@sikkuumiii/defuse 0.0.0-stage → 0.5.0

package/dist/src/core/score.js

@@ -0,0 +1,232 @@
+/**
+ * THE GAUGES
+ * ==========
+ *
+ * Three needles. They are never added together, and this file will not let
+ * them be - there is no `overallScore` export, and there never should be.
+ *
+ * WHY THAT MATTERS. The comment at the top of finding.ts says it best:
+ *
+ *   "Severity = how bad is this if it turns out to be real? Deliberately
+ *    separate from confidence, which is how sure are we it's real?
+ *    Conflating those two numbers is the single most common lie in SAST
+ *    tooling: a tool shows one 'risk' bar and you cannot tell whether it
+ *    means 'probably harmless but catastrophic if not' or 'definitely real
+ *    but minor'."
+ *
+ * A single 0-500 risk dial IS that bar. So the dial got split along the exact
+ * line the project already draws:
+ *
+ *   VERIFIED EXPOSURE    severity, over findings we PROVED reach a sink
+ *   UNVERIFIED SURFACE   severity, over findings we only pattern-matched
+ *   ANALYSIS COVERAGE    how much of the code we could actually reason about
+ *
+ * Two of those are the same weights over two different confidence levels, kept
+ * side by side so you can see the shape of what is proven against the shape of
+ * what is merely suspected. Reading them together is the point; averaging them
+ * would destroy it.
+ *
+ * Every reading carries its own arithmetic in `working`, so the number can be
+ * CHECKED rather than believed. That is the whole standard here: a score you
+ * cannot recompute by hand is a vibe with a decimal point on it.
+ */
+/**
+ * How much one finding contributes, by severity.
+ *
+ * These are a judgement, not a measurement, and calling them anything else
+ * would be the first lie. What makes them defensible is that they are FIXED,
+ * PUBLISHED and applied identically to both severity gauges - so while the
+ * absolute number is arbitrary, every comparison made with it is real: two
+ * criticals always outweigh three mediums, in both directions, in both shells.
+ */
+export const SEVERITY_WEIGHT = {
+    critical: 25,
+    high: 15,
+    medium: 7,
+    low: 3,
+    info: 1,
+};
+/** The top of the severity dials. A sum past this is reported, not hidden. */
+export const GAUGE_MAX = 500;
+function weigh(findings) {
+    const bySeverity = new Map();
+    let total = 0;
+    for (const finding of findings) {
+        bySeverity.set(finding.severity, (bySeverity.get(finding.severity) ?? 0) + 1);
+        total += SEVERITY_WEIGHT[finding.severity];
+    }
+    return { total, bySeverity };
+}
+const ORDER = ['critical', 'high', 'medium', 'low', 'info'];
+function showWorking(bySeverity, total) {
+    const lines = ORDER.filter((s) => bySeverity.get(s)).map((s) => {
+        const n = bySeverity.get(s) ?? 0;
+        return `${n} ${s} x ${SEVERITY_WEIGHT[s]} = ${n * SEVERITY_WEIGHT[s]}`;
+    });
+    if (lines.length === 0)
+        return ['nothing in this category'];
+    if (lines.length > 1)
+        lines.push(`total = ${total}`);
+    return lines;
+}
+function severityGauge(id, label, meaning, findings, examinedNothing) {
+    const { total, bySeverity } = weigh(findings);
+    const working = showWorking(bySeverity, total);
+    if (total > GAUGE_MAX) {
+        working.push(`past the top of the dial by ${total - GAUGE_MAX} - needle pinned at ${GAUGE_MAX}`);
+    }
+    const segments = ORDER.filter((s) => bySeverity.get(s)).map((severity) => {
+        const count = bySeverity.get(severity) ?? 0;
+        const weight = count * SEVERITY_WEIGHT[severity];
+        return { severity, count, weight, share: total > 0 ? weight / total : 0 };
+    });
+    return {
+        id,
+        label,
+        value: Math.min(total, GAUGE_MAX),
+        max: GAUGE_MAX,
+        unit: '',
+        meaning,
+        working,
+        rawTotal: total,
+        capped: total > GAUGE_MAX,
+        noReading: examinedNothing,
+        segments,
+    };
+}
+/**
+ * How much of the analysis actually completed.
+ *
+ * This is the gauge no other scanner shows, and it is the one that tells you
+ * how to read the other two. A verified-exposure of 0 means something very
+ * different at 95% coverage than at 30%: the first is reassuring, the second
+ * means we barely looked.
+ *
+ * It is an average of the ratios we can genuinely compute, and each one is
+ * listed in `working` so an average that hides a bad component cannot pass
+ * unnoticed. Ratios we cannot compute are OMITTED rather than assumed to be
+ * 100% - an unmeasured thing is not a passing thing.
+ */
+function coverageGauge(result, filesFound, examinedNothing) {
+    const working = [];
+    const parts = [];
+    const found = filesFound || result.stats.filesParsed;
+    if (found > 0) {
+        const rate = result.stats.filesParsed / found;
+        parts.push(rate);
+        working.push(`files read: ${result.stats.filesParsed}/${found} = ${Math.round(rate * 100)}%`);
+    }
+    const { rules, languages, implemented, partial } = result.coverage.counts;
+    const cells = rules * languages;
+    if (cells > 0) {
+        // A partial rule counts as half. It does something; it does not do the job.
+        const rate = (implemented + partial * 0.5) / cells;
+        parts.push(rate);
+        working.push(`rules available: ${implemented} full + ${partial} partial of ${cells} = ${Math.round(rate * 100)}%`);
+    }
+    if (result.crossFile.enabled) {
+        /*
+         * A local import that resolved to nothing is a module the analysis never
+         * entered. Leaving it out of the mean let a scan that linked 0 of 31 imports
+         * read 82%, because no call could even be attempted across the gap.
+         */
+        const imports = result.crossFile.importEdges + result.crossFile.importsUnresolved;
+        if (imports > 0) {
+            const rate = result.crossFile.importEdges / imports;
+            parts.push(rate);
+            working.push(`local imports resolved: ${result.crossFile.importEdges}/${imports} = ${Math.round(rate * 100)}%`);
+        }
+        const attempts = result.crossFile.resolved + result.crossFile.ambiguous;
+        if (attempts > 0) {
+            const rate = result.crossFile.resolved / attempts;
+            parts.push(rate);
+            working.push(`cross-file calls followed: ${result.crossFile.resolved}/${attempts} = ${Math.round(rate * 100)}%`);
+        }
+        else {
+            working.push('cross-file calls followed: none attempted, so not counted');
+        }
+    }
+    else {
+        working.push('cross-file resolution was OFF, so it is not counted here');
+    }
+    // Stated first, because it is the denominator everything else divides into.
+    // "94% of the analysis completed" is not a useful sentence when the analysis
+    // had nothing to run on.
+    working.unshift(`code constructs examined: ${result.stats.shapesExamined}`);
+    const value = parts.length > 0 ? Math.round((parts.reduce((a, b) => a + b, 0) / parts.length) * 100) : 0;
+    if (parts.length > 1)
+        working.push(`mean of ${parts.length} measured ratios = ${value}%`);
+    return {
+        id: 'analysis-coverage',
+        label: 'Analysis coverage',
+        value,
+        max: 100,
+        unit: '%',
+        meaning: examinedNothing
+            ? 'Nothing in this scan could be analysed - not one statement, call or ' +
+                'assignment reached a rule. There is no coverage figure to give, because ' +
+                'there was nothing to cover. This is not a clean result; it is no result.'
+            : 'How much of the analysis actually completed. This is not a security score - ' +
+                'it is how much weight the other two dials can carry. Low coverage with no ' +
+                'findings means we barely looked, not that the code is fine.',
+        working,
+        rawTotal: value,
+        capped: false,
+        noReading: examinedNothing,
+        // A ratio has no composition to show. Empty rather than faked.
+        segments: [],
+    };
+}
+/**
+ * Build all three readings.
+ *
+ * `filesFound` comes from the walker (Node) or the drop handler (browser), so
+ * it is passed in rather than read off the result - the analyzer only ever
+ * sees the files that made it that far.
+ */
+export function scoreAnalysis(result, filesFound = 0) {
+    const verified = result.findings.filter((f) => f.confidence === 'flow-verified');
+    const signature = result.findings.filter((f) => f.confidence === 'signature-based');
+    // Not one statement, call or assignment reached a rule. Parsing a file is not
+    // the same as analysing it: a file of whitespace parses perfectly.
+    const examinedNothing = result.stats.shapesExamined === 0;
+    const gauges = [
+        severityGauge('verified-exposure', 'Verified exposure', 'Severity weight of findings where attacker data was TRACED into the sink. ' +
+            'Every point here is backed by a printed path. Zero means no flow was proven - ' +
+            'it does not mean none exists.', verified, examinedNothing),
+        severityGauge('unverified-surface', 'Unverified surface', 'The same weights over findings we only pattern-matched. Deliberately a ' +
+            'separate needle: these may be real or may be false positives, and averaging ' +
+            'them into the proven ones would hide which is which.', signature, examinedNothing),
+        coverageGauge(result, filesFound, examinedNothing),
+    ];
+    // These are SCAN-WIDE counts, not a tally of what appears in the findings
+    // above. A trace can pass through an unmodelled function and then never reach
+    // a sink, so this number is legitimately larger than the unmodelled hops you
+    // can see in the printed paths. Saying "3" while the paths show 2 looks like
+    // an error until the label admits which population it is counting.
+    const blindSpots = [
+        {
+            label: 'expressions too deeply nested to walk (generated or minified code)',
+            count: result.traceLimits.astTruncations,
+        },
+        { label: 'call chains cut at the depth limit', count: result.traceLimits.depthTruncations },
+        { label: 'recursive calls not re-entered', count: result.traceLimits.recursionStops },
+        {
+            label: 'unmodelled functions stepped through (scan-wide, not only on reported paths)',
+            count: result.traceLimits.unmodelledHops,
+        },
+        {
+            label: 'cross-file calls declined as ambiguous',
+            count: result.crossFile.enabled ? result.crossFile.ambiguous : 0,
+        },
+        { label: 'files that did not fully parse', count: result.parseProblems.length },
+    ].filter((spot) => spot.count > 0);
+    return {
+        gauges,
+        examinedNothing,
+        shapesExamined: result.stats.shapesExamined,
+        blindSpots,
+        sourcesFound: result.traceLimits.sourcesFound,
+    };
+}
+//# sourceMappingURL=score.js.map

package/dist/src/core/score.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"score.js","sourceRoot":"","sources":["../../../src/core/score.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAuC;IACjE,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,EAAE;IACR,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,CAAC;AAoF7B,SAAS,KAAK,CAAC,QAA4B;IACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9E,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,KAAK,GAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEjF,SAAS,WAAW,CAAC,UAAiC,EAAE,KAAa;IACnE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7D,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CACpB,EAA8C,EAC9C,KAAa,EACb,OAAe,EACf,QAA4B,EAC5B,eAAwB;IAExB,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,+BAA+B,KAAK,GAAG,SAAS,uBAAuB,SAAS,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,EAAE;QACF,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC;QACjC,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,EAAE;QACR,OAAO;QACP,OAAO;QACP,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,KAAK,GAAG,SAAS;QACzB,SAAS,EAAE,eAAe;QAC1B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,aAAa,CAAC,MAAsB,EAAE,UAAkB,EAAE,eAAwB;IACzF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,KAAK,GAAG,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;IACrD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC1E,MAAM,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,4EAA4E;QAC5E,MAAM,IAAI,GAAG,CAAC,WAAW,GAAG,OAAO,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,CAAC,IAAI,CACV,oBAAoB,WAAW,WAAW,OAAO,eAAe,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,CACrG,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAC7B;;;;WAIG;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC;QAClF,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,WAAW,GAAG,OAAO,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CACV,2BAA2B,MAAM,CAAC,SAAS,CAAC,WAAW,IAAI,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,CAClG,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC;QACxE,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAClD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CACV,8BAA8B,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,QAAQ,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,CACnG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IAC3E,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,yBAAyB;IACzB,OAAO,CAAC,OAAO,CAAC,6BAA6B,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;IAE5E,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,sBAAsB,KAAK,GAAG,CAAC,CAAC;IAE1F,OAAO;QACL,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,KAAK;QACL,GAAG,EAAE,GAAG;QACR,IAAI,EAAE,GAAG;QACT,OAAO,EAAE,eAAe;YACtB,CAAC,CAAC,sEAAsE;gBACtE,0EAA0E;gBAC1E,0EAA0E;YAC5E,CAAC,CAAC,8EAA8E;gBAC9E,4EAA4E;gBAC5E,6DAA6D;QACjE,OAAO;QACP,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,eAAe;QAC1B,+DAA+D;QAC/D,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAsB,EAAE,UAAU,GAAG,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,iBAAiB,CAAC,CAAC;IACpF,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAmB;QAC7B,aAAa,CACX,mBAAmB,EACnB,mBAAmB,EACnB,4EAA4E;YAC1E,gFAAgF;YAChF,+BAA+B,EACjC,QAAQ,EACR,eAAe,CAChB;QACD,aAAa,CACX,oBAAoB,EACpB,oBAAoB,EACpB,yEAAyE;YACvE,8EAA8E;YAC9E,sDAAsD,EACxD,SAAS,EACT,eAAe,CAChB;QACD,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,eAAe,CAAC;KACnD,CAAC;IAEF,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,UAAU,GAAG;QACjB;YACE,KAAK,EAAE,oEAAoE;YAC3E,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,cAAc;SACzC;QACD,EAAE,KAAK,EAAE,oCAAoC,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE;QAC3F,EAAE,KAAK,EAAE,gCAAgC,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE;QACrF;YACE,KAAK,EAAE,8EAA8E;YACrF,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,cAAc;SACzC;QACD;YACE,KAAK,EAAE,wCAAwC;YAC/C,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SACjE;QACD,EAAE,KAAK,EAAE,gCAAgC,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE;KAChF,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAEnC,OAAO;QACL,MAAM;QACN,eAAe;QACf,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc;QAC3C,UAAU;QACV,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,YAAY;KAC9C,CAAC;AACJ,CAAC"}

package/dist/src/dast/targets.d.ts

@@ -0,0 +1,30 @@
+import type { Finding } from '../core/finding.js';
+export declare const ZAP_RULE: Record<string, string>;
+export interface Target {
+    id: string;
+    rule: string;
+    zapRule: string;
+    file: string;
+    url: string;
+    cookie: string;
+    from: string;
+    param: string;
+    trigger?: string;
+    untestable?: string;
+}
+export type Fields = string | {
+    untestable: string;
+};
+export interface UrlConfig {
+    base: string;
+    root: string;
+    rules: [string, string, string?, Fields?][];
+}
+export interface BuiltTargets {
+    targets: Target[];
+    skipped: number;
+    noUrl: number;
+}
+export declare function buildTargets(report: {
+    findings: Finding[];
+}, config: UrlConfig): BuiltTargets;

package/dist/src/dast/targets.js

@@ -0,0 +1,79 @@
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+export const ZAP_RULE = {
+    'sql-injection': '40018',
+    'xss': '40012',
+    'command-injection': '90020',
+    'code-injection': '90019',
+    'ssrf': '40046',
+    'path-traversal': '6',
+};
+// No matching rule means no URL: a file that is only included by other files has no address of its own.
+function toAddress(config, file) {
+    const relative = path.relative(config.root, file).replaceAll('\\', '/');
+    for (const [pattern, url, cookie, fields] of config.rules) {
+        const rule = new RegExp(pattern);
+        if (rule.test(relative)) {
+            return {
+                url: new URL(relative.replace(rule, url), config.base).href,
+                cookie: cookie === undefined ? '' : relative.replace(rule, cookie),
+                ...(typeof fields === 'string' ? { trigger: relative.replace(rule, fields) } : {}),
+                ...(typeof fields === 'object' ? { untestable: fields.untestable } : {}),
+            };
+        }
+    }
+    return undefined;
+}
+// Defuse's proven findings -> the list of addresses ZAP should try. A finding is a target only
+// when it is flow-verified, has a ZAP rule, names a request input, and its file has a URL.
+export function buildTargets(report, config) {
+    const targets = [];
+    let skipped = 0;
+    let noUrl = 0;
+    for (const f of report.findings) {
+        if (f.confidence !== 'flow-verified')
+            continue;
+        const zapRule = ZAP_RULE[f.ruleId];
+        const source = f.flowPath.find((step) => step.kind === 'source');
+        const match = source && /\$_(GET|POST|REQUEST|COOKIE)\[\s*['"]([^'"]+)['"]\s*\]/.exec(source.location.snippet);
+        if (zapRule === undefined || !match) {
+            skipped++;
+            continue;
+        }
+        const address = toAddress(config, f.location.file);
+        if (address === undefined) {
+            noUrl++;
+            continue;
+        }
+        targets.push({
+            id: `${f.ruleId}:${f.location.file}:${f.location.startLine}`,
+            rule: f.ruleId,
+            zapRule,
+            file: f.location.file,
+            url: address.url,
+            cookie: address.cookie,
+            from: match[1] ?? '',
+            param: match[2] ?? '',
+            ...(address.trigger !== undefined ? { trigger: address.trigger } : {}),
+            ...(address.untestable !== undefined ? { untestable: address.untestable } : {}),
+        });
+    }
+    return { targets, skipped, noUrl };
+}
+function main() {
+    const [reportPath, configPath] = process.argv.slice(2);
+    if (reportPath === undefined || configPath === undefined) {
+        console.error('usage: node dist/src/dast/targets.js report.json urls.json');
+        process.exit(1);
+    }
+    const report = JSON.parse(readFileSync(reportPath, 'utf8'));
+    const config = JSON.parse(readFileSync(configPath, 'utf8'));
+    const { targets, skipped, noUrl } = buildTargets(report, config);
+    console.log(JSON.stringify(targets, null, 2));
+    console.error(`${targets.length} targets; ${skipped} proven findings skipped (no ZAP rule or no named request input); ${noUrl} skipped (no URL rule matched the file)`);
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    main();
+}
+//# sourceMappingURL=targets.js.map

package/dist/src/dast/targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"targets.js","sourceRoot":"","sources":["../../../src/dast/targets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,CAAC,MAAM,QAAQ,GAA2B;IAC5C,eAAe,EAAE,OAAO;IACxB,KAAK,EAAE,OAAO;IACd,mBAAmB,EAAE,OAAO;IAC5B,gBAAgB,EAAE,OAAO;IACzB,MAAM,EAAE,OAAO;IACf,gBAAgB,EAAE,GAAG;CACxB,CAAC;AAiCF,wGAAwG;AACxG,SAAS,SAAS,CACd,MAAiB,EACjB,IAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtB,OAAO;gBACH,GAAG,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI;gBAC3D,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;gBAClE,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClF,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,+FAA+F;AAC/F,2FAA2F;AAC3F,MAAM,UAAU,YAAY,CAAC,MAA+B,EAAE,MAAiB;IAC3E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,UAAU,KAAK,eAAe;YAAE,SAAS;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,IAAI,wDAAwD,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/G,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;YACV,SAAS;QACb,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,EAAE,CAAC;YACR,SAAS;QACb,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE;YAC5D,IAAI,EAAE,CAAC,CAAC,MAAM;YACd,OAAO;YACP,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;YACrB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;YACpB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;YACrB,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,IAAI;IACT,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAA4B,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAc,CAAC;IACzE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,KAAK,CACT,GAAG,OAAO,CAAC,MAAM,aAAa,OAAO,qEAAqE,KAAK,yCAAyC,CAC3J,CAAC;AACN,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,IAAI,EAAE,CAAC;AACX,CAAC"}

package/dist/src/dast/zap.d.ts

@@ -0,0 +1,42 @@
+import { type Target } from './targets.js';
+/**
+ * STEP TWO OF THE DAST ADD-ON: hand the targets to ZAP, put each verdict next to
+ * the finding it came from.
+ *
+ * targets.ts turned Defuse's proven (flow-verified) findings into a list of
+ * addresses to probe. This file drives OWASP ZAP's active scanner against each
+ * one, restricted to the single ZAP rule that matches the finding's category,
+ * and reports ONE verdict per target:
+ *
+ *   confirmed       ZAP reproduced the bug at that URL with its own payloads.
+ *   not-confirmed   ZAP ran the rule and raised nothing. THE FINDING STANDS.
+ *   could-not-test  ZAP never got to render a verdict (input isn't a request
+ *                   parameter, the scan errored, or it timed out).
+ *
+ * The honesty rule from finding.ts carries over: not-confirmed is NOT cleared.
+ * A dynamic scanner that can't reach a code path proves nothing about it, so a
+ * finding Defuse traced by data flow keeps its status unless ZAP positively
+ * reproduces it. ZAP only ever ADDS confidence; it never subtracts a finding.
+ *
+ * Every target appears in the output exactly once. The run asserts
+ * results.length === targets.length so nothing is dropped silently.
+ */
+type Verdict = 'confirmed' | 'not-confirmed' | 'could-not-test';
+interface Result {
+    id: string;
+    rule: string;
+    zapRule: string;
+    url: string;
+    from: string;
+    param: string;
+    zap: Verdict;
+    detail: string;
+}
+interface Outcome {
+    zap: Verdict;
+    detail: string;
+}
+export declare function groupKey(t: Target): string;
+export declare function classify(zapRule: string, alertPluginIds: string[]): Verdict;
+export declare function joinResults(targets: Target[], byKey: Map<string, Outcome>): Result[];
+export {};

package/dist/src/dast/zap.js

@@ -0,0 +1,184 @@
+import { readFileSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+import { buildTargets } from './targets.js';
+// Which HTTP methods carry the tainted input. $_REQUEST is GET or POST, and a page
+// often guards one while reading the other ($_REQUEST['ip'] behind an isset($_POST['Submit'])),
+// so a REQUEST source has to be tried both ways. A COOKIE source is not a request
+// parameter this harness can mutate (the Cookie header is pinned for auth), so it is
+// reported could-not-test, never not-confirmed.
+function methods(from) {
+    if (from === 'POST')
+        return ['POST'];
+    if (from === 'GET')
+        return ['GET'];
+    if (from === 'REQUEST')
+        return ['GET', 'POST'];
+    return [];
+}
+// One scan covers every target that attacks the same spot the same way.
+export function groupKey(t) {
+    return [t.zapRule, t.from, t.url, t.param, t.cookie, t.trigger ?? '', t.untestable ?? ''].join('|');
+}
+// confirmed iff ZAP raised at least one alert of the finding's own rule.
+export function classify(zapRule, alertPluginIds) {
+    return alertPluginIds.includes(zapRule) ? 'confirmed' : 'not-confirmed';
+}
+// Put each ZAP outcome next to its target by id. A target with no outcome (a
+// group that never ran) becomes could-not-test, never a dropped row.
+export function joinResults(targets, byKey) {
+    return targets.map((t) => {
+        const outcome = byKey.get(groupKey(t)) ?? { zap: 'could-not-test', detail: 'no scan ran for this target' };
+        return { id: t.id, rule: t.rule, zapRule: t.zapRule, url: t.url, from: t.from, param: t.param, ...outcome };
+    });
+}
+const ZAP = process.env.ZAP ?? 'http://localhost:8080';
+const AUTH = process.env.DAST_COOKIE ?? ''; // e.g. "PHPSESSID=abc"; combined with each target's security cookie
+const POLL_MS = 3000;
+const SCAN_TIMEOUT_MS = Number(process.env.DAST_SCAN_TIMEOUT_MS ?? 300_000);
+const RULE_DESC = 'defuse-dast-cookie';
+async function zap(apiPath, params = {}) {
+    const url = new URL(`/JSON/${apiPath}/`, ZAP);
+    for (const [k, v] of Object.entries(params))
+        url.searchParams.set(k, v);
+    const res = await fetch(url);
+    const body = (await res.json());
+    if (typeof body.code === 'string' && typeof body.message === 'string') {
+        throw new Error(`ZAP ${apiPath}: ${body.message} (${body.code})`);
+    }
+    return body;
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function setCookie(cookie) {
+    await zap('replacer/action/removeRule', { description: RULE_DESC }).catch(() => undefined);
+    if (cookie === '')
+        return;
+    await zap('replacer/action/addRule', {
+        description: RULE_DESC,
+        enabled: 'true',
+        matchType: 'REQ_HEADER',
+        matchString: 'Cookie',
+        matchRegex: 'false',
+        replacement: cookie,
+    });
+}
+// One method against one target. confirmed / not-confirmed come from ZAP; a thrown
+// ZAP error becomes could-not-test.
+async function scanOnce(t, verb, trigger) {
+    try {
+        const cookie = [AUTH, t.cookie].filter(Boolean).join('; ');
+        await setCookie(cookie);
+        const seedParams = [`${t.param}=test`, trigger].filter(Boolean).join('&');
+        // Seed the request so the URL is in ZAP's tree (the scan errors otherwise) and so
+        // the vulnerable branch actually runs before the scanner starts mutating the param.
+        let scanUrl = t.url;
+        let postData = '';
+        if (verb === 'GET') {
+            scanUrl = `${t.url}?${seedParams}`;
+            await zap('core/action/accessUrl', { url: scanUrl, followRedirects: 'false' });
+        }
+        else {
+            postData = seedParams;
+            const { pathname, host } = new URL(t.url);
+            const req = `POST ${pathname} HTTP/1.1\r\n` +
+                `Host: ${host}\r\n` +
+                (cookie ? `Cookie: ${cookie}\r\n` : '') +
+                `Content-Type: application/x-www-form-urlencoded\r\n` +
+                `Content-Length: ${Buffer.byteLength(postData)}\r\n\r\n${postData}`;
+            await zap('core/action/sendRequest', { request: req, followRedirects: 'false' });
+        }
+        // Only the finding's own rule runs. The policy is global state, so groups go
+        // one at a time. ponytail: sequential scans, parallelise per-rule policies if it's ever too slow.
+        await zap('ascan/action/disableAllScanners', { scanPolicyName: '' });
+        await zap('ascan/action/enableScanners', { ids: t.zapRule, scanPolicyName: '' });
+        const started = await zap('ascan/action/scan', {
+            url: scanUrl,
+            method: verb,
+            postData,
+            recurse: 'false',
+            inScopeOnly: 'false',
+        });
+        const scanId = String(started.scan);
+        const deadline = Date.now() + SCAN_TIMEOUT_MS;
+        for (;;) {
+            const status = String((await zap('ascan/view/status', { scanId })).status);
+            if (status === '100')
+                break;
+            if (Date.now() > deadline) {
+                await zap('ascan/action/stop', { scanId }).catch(() => undefined);
+                return { zap: 'could-not-test', detail: `scan timed out after ${SCAN_TIMEOUT_MS / 1000}s` };
+            }
+            await sleep(POLL_MS);
+        }
+        const alertIds = (await zap('ascan/view/alertsIds', { scanId })).alertsIds;
+        const pluginIds = [];
+        for (const id of alertIds) {
+            const alert = (await zap('core/view/alert', { id })).alert;
+            if (alert?.pluginId !== undefined)
+                pluginIds.push(String(alert.pluginId));
+        }
+        const verdict = classify(t.zapRule, pluginIds);
+        const hits = pluginIds.filter((p) => p === t.zapRule).length;
+        return {
+            zap: verdict,
+            detail: verdict === 'confirmed' ? `ZAP rule ${t.zapRule} raised ${hits} alert(s) via ${verb}` : `ZAP rule ${t.zapRule} ran via ${verb} and raised none`,
+        };
+    }
+    catch (e) {
+        return { zap: 'could-not-test', detail: `${verb}: ${e.message}` };
+    }
+}
+// A target may need more than one method (REQUEST). confirmed wins; otherwise
+// not-confirmed if any method actually ran; could-not-test only if none could.
+async function scanGroup(t, trigger) {
+    // Not "not-confirmed": that would say ZAP tried and failed, when it never got in.
+    if (t.untestable !== undefined)
+        return { zap: 'could-not-test', detail: t.untestable };
+    const verbs = methods(t.from);
+    if (verbs.length === 0) {
+        return { zap: 'could-not-test', detail: `input comes from a ${t.from.toLowerCase()}, not a request parameter this scan can mutate` };
+    }
+    const outcomes = [];
+    for (const verb of verbs) {
+        const outcome = await scanOnce(t, verb, trigger);
+        if (outcome.zap === 'confirmed')
+            return outcome;
+        outcomes.push(outcome);
+    }
+    return outcomes.find((o) => o.zap === 'not-confirmed') ?? outcomes[0];
+}
+async function main() {
+    const [reportPath, configPath] = process.argv.slice(2);
+    if (reportPath === undefined || configPath === undefined) {
+        console.error('usage: DAST_COOKIE=PHPSESSID=... node dist/src/dast/zap.js report.json urls.json');
+        process.exit(1);
+    }
+    const report = JSON.parse(readFileSync(reportPath, 'utf8'));
+    const config = JSON.parse(readFileSync(configPath, 'utf8'));
+    const { targets, skipped, noUrl } = buildTargets(report, config);
+    const trigger = config.trigger ?? '';
+    // One scan per group; its outcome fills every target in the group.
+    const byKey = new Map();
+    let done = 0;
+    for (const t of targets) {
+        const key = groupKey(t);
+        if (byKey.has(key))
+            continue;
+        process.stderr.write(`[${++done}] ${t.rule} ${t.from} ${t.url} (${t.param}) ... `);
+        const outcome = await scanGroup(t, t.trigger ?? trigger);
+        byKey.set(key, outcome);
+        process.stderr.write(`${outcome.zap}\n`);
+    }
+    const results = joinResults(targets, byKey);
+    if (results.length !== targets.length) {
+        throw new Error(`dropped targets: ${targets.length} in, ${results.length} out`);
+    }
+    console.log(JSON.stringify(results, null, 2));
+    const n = (v) => results.filter((r) => r.zap === v).length;
+    console.error(`\n${results.length} findings tested: ${n('confirmed')} confirmed, ${n('not-confirmed')} not confirmed, ${n('could-not-test')} could not test.` +
+        `\nBefore ZAP: ${skipped} proven findings had no ZAP rule or named input, ${noUrl} had no URL.` +
+        `\nA not-confirmed finding stays a finding: ZAP reproducing nothing does not clear what Defuse traced.`);
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    void main();
+}
+//# sourceMappingURL=zap.js.map

package/dist/src/dast/zap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zap.js","sourceRoot":"","sources":["../../../src/dast/zap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAA+B,MAAM,cAAc,CAAC;AAqDzE,mFAAmF;AACnF,gGAAgG;AAChG,kFAAkF;AAClF,qFAAqF;AACrF,gDAAgD;AAChD,SAAS,OAAO,CAAC,IAAY;IACzB,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,EAAE,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,QAAQ,CAAC,CAAS;IAC9B,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxG,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,cAAwB;IAC9D,OAAO,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;AAC5E,CAAC;AAED,6EAA6E;AAC7E,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,OAAiB,EAAE,KAA2B;IACtE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAyB,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACpH,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;IAChH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,uBAAuB,CAAC;AACvD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,oEAAoE;AAChH,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,CAAC;AAC5E,MAAM,SAAS,GAAG,oBAAoB,CAAC;AAEvC,KAAK,UAAU,GAAG,CAAC,OAAe,EAAE,SAAiC,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,OAAO,OAAO,KAAK,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEnF,KAAK,UAAU,SAAS,CAAC,MAAc;IACnC,MAAM,GAAG,CAAC,4BAA4B,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3F,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO;IAC1B,MAAM,GAAG,CAAC,yBAAyB,EAAE;QACjC,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,YAAY;QACvB,WAAW,EAAE,QAAQ;QACrB,UAAU,EAAE,OAAO;QACnB,WAAW,EAAE,MAAM;KACtB,CAAC,CAAC;AACP,CAAC;AAED,mFAAmF;AACnF,oCAAoC;AACpC,KAAK,UAAU,QAAQ,CAAC,CAAS,EAAE,IAAoB,EAAE,OAAe;IACpE,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE1E,kFAAkF;QAClF,oFAAoF;QACpF,IAAI,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC;QACpB,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACjB,OAAO,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACJ,QAAQ,GAAG,UAAU,CAAC;YACtB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,GAAG,GACL,QAAQ,QAAQ,eAAe;gBAC/B,SAAS,IAAI,MAAM;gBACnB,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,qDAAqD;gBACrD,mBAAmB,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,QAAQ,EAAE,CAAC;YACxE,MAAM,GAAG,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,6EAA6E;QAC7E,kGAAkG;QAClG,MAAM,GAAG,CAAC,iCAAiC,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,GAAG,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;QAEjF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,mBAAmB,EAAE;YAC3C,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,IAAI;YACZ,QAAQ;YACR,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;QAC9C,SAAS,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC3E,IAAI,MAAM,KAAK,KAAK;gBAAE,MAAM;YAC5B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBACxB,MAAM,GAAG,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,wBAAwB,eAAe,GAAG,IAAI,GAAG,EAAE,CAAC;YAChG,CAAC;YACD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAqB,CAAC;QACvF,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,iBAAiB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAmD,CAAC;YACzG,IAAI,KAAK,EAAE,QAAQ,KAAK,SAAS;gBAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC7D,OAAO;YACH,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,WAAW,IAAI,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,YAAY,IAAI,kBAAkB;SAC1J,CAAC;IACN,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IACjF,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,KAAK,UAAU,SAAS,CAAC,CAAS,EAAE,OAAe;IAC/C,kFAAkF;IAClF,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;IACvF,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,gDAAgD,EAAE,CAAC;IACzI,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW;YAAE,OAAO,OAAO,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,eAAe,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAE,CAAC;AAC3E,CAAC;AAED,KAAK,UAAU,IAAI;IACf,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;QAClG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAA4B,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAW,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IAErC,mEAAmE;IACnE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC;QACzD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,CAAC,MAAM,QAAQ,OAAO,CAAC,MAAM,MAAM,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE9C,MAAM,CAAC,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,OAAO,CAAC,KAAK,CACT,KAAK,OAAO,CAAC,MAAM,qBAAqB,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAC,gBAAgB,CAAC,kBAAkB;QAC3I,iBAAiB,OAAO,oDAAoD,KAAK,cAAc;QAC/F,uGAAuG,CAC9G,CAAC;AACN,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,KAAK,IAAI,EAAE,CAAC;AAChB,CAAC"}