAsB;QACtB,SAAS;QACT,WAAW;QACX,KAAK,EAAE;YACL,WAAW;YACX,YAAY;YACZ,cAAc;YACd,aAAa,EAAE,YAAY,CAAC,MAAM;YAClC,kBAAkB;YAClB,mBAAmB;YACnB,wBAAwB,EAAE,kBAAkB,CAAC,IAAI;YACjD,wBAAwB,EAAE,eAAe,CAAC,MAAM;YAChD,uBAAuB,EAAE,uBAAuB,CAAC,MAAM;YACvD,sBAAsB,EAAE,sBAAsB,CAAC,MAAM;YACrD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SACjC;QACD,UAAU;QACV,aAAa;QACb,YAAY;QACZ,SAAS,EAAE,YAAY;YACrB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAa,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE;YACrD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAc,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3D,UAAU,EAAE,cAAc;QAC1B,QAAQ,EAAE,mBAAmB,EAAE;KAChC,CAAC;AACJ,CAAC"}

package/dist/src/core/coverage.d.ts

@@ -0,0 +1,87 @@
+/**
+ * THE COVERAGE LEDGER - "no silent gaps"
+ * ======================================
+ *
+ * Most scanners tell you what they FOUND. Almost none tell you what they did
+ * not LOOK for. That asymmetry is how a clean report comes to mean "we are
+ * secure" when it actually means "we ran five checks on two of your six
+ * languages".
+ *
+ * This module turns the per-rule, per-language declarations in the rule files
+ * into a ledger that is printed at the end of EVERY scan - clean or not. If a
+ * rule is partial, the report says which part. If a language went unscanned,
+ * the report says so and says why.
+ *
+ * A gap you can read is a decision. A gap you cannot read is a lie by omission.
+ */
+import type { SupportStatus } from '../rules/contract.js';
+import { type LanguageId } from '../parse/languages.js';
+import { ENGINE_CAPABILITIES } from './finding.js';
+export interface CoverageCell {
+    readonly ruleId: string;
+    readonly ruleName: string;
+    readonly language: LanguageId;
+    readonly status: SupportStatus;
+    readonly note: string;
+}
+/** Which languages the data-flow engine can actually verify flows in. */
+export interface TaintCoverageCell {
+    readonly language: LanguageId;
+    readonly implemented: boolean;
+    readonly note: string;
+}
+export interface CoverageReport {
+    readonly engine: typeof ENGINE_CAPABILITIES;
+    /**
+     * Data-flow coverage is reported SEPARATELY from rule coverage, because a
+     * language can have every rule implemented and still get no flow
+     * verification at all - which is exactly the situation Java and Go are in.
+     * Folding the two together would let "5/5 rules implemented" imply a depth
+     * of analysis that does not exist there.
+     */
+    readonly taint: readonly TaintCoverageCell[];
+    /** Every rule x language combination, including the ones we do not do. */
+    readonly matrix: readonly CoverageCell[];
+    /** Only the cells a reader must act on: partial and not-implemented. */
+    readonly gaps: readonly CoverageCell[];
+    readonly counts: {
+        readonly rules: number;
+        readonly languages: number;
+        readonly implemented: number;
+        readonly partial: number;
+        readonly notImplemented: number;
+    };
+    /** Languages present in the scanned tree that we have no support for at all. */
+    readonly unscannedExtensions: readonly string[];
+    /**
+     * OWASP categories this engine has NO rule for. Not a gap within a rule -
+     * the absence of the rule entirely.
+     *
+     * The report already listed limits inside the checks it runs, and partial
+     * language coverage per rule. It never said which whole classes of bug it
+     * does not look for. So a Java scan that stays silent on XXE and insecure
+     * deserialization reads exactly like a Java scan where those things are fine,
+     * and there was nothing anywhere in the output to tell the two apart.
+     *
+     * That is the same failure as a green tick on an unread file, one level up.
+     */
+    readonly owaspCoverage: readonly CategoryCoverage[];
+}
+export interface CategoryCoverage {
+    readonly id: string;
+    readonly title: string;
+    /**
+     * Never 'full'. No category in this list is comprehensively checked, and a
+     * state the data can never reach should not exist in the type.
+     */
+    readonly state: 'none' | 'partial';
+    /** Rule ids that land in this category. Empty when state is 'none'. */
+    readonly rules: readonly string[];
+    /** What we DO check here. Only set when state is 'partial'. */
+    readonly weCheck?: string;
+    /** What a reader would plausibly expect here - covered or not. */
+    readonly examples: string;
+    /** Why it is absent, when the reason is structural rather than just "not yet". */
+    readonly note?: string;
+}
+export declare function buildCoverageReport(unscannedExtensions?: readonly string[]): CoverageReport;

package/dist/src/core/coverage.js

@@ -0,0 +1,181 @@
+/**
+ * THE COVERAGE LEDGER - "no silent gaps"
+ * ======================================
+ *
+ * Most scanners tell you what they FOUND. Almost none tell you what they did
+ * not LOOK for. That asymmetry is how a clean report comes to mean "we are
+ * secure" when it actually means "we ran five checks on two of your six
+ * languages".
+ *
+ * This module turns the per-rule, per-language declarations in the rule files
+ * into a ledger that is printed at the end of EVERY scan - clean or not. If a
+ * rule is partial, the report says which part. If a language went unscanned,
+ * the report says so and says why.
+ *
+ * A gap you can read is a decision. A gap you cannot read is a lie by omission.
+ */
+import { ALL_RULES } from '../rules/registry.js';
+import { LANGUAGES } from '../parse/languages.js';
+import { TAINT_COVERAGE_NOTES, TAINT_DICTIONARIES } from '../taint/dictionaries.js';
+import { ENGINE_CAPABILITIES } from './finding.js';
+import { RUNTIME_VERSION_RULE } from '../platform/runtime-version.js';
+import { DEPENDENCY_RULE } from '../platform/dependency-rule.js';
+/**
+ * THE OWASP TOP 10, 2025 EDITION.
+ *
+ * Two corrections live in this block, and both were caught by someone asking
+ * "is that actually true?" of a panel built to be trusted.
+ *
+ * 1. THE EDITION WAS STALE. Every rule declared `A0x:2021`, and the coverage
+ *    panel counted against the 2021 taxonomy. The 2025 edition superseded it -
+ *    the numbering moved (Injection is A05 now, not A03), Software Supply Chain
+ *    Failures arrived as its own category, and A10 is a new entry entirely. A
+ *    tool that names a standard has to name the current one.
+ *
+ * 2. "COVERED" WAS A LIE OF ROUNDING. The first version of this list was a
+ *    binary: a category counted as covered if ANY rule declared it. Three did,
+ *    so the panel read "7 of 10 have no rule" - which invites the reader to
+ *    conclude the other three are handled. They are not. Injection has one rule
+ *    each for SQL, command and XSS, and none for LDAP, XPath, NoSQL, ORM,
+ *    template or header injection. Cryptographic Failures is a single weak-hash
+ *    check. Authentication Failures is hardcoded credentials and nothing else.
+ *
+ *    So there is no `covered: true` state here, because nothing earns it. Every
+ *    category is either untouched or PARTLY touched, and a partly-touched one
+ *    has to say what it leaves out - otherwise the count does the same
+ *    overstating the old binary did, one step further in.
+ */
+const OWASP_2025 = [
+    {
+        id: 'A01:2025',
+        title: 'Broken Access Control',
+        examples: 'path traversal, missing authorisation checks, insecure direct object references',
+        note: 'Whether a check is MISSING needs a model of who may do what, which no syntax tree carries.',
+    },
+    {
+        id: 'A02:2025',
+        title: 'Security Misconfiguration',
+        examples: 'XXE (XML parser left with external entities enabled), debug mode on, permissive CORS',
+        note: 'XXE is an ABSENCE rule - the bug is a hardening call that was never written. Every rule here detects a presence, which is a different shape.',
+    },
+    {
+        id: 'A03:2025',
+        title: 'Software Supply Chain Failures',
+        examples: 'known-vulnerable dependency versions, unpinned or compromised packages',
+        note: 'Needs a lockfile and an advisory database, not a syntax tree.',
+    },
+    {
+        id: 'A04:2025',
+        title: 'Cryptographic Failures',
+        examples: 'weak ciphers, missing TLS, weak randomness, unsalted hashes',
+    },
+    {
+        id: 'A05:2025',
+        title: 'Injection',
+        examples: 'SQL, command, XSS, LDAP, XPath, NoSQL, ORM, template and header injection',
+    },
+    {
+        id: 'A06:2025',
+        title: 'Insecure Design',
+        examples: 'missing rate limits, unsafe workflows',
+        note: 'A design flaw is not a code pattern; static analysis cannot see it.',
+    },
+    {
+        id: 'A07:2025',
+        title: 'Authentication Failures',
+        examples: 'hardcoded credentials, weak session handling, missing MFA, credential stuffing',
+    },
+    {
+        id: 'A08:2025',
+        title: 'Software or Data Integrity Failures',
+        examples: 'insecure deserialization (ObjectInputStream, pickle, unserialize), unsigned updates',
+    },
+    {
+        id: 'A09:2025',
+        title: 'Security Logging and Alerting Failures',
+        examples: 'absent audit logging, secrets written to logs, no alerting on abuse',
+    },
+    {
+        id: 'A10:2025',
+        title: 'Mishandling of Exceptional Conditions',
+        examples: 'swallowed errors, fail-open error paths, information leaked through error messages',
+    },
+];
+/** What we DO check inside a category we only partly touch. */
+const PARTIAL_NOTES = {
+    'A04:2025': 'weak hash algorithms only',
+    'A05:2025': 'SQL, command and XSS only',
+    'A01:2025': 'server-side request forgery (a URL the server fetches that a request chose) and path traversal (a file path it opens that a request chose) only. Missing authorisation checks and IDOR are NOT checked: deciding whether a check is ABSENT needs a model of who may do what, which no syntax tree carries.',
+    'A07:2025': 'hardcoded credentials in source only',
+    // This category used to be listed as unreachable, on the reasoning that
+    // deserialization is "structurally unlike a taint chain". That was wrong, and
+    // a Gemini-written test file proved it: `unserialize(base64_decode($_COOKIE
+    // ['session']))` is an ordinary source-to-sink flow with a source the engine
+    // already tracked. The claim was an assumption dressed up as an analysis.
+    'A08:2025': 'deserialization of untrusted input only - unsigned updates and CI/CD integrity are not checked',
+    'A03:2025': 'the PHP version a project declares (Dockerfile, compose, composer.json, .php-version), against php.net support dates and critical advisories only. Library versions are checked only with --deps (package-lock.json, composer.lock, requirements.txt, go.mod against osv.dev).',
+};
+/**
+ * Checks that are not shape rules - they read declarations rather than code -
+ * but still land in an OWASP category. Listed here so the coverage table
+ * counts them; leaving them out would understate what a scan does.
+ */
+const PROJECT_CHECKS = [
+    { id: RUNTIME_VERSION_RULE.id, owasp: RUNTIME_VERSION_RULE.owasp },
+    { id: DEPENDENCY_RULE.id, owasp: DEPENDENCY_RULE.owasp },
+];
+export function buildCoverageReport(unscannedExtensions = []) {
+    const matrix = [];
+    for (const rule of ALL_RULES) {
+        for (const language of LANGUAGES) {
+            const support = rule.support[language.id];
+            matrix.push({
+                ruleId: rule.id,
+                ruleName: rule.name,
+                language: language.id,
+                status: support?.status ?? 'not-implemented',
+                note: support?.note ??
+                    'NOT IMPLEMENTED: this rule has no pattern for this language, so files in ' +
+                        'this language were parsed but never checked for this weakness.',
+            });
+        }
+    }
+    const counts = {
+        rules: ALL_RULES.length,
+        languages: LANGUAGES.length,
+        implemented: matrix.filter((c) => c.status === 'implemented').length,
+        partial: matrix.filter((c) => c.status === 'partial').length,
+        notImplemented: matrix.filter((c) => c.status === 'not-implemented').length,
+    };
+    const taint = LANGUAGES.map((language) => ({
+        language: language.id,
+        implemented: TAINT_DICTIONARIES[language.id] !== undefined,
+        note: TAINT_COVERAGE_NOTES[language.id],
+    }));
+    return {
+        engine: ENGINE_CAPABILITIES,
+        taint,
+        matrix,
+        gaps: matrix.filter((c) => c.status !== 'implemented'),
+        counts,
+        unscannedExtensions: [...unscannedExtensions].sort(),
+        // Computed from the registry, so adding a rule quietly removes its category
+        // from this list and nobody has to remember to update prose.
+        owaspCoverage: OWASP_2025.map((category) => {
+            const rules = [...ALL_RULES, ...PROJECT_CHECKS]
+                .filter((rule) => rule.owasp.startsWith(category.id))
+                .map((r) => r.id);
+            const partial = PARTIAL_NOTES[category.id];
+            return {
+                id: category.id,
+                title: category.title,
+                state: rules.length > 0 ? 'partial' : 'none',
+                rules,
+                ...(rules.length > 0 && partial ? { weCheck: partial } : {}),
+                examples: category.examples,
+                ...(category.note ? { note: category.note } : {}),
+            };
+        }),
+    };
+}
+//# sourceMappingURL=coverage.js.map

package/dist/src/core/coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.js","sourceRoot":"","sources":["../../../src/core/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,SAAS,EAAmB,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAyEjE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,GAKV;IACJ;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,iFAAiF;QAC3F,IAAI,EAAE,4FAA4F;KACnG;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,sFAAsF;QAChG,IAAI,EAAE,8IAA8I;KACrJ;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,gCAAgC;QACvC,QAAQ,EAAE,wEAAwE;QAClF,IAAI,EAAE,+DAA+D;KACtE;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,wBAAwB;QAC/B,QAAQ,EAAE,6DAA6D;KACxE;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,2EAA2E;KACtF;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,iBAAiB;QACxB,QAAQ,EAAE,uCAAuC;QACjD,IAAI,EAAE,qEAAqE;KAC5E;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,gFAAgF;KAC3F;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,qCAAqC;QAC5C,QAAQ,EAAE,qFAAqF;KAChG;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,wCAAwC;QAC/C,QAAQ,EAAE,qEAAqE;KAChF;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,uCAAuC;QAC9C,QAAQ,EAAE,oFAAoF;KAC/F;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,aAAa,GAA2B;IAC5C,UAAU,EAAE,2BAA2B;IACvC,UAAU,EAAE,2BAA2B;IACvC,UAAU,EACR,4SAA4S;IAC9S,UAAU,EAAE,sCAAsC;IAClD,wEAAwE;IACxE,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,UAAU,EAAE,gGAAgG;IAC5G,UAAU,EACR,gRAAgR;CACnR,CAAC;AAEF;;;;GAIG;AACH,MAAM,cAAc,GAA6C;IAC/D,EAAE,EAAE,EAAE,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,oBAAoB,CAAC,KAAK,EAAE;IAClE,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE;CACzD,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,sBAAyC,EAAE;IAC7E,MAAM,MAAM,GAAmB,EAAE,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC;gBACV,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,QAAQ,EAAE,QAAQ,CAAC,EAAE;gBACrB,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,iBAAiB;gBAC5C,IAAI,EACF,OAAO,EAAE,IAAI;oBACb,2EAA2E;wBACzE,gEAAgE;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG;QACb,KAAK,EAAE,SAAS,CAAC,MAAM;QACvB,SAAS,EAAE,SAAS,CAAC,MAAM;QAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,MAAM;QACpE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;QAC5D,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,MAAM;KAC5E,CAAC;IAEF,MAAM,KAAK,GAAwB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9D,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,SAAS;QAC1D,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;KACxC,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,MAAM,EAAE,mBAAmB;QAC3B,KAAK;QACL,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC;QACtD,MAAM;QACN,mBAAmB,EAAE,CAAC,GAAG,mBAAmB,CAAC,CAAC,IAAI,EAAE;QACpD,4EAA4E;QAC5E,6DAA6D;QAC7D,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,cAAc,CAAC;iBAC5C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;iBACpD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpB,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,SAAmB,CAAC,CAAC,CAAE,MAAgB;gBAClE,KAAK;gBACL,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClD,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/src/core/finding.d.ts

@@ -0,0 +1,196 @@
+/**
+ * THE HONESTY CONTRACT
+ * ====================
+ *
+ * This file is the most important file in the project. Everything else is
+ * plumbing. Read this one carefully.
+ *
+ * Defuse promises one thing that Snyk / Semgrep / SonarQube do not
+ * promise clearly: every single finding tells you HOW SURE we are, in a way you
+ * can act on. There are exactly two levels, and they mean precise things:
+ *
+ *   "signature-based"  We matched a SHAPE in your code. We saw a pattern that
+ *                      is *often* a vulnerability. We did NOT trace where the
+ *                      data actually came from. This might be a real bug, or it
+ *                      might be completely safe. YOU still have to look.
+ *
+ *   "flow-verified"    We traced actual data, step by step, from a place an
+ *                      attacker controls (a "source", e.g. an HTTP request)
+ *                      all the way into a dangerous operation (a "sink", e.g.
+ *                      a database query), and we confirmed nothing cleaned it
+ *                      up along the way. We can show you every hop.
+ *
+ * A RULE CAN ONLY EVER PRODUCE "signature-based". Only the taint engine can
+ * produce the other label.
+ *
+ * We do not enforce that with willpower or a code review checklist. We enforce
+ * it with the type system:
+ *
+ *   - A FlowVerifiedFinding REQUIRES a non-empty `flowPath` of concrete steps.
+ *   - Only the taint engine can build one. A rule cannot, because a rule only
+ *     ever sees a single shape - it has no idea where the value came from.
+ *   - So a rule physically cannot emit a "flow-verified" finding: there is no
+ *     path it could supply, and TypeScript refuses to compile the attempt.
+ *
+ * That is the difference between a promise and a guarantee.
+ *
+ * ARCHITECTURAL DECISION (matters later): we are modelling Finding as a
+ * "discriminated union" - two shapes sharing one `confidence` tag - rather than
+ * one flat object with an optional flag. The taint engine supplies the second
+ * shape, and every report renderer is forced by the compiler to handle it.
+ * Nothing silently upgrades its own confidence.
+ */
+/** The two - and only two - confidence levels this tool will ever emit. */
+export type Confidence = 'signature-based' | 'flow-verified';
+/**
+ * Severity = "how bad is this if it turns out to be real?"
+ * Deliberately separate from confidence, which is "how sure are we it's real?"
+ * Conflating those two numbers is the single most common lie in SAST tooling:
+ * a tool shows one "risk" bar and you cannot tell whether it means
+ * "probably harmless but catastrophic if not" or "definitely real but minor".
+ */
+export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';
+export declare const SEVERITY_ORDER: Record<Severity, number>;
+/**
+ * Exactly where in the code this was found.
+ * We keep the raw AST node type and its ancestry so a finding is reproducible:
+ * you can point at the same node again later and check whether we were right.
+ */
+export interface CodeLocation {
+    /** Path as the user gave it to us (relative where possible - nicer to read). */
+    readonly file: string;
+    /** 1-based, because humans and editors count from 1. Tree-sitter counts from 0. */
+    readonly startLine: number;
+    readonly startColumn: number;
+    readonly endLine: number;
+    readonly endColumn: number;
+    /** The tree-sitter node type we matched, e.g. "binary_expression". */
+    readonly astNodeType: string;
+    /** Ancestry of that node, e.g. "program > lexical_declaration > call_expression". */
+    readonly astNodePath: string;
+    /** The exact source text that matched, trimmed for display. */
+    readonly snippet: string;
+}
+/**
+ * One hop in a data-flow trace. Produced only by the taint engine, which is the
+ * only component that watches a value move. Defined as a public, reviewable
+ * shape rather than a vague promise: if a hop cannot be described and located,
+ * it does not belong in a path.
+ */
+export interface FlowStep {
+    readonly kind: 'source' | 'propagation' | 'sanitizer' | 'sink';
+    readonly location: CodeLocation;
+    readonly description: string;
+}
+interface FindingBase {
+    /** Stable machine id, e.g. "sql-injection". Used by --json and by tests. */
+    readonly ruleId: string;
+    /** Human title, e.g. "SQL query built by string concatenation". */
+    readonly ruleName: string;
+    /** Common Weakness Enumeration id, the industry's shared bug catalogue. */
+    readonly cwe: string;
+    /** Which OWASP Top 10 (2025) category this belongs to. */
+    readonly owasp: string;
+    readonly severity: Severity;
+    /** One line, plain language, shown in terminal output. */
+    readonly message: string;
+    readonly location: CodeLocation;
+    /**
+     * WHY did this match? Written for a human who is deciding whether to care.
+     * Required, never optional - a finding with no explanation is a guess with a
+     * badge on.
+     */
+    readonly reasoning: string;
+    /**
+     * What this particular check CANNOT tell you. Required for the same reason.
+     * e.g. "We did not check whether `userId` is attacker-controlled."
+     */
+    readonly limitations: string;
+    /** ISO-8601 timestamp of the scan that produced this. */
+    readonly detectedAt: string;
+}
+/** A pattern match. Unverified by design - this is what the rule engine emits. */
+export interface SignatureFinding extends FindingBase {
+    readonly confidence: 'signature-based';
+    readonly verified: false;
+    /** Explicitly null, not missing: "we looked at flow" is never implied. */
+    readonly flowPath: null;
+}
+/** A confirmed source-to-sink trace. Only the taint engine can construct one. */
+export interface FlowVerifiedFinding extends FindingBase {
+    readonly confidence: 'flow-verified';
+    readonly verified: true;
+    /** Must contain at least a source and a sink. Enforced at construction. */
+    readonly flowPath: readonly FlowStep[];
+    /**
+     * Functions on this path that we do not model, named.
+     *
+     * THE WEAKEST LINK, PROMOTED TO A FIELD. `flow-verified` promises the value
+     * was traced with no sanitiser on the path. When a hop passes through a
+     * function we have never heard of, "no sanitiser" is an ASSUMPTION rather
+     * than an observation - if that function sanitises, the finding is wrong.
+     *
+     * The path step and the prose limitations both said so already. This did not:
+     * a consumer filtering `confidence === 'flow-verified'` out of --json got the
+     * unqualified promise with no way to tell a fully-modelled trace from one
+     * resting on an assumption. A caveat that only exists in prose is a caveat
+     * machines cannot honour, which makes it half a caveat.
+     *
+     * Empty means every hop on this path is modelled. That is the strong case.
+     */
+    readonly unmodelledHops: readonly string[];
+}
+export type Finding = SignatureFinding | FlowVerifiedFinding;
+/**
+ * The constructor for everything the RULE engine produces.
+ *
+ * Note what it does not accept: there is no `confidence` parameter. A rule
+ * author cannot pass "flow-verified" even by mistake, because the value is
+ * hard-coded here and nowhere else.
+ */
+export declare function signatureFinding(input: Omit<FindingBase, 'detectedAt'> & {
+    detectedAt?: string;
+}): SignatureFinding;
+/**
+ * THE SECOND CONSTRUCTOR.
+ *
+ * For the whole first stretch of this project, this function threw. It was a
+ * deliberate, documented stub: the type for a flow-verified finding existed, so
+ * anyone could read what the claim would REQUIRE, but nothing could produce one.
+ *
+ * It is real now, and the requirement did not soften. Note the runtime checks
+ * below: a flow-verified finding must carry a path that BEGINS at a source and
+ * ENDS at a sink. Not "a path". Not "some steps". If the taint engine ever
+ * hands over a path that doesn't start where attacker data enters and finish
+ * where it does damage, this throws rather than emitting the claim.
+ *
+ * The type system stops a rule from lying. This function stops the ENGINE from
+ * lying - including a future version of it written by someone in a hurry.
+ */
+export declare function flowVerifiedFinding(input: Omit<FindingBase, 'detectedAt'> & {
+    detectedAt?: string;
+    flowPath: readonly FlowStep[];
+    unmodelledHops?: readonly string[];
+}): FlowVerifiedFinding;
+/** What this build of the engine can and cannot do. Printed in every report. */
+export declare const ENGINE_CAPABILITIES: {
+    /**
+     * What the banner prints, on the terminal and in the browser.
+     *
+     * A phase number used to live here. It described OUR build order, not
+     * anything a user of the tool can act on - and it went stale the moment work
+     * happened out of order: the banner read "PHASE 3C" while the version string
+     * read "phase2", which is precisely the kind of small lie this project exists
+     * to not tell. A capability label cannot drift, because it can only change
+     * when the engine actually changes.
+     */
+    readonly analysisLabel: "SIGNATURE + DATA FLOW";
+    readonly version: "0.5.0";
+    readonly implemented: readonly [`Tree-sitter AST parsing for ${string}`, "Pattern (signature) matching over real syntax trees, not text/regex", `Taint analysis in all ${number} languages: source to sink, following values into other functions AND - in every language except PHP - into other files through resolved imports`, "Prepared-statement awareness: arguments bound to a prepared query are parameters, not instructions", "Kind-scoped sanitiser recognition - an HTML escaper does not clear a SQL sink", "Retraction: a signature guess is withdrawn when the tracer proves a sanitiser runs", "Verified-clean reporting: lines the tracer reached and proved safe are listed, so \"no finding here\" can be told apart from \"never looked here\"", "One engine, two shells: the terminal and the browser run the same compiled analysis module, not two implementations of it", "Receiver state: a tainted argument dirties the object it was handed to, so `sb.append(dirty)` and `list.add(dirty)` are followed - and a sink that takes NO arguments because the payload was loaded earlier (`pb.command(list); pb.start()`) is recognised", "Return-value sinks in Python: a Flask/Django view that returns an HTML string is treated as writing the response body, so the commonest reflected XSS in Python is seen at all - and the escaped version is credited as clean rather than merely unflagged", "Escape proof before complaint (JavaScript/TypeScript): before reporting a value written into HTML, local variables, local render helpers and their arguments are resolved to see whether every spliced-in value is a literal, a number, or the output of a known escaper. A finding that survives names the exact sub-expression it could not prove safe.", "SQL is recognised by statement SHAPE (SELECT paired with FROM, INSERT with INTO) inside a bounded window, not by keywords scattered anywhere in the text - so a paragraph of prose containing \"call\" and \"where\" is not a query", "Per-rule and per-language coverage reporting, including gaps"];
+    readonly notImplemented: readonly ["Third-party code: only files inside the scan are resolved. A call into node_modules, a JAR or a vendored package ends the trace.", "Ambiguous imports: when several files in scope define the same function name, we decline to guess and the trace stops there. The count is reported.", "Re-exports, dynamic imports, computed requires, and build-tool path aliases (tsconfig paths, webpack) are not resolved.", "Whether a function is actually EXPORTED is not checked - a module-private helper with a matching name could be entered.", "Call chains deeper than four functions are not followed, and a call that resolves by name to a function already being followed on the same path - recursion, or a same-named method on another object - is not re-entered. At either stop the value is carried on as an ASSUMPTION that the unread call preserves it, and the finding names the call and why it was not read. So a sanitiser hidden past a stop is missed and the line is reported; before this was fixed the stop declared the value clean, which cost BenchmarkJava 38 real vulnerabilities.", "Calls are resolved by NAME, with two checks where the language makes them sound: in Java, Go, C and C++ a call must pass a number of arguments the target accepts, and in Java a call on a receiver of a declared type only reaches methods declared in that type. An interface-typed receiver therefore reaches no body at all, and the value is carried past it as a named assumption.", "Object and field state: `obj.field = dirty` and `sb.append(dirty)` are invisible - we track variables, not the interiors of objects.", "Sources are recognised by expression shape (req.query, request.form), not by proving the object really is a request.", "Branch conditions are evaluated only when they are fixed at compile time: literals, arithmetic, comparisons and logic over them, a local DECLARED once with such a value (in Python, PHP and a JavaScript `var`: written once at the top of the function, since those have no block-scoped declarations), a character literal, and Java's `charAt` on a string literal. A name that is a parameter, a field, incremented, passed by address or reference, part of a destructuring or multi-value write, or written more than once is not fixed; nor is anything in C++ unless it is declared const or constexpr, since a reference can write to it invisibly; nor anything in a function that uses eval, with, arguments, $$name, extract() or exec(), that C code can goto into, or that did not parse cleanly. Only exact arithmetic is folded: no octal literals, no division outside integer languages, and no value outside the range its declared type holds. Such a condition decides `if`, ternaries and switch statements (Java, JavaScript, TypeScript, C, C++, PHP and Go - not Python's `match`); strings are never compared, so a switch on a string stays undecided. Every branch or case skipped this way is listed in diagnostics.unreachableCodeSkipped with the decision behind it. Every other condition is not read, so we make the weaker claim that a CONDITIONAL write cannot prove a value clean: taint set anywhere survives a clean assignment inside an if/else, switch or loop, while an unconditional one still clears it. That errs toward reporting a value that might be clean rather than staying silent about one that might be dirty - and it is why `if (cond) bar = dirty; else bar = \"safe\";` is still reported.", "Loops are not iterated to a fixpoint, so a value that becomes tainted late in a loop body is missed.", "Containers are tainted whole, not per element: after `list.add(clean)` and `list.add(dirty)`, or after `Object[] a = {\"safe\", dirty}`, every read from that container is treated as dirty. This is the price of following values into objects at all, and it errs toward reporting rather than missing. TWO EXCEPTIONS, Java only, where every write the collection can receive is visible: a map created locally as `new HashMap<>()` or `new LinkedHashMap<>()` and touched by nothing but straight-line `put(\"literal\", value);` statements and reads answers `get(\"literal\")` with the last put under that key; and a list created locally as `new ArrayList<>()` or `new LinkedList<>()` and touched by nothing but straight-line `add(value);` and `remove(n);` statements and reads is replayed, so `get(n)` returns what sits at that position. Anything else - a conditional write, a variable key or index, the collection handed to anything, any other method - keeps the whole-collection answer. A stored value that can change in place (a StringBuilder, an array, a list) is not read this way, since an alias could change it unseen. Every read answered this way is listed in diagnostics.collectionReadsResolved.", "Framework awareness is PER-FRAMEWORK and partial. Recognised: Express/Koa request objects, Flask/Django/DRF request objects, URL path parameters named by a Flask or FastAPI route decorator, NestJS @Param/@Query/@Body/@Headers parameters, Spring and JAX-RS parameter annotations, servlet getters, net/http and Gin/Echo context values, PHP superglobals and $request accessors. NOT recognised, and each one is a silent zero: any house-built REST layer (elasticsearch's own RestRequest is 783 uses in one repository), Micronaut, Quarkus outside JAX-RS, Vert.x, Play, NestJS decorators other than @Param, @Query, @Body and @Headers, FastAPI query parameters a route path does not name and Pydantic body models, and Express ROUTING itself - a value that only becomes attacker-controlled through a framework binding we do not list is never seen as a source. The report now prints how many sources were recognised, so a zero is visible rather than reading as a clean bill.", "The escape proof is JavaScript and TypeScript only, and same-file only. An escaper imported from another module, applied by a framework, or reached through more than six nested calls reads as unproven - so Python, Java, PHP and Go HTML sinks still report on shape alone.", "MEMORY SCALES WITH THE SOURCE, at roughly 7x its bytes plus a fixed ~300MB for Node and the seven WebAssembly grammars. Syntax trees live in a WASM heap that JavaScript garbage collection cannot touch, so they are freed explicitly: the scan holds as many as DEFUSE_TREE_BUDGET_MB allows and parses a file again if something needs it after its tree was dropped. Measured on one 54MB corpus, same binary, only the budget changed: 1474MB peak holding everything, 716MB with a 256MB tree budget, findings byte-identical, 7% slower. That puts the practical ceiling near 1.1GB of source on an 8GB machine. A scan that does not fit gets SLOWER rather than being killed, and the report says so - diagnostics.treeMemory.reparses above zero means files were parsed more than once. THE PREVIOUS VERSION OF THIS NOTE WAS WRONG, and is recorded here rather than quietly deleted: it said trees were never freed \"because cross-file tracing needs to resolve into any file at any time\", and cited a 120MB ceiling. Cross-file had nothing to do with it - measured, --no-cross-file used 535.8MB against 528.8MB with it on, because nothing called delete() in either mode. The ceiling was real; the explanation for it was invented.", "Expressions nested deeper than 400 levels are not walked. Hand-written code never reaches this; generated, minified and stress-test files do. The count is reported as a blind spot rather than silently skipped - an earlier version had no limit at all and one such file killed an entire 25,809-file scan with a stack overflow, losing every finding in it.", "Vendor documentation example credentials (a key matching a published format but ending in EXAMPLE, or filled with 0000/1234567890) are treated as placeholders and not reported. A real credential that happened to look like one would be missed."];
+    readonly meaningOfConfidence: {
+        readonly 'signature-based': "Pattern matched in the syntax tree. Data flow NOT traced. May be a false positive.";
+        readonly 'flow-verified': "Attacker-controlled data was traced from a source into a sink - across functions and, where imports resolve, across files - with no sanitiser on the path. Every hop is listed in flowPath, with its own file and line.";
+    };
+};
+export {};