agentic-qe 3.6.8 → 3.6.9

package/v3/dist/domains/security-compliance/services/security-auditor-sast.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Agentic QE v3 - Security Auditor SAST Scanner
+ * Extracted from security-auditor.ts - Static Application Security Testing
+ */
+import type { VulnerabilitySeverity, VulnerabilityCategory, SASTResult } from '../interfaces.js';
+interface SASTVulnerabilityPattern {
+    id: string;
+    pattern: RegExp;
+    title: string;
+    description: string;
+    severity: VulnerabilitySeverity;
+    category: VulnerabilityCategory;
+    remediation: string;
+    fixExample?: string;
+    cweId: string;
+}
+/**
+ * Get the default SAST vulnerability patterns for JS/TS analysis
+ */
+export declare function getSASTVulnerabilityPatterns(): SASTVulnerabilityPattern[];
+/**
+ * Perform SAST scan using AST-based analysis for JavaScript/TypeScript
+ * Scans for common vulnerability patterns: XSS, SQL injection, command injection, path traversal
+ */
+export declare function performSASTScan(findSourceFiles: (dir: string) => Promise<string[]>, shouldExclude: (filePath: string) => boolean): Promise<SASTResult>;
+export {};
+//# sourceMappingURL=security-auditor-sast.d.ts.map

package/v3/dist/domains/security-compliance/services/security-auditor-sast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-auditor-sast.d.ts","sourceRoot":"","sources":["../../../../src/domains/security-compliance/services/security-auditor-sast.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAEV,qBAAqB,EACrB,qBAAqB,EAGrB,UAAU,EACX,MAAM,kBAAkB,CAAC;AAM1B,UAAU,wBAAwB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,qBAAqB,CAAC;IAChC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,4BAA4B,IAAI,wBAAwB,EAAE,CAwIzE;AAMD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,EACnD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GAC3C,OAAO,CAAC,UAAU,CAAC,CA8HrB"}

package/v3/dist/domains/security-compliance/services/security-auditor-sast.js

@@ -0,0 +1,279 @@
+/**
+ * Agentic QE v3 - Security Auditor SAST Scanner
+ * Extracted from security-auditor.ts - Static Application Security Testing
+ */
+import { v4 as uuidv4 } from 'uuid';
+import * as fs from 'fs/promises';
+import * as path from 'path';
+/**
+ * Get the default SAST vulnerability patterns for JS/TS analysis
+ */
+export function getSASTVulnerabilityPatterns() {
+    return [
+        // SQL Injection patterns
+        {
+            id: 'sqli-concat',
+            pattern: /(?:query|execute|exec|run)\s*\(\s*(?:['"`].*?\s*\+|`[^`]*\$\{)/gi,
+            title: 'SQL Injection via String Concatenation',
+            description: 'SQL query constructed using string concatenation with potentially untrusted input',
+            severity: 'critical',
+            category: 'injection',
+            remediation: 'Use parameterized queries or prepared statements',
+            fixExample: 'db.query("SELECT * FROM users WHERE id = $1", [userId])',
+            cweId: 'CWE-89',
+        },
+        // XSS patterns
+        {
+            id: 'xss-innerhtml',
+            pattern: /\.innerHTML\s*=\s*(?!['"`])/g,
+            title: 'XSS via innerHTML Assignment',
+            description: 'Direct innerHTML assignment with potentially unsanitized content',
+            severity: 'high',
+            category: 'xss',
+            remediation: 'Use textContent for text, or sanitize HTML with DOMPurify',
+            fixExample: 'element.textContent = userInput;',
+            cweId: 'CWE-79',
+        },
+        {
+            id: 'xss-document-write',
+            pattern: /document\.write\s*\([^)]+\)/g,
+            title: 'XSS via document.write',
+            description: 'document.write() can execute scripts from untrusted data',
+            severity: 'high',
+            category: 'xss',
+            remediation: 'Avoid document.write(); use DOM manipulation methods',
+            cweId: 'CWE-79',
+        },
+        {
+            id: 'xss-eval',
+            pattern: /(?<!\.)\beval\s*\([^)]+\)/g,
+            title: 'Code Injection via eval()',
+            description: 'eval() executes arbitrary code and is a major security risk',
+            severity: 'critical',
+            category: 'xss',
+            remediation: 'Never use eval(); use JSON.parse() for JSON data',
+            fixExample: 'JSON.parse(jsonString)',
+            cweId: 'CWE-95',
+        },
+        {
+            id: 'xss-dangerous-react',
+            pattern: /dangerouslySetInnerHTML\s*=\s*\{/g,
+            title: 'React dangerouslySetInnerHTML Usage',
+            description: 'dangerouslySetInnerHTML bypasses React XSS protections',
+            severity: 'medium',
+            category: 'xss',
+            remediation: 'Sanitize HTML content with DOMPurify before use',
+            fixExample: 'dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(content) }}',
+            cweId: 'CWE-79',
+        },
+        // Command Injection patterns
+        {
+            id: 'cmd-injection-exec',
+            pattern: /(?:child_process\.)?exec\s*\(\s*(?:[^,)]*\s*\+|`[^`]*\$\{)/g,
+            title: 'Command Injection via exec()',
+            description: 'Shell command execution with unsanitized input',
+            severity: 'critical',
+            category: 'injection',
+            remediation: 'Use execFile() with argument array instead of exec()',
+            fixExample: 'execFile("command", [arg1, arg2], callback)',
+            cweId: 'CWE-78',
+        },
+        {
+            id: 'cmd-injection-spawn-shell',
+            pattern: /spawn\s*\([^)]+,\s*\{[^}]*shell\s*:\s*true/g,
+            title: 'Dangerous Shell Option in spawn()',
+            description: 'spawn() with shell: true can enable command injection',
+            severity: 'high',
+            category: 'injection',
+            remediation: 'Avoid shell: true option; use direct command execution',
+            cweId: 'CWE-78',
+        },
+        // Path Traversal patterns
+        {
+            id: 'path-traversal-readfile',
+            pattern: /(?:readFile|readFileSync)\s*\([^)]*\+/g,
+            title: 'Path Traversal via File Read',
+            description: 'File read operation with concatenated path may allow directory traversal',
+            severity: 'high',
+            category: 'access-control',
+            remediation: 'Validate and sanitize file paths; use path.resolve() and check against base directory',
+            fixExample: 'const safePath = path.resolve(baseDir, path.basename(userInput))',
+            cweId: 'CWE-22',
+        },
+        {
+            id: 'path-traversal-writefile',
+            pattern: /(?:writeFile|writeFileSync)\s*\([^)]*\+/g,
+            title: 'Path Traversal via File Write',
+            description: 'File write operation with concatenated path may allow directory traversal',
+            severity: 'high',
+            category: 'access-control',
+            remediation: 'Validate file paths before writing; ensure path is within allowed directory',
+            cweId: 'CWE-22',
+        },
+        // Hardcoded secrets
+        {
+            id: 'secret-private-key',
+            pattern: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/g,
+            title: 'Private Key Detected in Source',
+            description: 'Private key found in source code',
+            severity: 'critical',
+            category: 'sensitive-data',
+            remediation: 'Store private keys in secure key management systems, not in code',
+            cweId: 'CWE-798',
+        },
+        // Insecure configurations
+        {
+            id: 'config-tls-disabled',
+            pattern: /rejectUnauthorized\s*:\s*false/g,
+            title: 'TLS Certificate Validation Disabled',
+            description: 'Disabling TLS certificate validation exposes to MITM attacks',
+            severity: 'high',
+            category: 'security-misconfiguration',
+            remediation: 'Always enable TLS certificate validation in production',
+            cweId: 'CWE-295',
+        },
+        {
+            id: 'config-cors-wildcard',
+            pattern: /cors\s*\(\s*\{[^}]*origin\s*:\s*['"]\*['"]/gi,
+            title: 'Permissive CORS Configuration',
+            description: 'CORS allows all origins (*) which may expose sensitive data',
+            severity: 'medium',
+            category: 'security-misconfiguration',
+            remediation: 'Restrict CORS to specific trusted origins',
+            fixExample: 'cors({ origin: ["https://trusted-domain.com"] })',
+            cweId: 'CWE-942',
+        },
+    ];
+}
+// ============================================================================
+// SAST Scanning
+// ============================================================================
+/**
+ * Perform SAST scan using AST-based analysis for JavaScript/TypeScript
+ * Scans for common vulnerability patterns: XSS, SQL injection, command injection, path traversal
+ */
+export async function performSASTScan(findSourceFiles, shouldExclude) {
+    const scanId = uuidv4();
+    const startTime = Date.now();
+    const vulnerabilities = [];
+    let filesScanned = 0;
+    let linesScanned = 0;
+    try {
+        const sourceFiles = await findSourceFiles(process.cwd());
+        const vulnerabilityPatterns = getSASTVulnerabilityPatterns();
+        for (const filePath of sourceFiles) {
+            if (shouldExclude(filePath)) {
+                continue;
+            }
+            // Only scan JS/TS files
+            const ext = path.extname(filePath).toLowerCase();
+            if (!['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'].includes(ext)) {
+                continue;
+            }
+            try {
+                const content = await fs.readFile(filePath, 'utf-8');
+                const lines = content.split('\n');
+                filesScanned++;
+                linesScanned += lines.length;
+                // Check each vulnerability pattern
+                for (const vulnPattern of vulnerabilityPatterns) {
+                    // Reset regex state
+                    vulnPattern.pattern.lastIndex = 0;
+                    let match;
+                    while ((match = vulnPattern.pattern.exec(content)) !== null) {
+                        // Calculate line and column
+                        const beforeMatch = content.substring(0, match.index);
+                        const linesBefore = beforeMatch.split('\n');
+                        const lineNumber = linesBefore.length;
+                        const column = linesBefore[linesBefore.length - 1].length + 1;
+                        // Check if in comment
+                        const currentLine = lines[lineNumber - 1] || '';
+                        if (currentLine.trimStart().startsWith('//') || currentLine.trimStart().startsWith('*')) {
+                            continue;
+                        }
+                        // Check for nosec annotation
+                        if (currentLine.includes('// nosec') || currentLine.includes('// security-ignore')) {
+                            continue;
+                        }
+                        // Extract snippet with context
+                        const startLine = Math.max(0, lineNumber - 2);
+                        const endLine = Math.min(lines.length, lineNumber + 1);
+                        const snippet = lines.slice(startLine, endLine).join('\n');
+                        const location = {
+                            file: filePath,
+                            line: lineNumber,
+                            column,
+                            snippet,
+                        };
+                        const remediation = {
+                            description: vulnPattern.remediation,
+                            fixExample: vulnPattern.fixExample,
+                            estimatedEffort: vulnPattern.severity === 'critical' ? 'moderate' : 'minor',
+                            automatable: vulnPattern.severity === 'low' || vulnPattern.severity === 'medium',
+                        };
+                        vulnerabilities.push({
+                            id: uuidv4(),
+                            cveId: undefined,
+                            title: vulnPattern.title,
+                            description: `${vulnPattern.description} [${vulnPattern.cweId}]`,
+                            severity: vulnPattern.severity,
+                            category: vulnPattern.category,
+                            location,
+                            remediation,
+                            references: [
+                                `https://cwe.mitre.org/data/definitions/${vulnPattern.cweId.replace('CWE-', '')}.html`,
+                            ],
+                        });
+                    }
+                }
+            }
+            catch {
+                // Skip files that can't be read
+            }
+        }
+    }
+    catch (error) {
+        console.error('SAST scan failed:', error);
+    }
+    const scanDurationMs = Date.now() - startTime;
+    // Calculate summary
+    let critical = 0, high = 0, medium = 0, low = 0, informational = 0;
+    for (const vuln of vulnerabilities) {
+        switch (vuln.severity) {
+            case 'critical':
+                critical++;
+                break;
+            case 'high':
+                high++;
+                break;
+            case 'medium':
+                medium++;
+                break;
+            case 'low':
+                low++;
+                break;
+            case 'informational':
+                informational++;
+                break;
+        }
+    }
+    return {
+        scanId,
+        vulnerabilities,
+        summary: {
+            critical,
+            high,
+            medium,
+            low,
+            informational,
+            totalFiles: filesScanned,
+            scanDurationMs,
+        },
+        coverage: {
+            filesScanned,
+            linesScanned,
+            rulesApplied: 12,
+        },
+    };
+}
+//# sourceMappingURL=security-auditor-sast.js.map

package/v3/dist/domains/security-compliance/services/security-auditor-sast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-auditor-sast.js","sourceRoot":"","sources":["../../../../src/domains/security-compliance/services/security-auditor-sast.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AA0B7B;;GAEG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,yBAAyB;QACzB;YACE,EAAE,EAAE,aAAa;YACjB,OAAO,EAAE,kEAAkE;YAC3E,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,mFAAmF;YAChG,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,WAAW;YACrB,WAAW,EAAE,kDAAkD;YAC/D,UAAU,EAAE,yDAAyD;YACrE,KAAK,EAAE,QAAQ;SAChB;QACD,eAAe;QACf;YACE,EAAE,EAAE,eAAe;YACnB,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE,8BAA8B;YACrC,WAAW,EAAE,kEAAkE;YAC/E,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,2DAA2D;YACxE,UAAU,EAAE,kCAAkC;YAC9C,KAAK,EAAE,QAAQ;SAChB;QACD;YACE,EAAE,EAAE,oBAAoB;YACxB,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE,wBAAwB;YAC/B,WAAW,EAAE,0DAA0D;YACvE,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,sDAAsD;YACnE,KAAK,EAAE,QAAQ;SAChB;QACD;YACE,EAAE,EAAE,UAAU;YACd,OAAO,EAAE,4BAA4B;YACrC,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,6DAA6D;YAC1E,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,kDAAkD;YAC/D,UAAU,EAAE,wBAAwB;YACpC,KAAK,EAAE,QAAQ;SAChB;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,OAAO,EAAE,mCAAmC;YAC5C,KAAK,EAAE,qCAAqC;YAC5C,WAAW,EAAE,wDAAwD;YACrE,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,iDAAiD;YAC9D,UAAU,EAAE,mEAAmE;YAC/E,KAAK,EAAE,QAAQ;SAChB;QACD,6BAA6B;QAC7B;YACE,EAAE,EAAE,oBAAoB;YACxB,OAAO,EAAE,6DAA6D;YACtE,KAAK,EAAE,8BAA8B;YACrC,WAAW,EAAE,gDAAgD;YAC7D,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,WAAW;YACrB,WAAW,EAAE,sDAAsD;YACnE,UAAU,EAAE,6CAA6C;YACzD,KAAK,EAAE,QAAQ;SAChB;QACD;YACE,EAAE,EAAE,2BAA2B;YAC/B,OAAO,EAAE,6CAA6C;YACtD,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EAAE,uDAAuD;YACpE,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,WAAW;YACrB,WAAW,EAAE,wDAAwD;YACrE,KAAK,EAAE,QAAQ;SAChB;QACD,0BAA0B;QAC1B;YACE,EAAE,EAAE,yBAAyB;YAC7B,OAAO,EAAE,wCAAwC;YACjD,KAAK,EAAE,8BAA8B;YACrC,WAAW,EAAE,0EAA0E;YACvF,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,gBAAgB;YAC1B,WAAW,EAAE,uFAAuF;YACpG,UAAU,EAAE,kEAAkE;YAC9E,KAAK,EAAE,QAAQ;SAChB;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,OAAO,EAAE,0CAA0C;YACnD,KAAK,EAAE,+BAA+B;YACtC,WAAW,EAAE,2EAA2E;YACxF,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,gBAAgB;YAC1B,WAAW,EAAE,6EAA6E;YAC1F,KAAK,EAAE,QAAQ;SAChB;QACD,oBAAoB;QACpB;YACE,EAAE,EAAE,oBAAoB;YACxB,OAAO,EAAE,6CAA6C;YACtD,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,kCAAkC;YAC/C,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,gBAAgB;YAC1B,WAAW,EAAE,kEAAkE;YAC/E,KAAK,EAAE,SAAS;SACjB;QACD,0BAA0B;QAC1B;YACE,EAAE,EAAE,qBAAqB;YACzB,OAAO,EAAE,iCAAiC;YAC1C,KAAK,EAAE,qCAAqC;YAC5C,WAAW,EAAE,8DAA8D;YAC3E,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,2BAA2B;YACrC,WAAW,EAAE,wDAAwD;YACrE,KAAK,EAAE,SAAS;SACjB;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,OAAO,EAAE,8CAA8C;YACvD,KAAK,EAAE,+BAA+B;YACtC,WAAW,EAAE,6DAA6D;YAC1E,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,2BAA2B;YACrC,WAAW,EAAE,2CAA2C;YACxD,UAAU,EAAE,kDAAkD;YAC9D,KAAK,EAAE,SAAS;SACjB;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,eAAmD,EACnD,aAA4C;IAE5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,eAAe,GAAoB,EAAE,CAAC;IAC5C,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,MAAM,qBAAqB,GAAG,4BAA4B,EAAE,CAAC;QAE7D,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;YACnC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,SAAS;YACX,CAAC;YAED,wBAAwB;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClE,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,YAAY,EAAE,CAAC;gBACf,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC;gBAE7B,mCAAmC;gBACnC,KAAK,MAAM,WAAW,IAAI,qBAAqB,EAAE,CAAC;oBAChD,oBAAoB;oBACpB,WAAW,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;oBAClC,IAAI,KAA6B,CAAC;oBAElC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;wBAC5D,4BAA4B;wBAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;wBACtD,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBAC5C,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC;wBACtC,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;wBAE9D,sBAAsB;wBACtB,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;wBAChD,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;4BACxF,SAAS;wBACX,CAAC;wBAED,6BAA6B;wBAC7B,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;4BACnF,SAAS;wBACX,CAAC;wBAED,+BAA+B;wBAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;wBAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;wBACvD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAE3D,MAAM,QAAQ,GAA0B;4BACtC,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,UAAU;4BAChB,MAAM;4BACN,OAAO;yBACR,CAAC;wBAEF,MAAM,WAAW,GAAsB;4BACrC,WAAW,EAAE,WAAW,CAAC,WAAW;4BACpC,UAAU,EAAE,WAAW,CAAC,UAAU;4BAClC,eAAe,EAAE,WAAW,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO;4BAC3E,WAAW,EAAE,WAAW,CAAC,QAAQ,KAAK,KAAK,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ;yBACjF,CAAC;wBAEF,eAAe,CAAC,IAAI,CAAC;4BACnB,EAAE,EAAE,MAAM,EAAE;4BACZ,KAAK,EAAE,SAAS;4BAChB,KAAK,EAAE,WAAW,CAAC,KAAK;4BACxB,WAAW,EAAE,GAAG,WAAW,CAAC,WAAW,KAAK,WAAW,CAAC,KAAK,GAAG;4BAChE,QAAQ,EAAE,WAAW,CAAC,QAAQ;4BAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;4BAC9B,QAAQ;4BACR,WAAW;4BACX,UAAU,EAAE;gCACV,0CAA0C,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO;6BACvF;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAE9C,oBAAoB;IACpB,IAAI,QAAQ,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,aAAa,GAAG,CAAC,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,KAAK,UAAU;gBAAE,QAAQ,EAAE,CAAC;gBAAC,MAAM;YACnC,KAAK,MAAM;gBAAE,IAAI,EAAE,CAAC;gBAAC,MAAM;YAC3B,KAAK,QAAQ;gBAAE,MAAM,EAAE,CAAC;gBAAC,MAAM;YAC/B,KAAK,KAAK;gBAAE,GAAG,EAAE,CAAC;gBAAC,MAAM;YACzB,KAAK,eAAe;gBAAE,aAAa,EAAE,CAAC;gBAAC,MAAM;QAC/C,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,eAAe;QACf,OAAO,EAAE;YACP,QAAQ;YACR,IAAI;YACJ,MAAM;YACN,GAAG;YACH,aAAa;YACb,UAAU,EAAE,YAAY;YACxB,cAAc;SACf;QACD,QAAQ,EAAE;YACR,YAAY;YACZ,YAAY;YACZ,YAAY,EAAE,EAAE;SACjB;KACF,CAAC;AACJ,CAAC"}

package/v3/dist/domains/security-compliance/services/security-auditor-secrets.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Agentic QE v3 - Security Auditor Secret Scanner
+ * Extracted from security-auditor.ts - Secret/credential detection
+ */
+import type { FilePath } from '../../../shared/value-objects/index.js';
+import type { DetectedSecret } from '../interfaces.js';
+interface SecretPattern {
+    name: string;
+    type: DetectedSecret['type'];
+    regex: RegExp;
+    entropyThreshold?: number;
+}
+/**
+ * Get the comprehensive set of secret detection patterns
+ */
+export declare function getSecretPatterns(): SecretPattern[];
+/**
+ * Calculate Shannon entropy of a string
+ */
+export declare function calculateEntropy(str: string): number;
+/**
+ * Create a masked snippet for display
+ */
+export declare function createMaskedSnippet(line: string, matchIndex: number, matchLength: number): string;
+/**
+ * Validate if a detected secret is likely valid (basic validation)
+ */
+export declare function validateSecret(type: DetectedSecret['type'], value: string): boolean;
+/**
+ * Scan a single file for secrets
+ */
+export declare function scanFileForSecrets(file: FilePath): Promise<DetectedSecret[]>;
+export {};
+//# sourceMappingURL=security-auditor-secrets.d.ts.map

package/v3/dist/domains/security-compliance/services/security-auditor-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-auditor-secrets.d.ts","sourceRoot":"","sources":["../../../../src/domains/security-compliance/services/security-auditor-secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,KAAK,EACV,cAAc,EAEf,MAAM,kBAAkB,CAAC;AAM1B,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,aAAa,EAAE,CAyHnD;AAMD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAkBpD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAsBjG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAenF;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAgDlF"}

package/v3/dist/domains/security-compliance/services/security-auditor-secrets.js

@@ -0,0 +1,236 @@
+/**
+ * Agentic QE v3 - Security Auditor Secret Scanner
+ * Extracted from security-auditor.ts - Secret/credential detection
+ */
+import * as fs from 'fs/promises';
+/**
+ * Get the comprehensive set of secret detection patterns
+ */
+export function getSecretPatterns() {
+    return [
+        // AWS Keys
+        {
+            name: 'AWS Access Key ID',
+            type: 'api-key',
+            regex: /AKIA[0-9A-Z]{16}/g,
+        },
+        {
+            name: 'AWS Secret Access Key',
+            type: 'api-key',
+            regex: /(?:aws[_-]?secret[_-]?access[_-]?key|AWS_SECRET_ACCESS_KEY)['"]?\s*[:=]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,
+            entropyThreshold: 4.0,
+        },
+        // GitHub Tokens
+        {
+            name: 'GitHub Personal Access Token',
+            type: 'token',
+            regex: /ghp_[A-Za-z0-9]{36}/g,
+        },
+        {
+            name: 'GitHub OAuth Access Token',
+            type: 'token',
+            regex: /gho_[A-Za-z0-9]{36}/g,
+        },
+        {
+            name: 'GitHub App Token',
+            type: 'token',
+            regex: /(?:ghu|ghs)_[A-Za-z0-9]{36}/g,
+        },
+        // Generic API Keys
+        {
+            name: 'Generic API Key',
+            type: 'api-key',
+            regex: /(?:api[_-]?key|apikey|api_secret)['"]?\s*[:=]\s*['"]([A-Za-z0-9_\-]{20,})['"]?/gi,
+            entropyThreshold: 3.5,
+        },
+        // OpenAI API Key
+        {
+            name: 'OpenAI API Key',
+            type: 'api-key',
+            regex: /sk-[A-Za-z0-9]{48}/g,
+        },
+        // Stripe Keys
+        {
+            name: 'Stripe Secret Key',
+            type: 'api-key',
+            regex: /sk_live_[A-Za-z0-9]{24,}/g,
+        },
+        {
+            name: 'Stripe Publishable Key',
+            type: 'api-key',
+            regex: /pk_live_[A-Za-z0-9]{24,}/g,
+        },
+        // Private Keys
+        {
+            name: 'RSA Private Key',
+            type: 'private-key',
+            regex: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/gi,
+        },
+        {
+            name: 'PGP Private Key',
+            type: 'private-key',
+            regex: /-----BEGIN\s+PGP\s+PRIVATE\s+KEY\s+BLOCK-----/gi,
+        },
+        {
+            name: 'SSH Private Key',
+            type: 'private-key',
+            regex: /-----BEGIN\s+(?:OPENSSH|DSA|EC)?\s*PRIVATE\s+KEY-----/gi,
+        },
+        // Passwords
+        {
+            name: 'Password Assignment',
+            type: 'password',
+            regex: /(?:password|passwd|pwd|secret)['"]?\s*[:=]\s*['"]([^'"\s]{8,})['"]?/gi,
+            entropyThreshold: 3.0,
+        },
+        // Database Connection Strings
+        {
+            name: 'Database Connection String',
+            type: 'password',
+            regex: /(?:mongodb|postgres|mysql|redis):\/\/[^:]+:[^@]+@[^\s'"]+/gi,
+        },
+        // JWT Tokens
+        {
+            name: 'JWT Token',
+            type: 'token',
+            regex: /eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g,
+            entropyThreshold: 4.0,
+        },
+        // Slack Tokens
+        {
+            name: 'Slack Token',
+            type: 'token',
+            regex: /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+        },
+        // Google API Key
+        {
+            name: 'Google API Key',
+            type: 'api-key',
+            regex: /AIza[A-Za-z0-9_-]{35}/g,
+        },
+        // Twilio
+        {
+            name: 'Twilio API Key',
+            type: 'api-key',
+            regex: /SK[A-Za-z0-9]{32}/g,
+        },
+        // SendGrid
+        {
+            name: 'SendGrid API Key',
+            type: 'api-key',
+            regex: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,
+        },
+        // Certificates
+        {
+            name: 'X.509 Certificate',
+            type: 'certificate',
+            regex: /-----BEGIN\s+CERTIFICATE-----/gi,
+        },
+    ];
+}
+// ============================================================================
+// Secret Scanning Utilities
+// ============================================================================
+/**
+ * Calculate Shannon entropy of a string
+ */
+export function calculateEntropy(str) {
+    if (!str || str.length === 0)
+        return 0;
+    const charFrequency = {};
+    for (const char of str) {
+        charFrequency[char] = (charFrequency[char] || 0) + 1;
+    }
+    let entropy = 0;
+    const len = str.length;
+    for (const char in charFrequency) {
+        const probability = charFrequency[char] / len;
+        entropy -= probability * Math.log2(probability);
+    }
+    return entropy;
+}
+/**
+ * Create a masked snippet for display
+ */
+export function createMaskedSnippet(line, matchIndex, matchLength) {
+    const contextBefore = 20;
+    const contextAfter = 10;
+    const start = Math.max(0, matchIndex - contextBefore);
+    const end = Math.min(line.length, matchIndex + matchLength + contextAfter);
+    let snippet = line.substring(start, end);
+    // Mask the secret value (show first 4 and last 4 characters)
+    const secretStart = matchIndex - start;
+    const secretInSnippet = snippet.substring(secretStart, secretStart + matchLength);
+    if (secretInSnippet.length > 8) {
+        const masked = secretInSnippet.substring(0, 4) + '...' + secretInSnippet.substring(secretInSnippet.length - 4);
+        snippet = snippet.substring(0, secretStart) + masked + snippet.substring(secretStart + matchLength);
+    }
+    if (start > 0)
+        snippet = '...' + snippet;
+    if (end < line.length)
+        snippet = snippet + '...';
+    return snippet;
+}
+/**
+ * Validate if a detected secret is likely valid (basic validation)
+ */
+export function validateSecret(type, value) {
+    switch (type) {
+        case 'api-key':
+            return value.length >= 20 && /[a-z]/.test(value) && /[A-Z0-9]/.test(value);
+        case 'token':
+            return value.length >= 20;
+        case 'password':
+            return !['password', 'secret', 'changeme', '12345678', 'qwerty'].includes(value.toLowerCase());
+        case 'private-key':
+            return true;
+        case 'certificate':
+            return true;
+        default:
+            return true;
+    }
+}
+/**
+ * Scan a single file for secrets
+ */
+export async function scanFileForSecrets(file) {
+    const secrets = [];
+    try {
+        const content = await fs.readFile(file.value, 'utf-8');
+        const lines = content.split('\n');
+        const secretPatterns = getSecretPatterns();
+        for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {
+            const line = lines[lineIndex];
+            const lineNumber = lineIndex + 1;
+            for (const pattern of secretPatterns) {
+                pattern.regex.lastIndex = 0;
+                let match;
+                while ((match = pattern.regex.exec(line)) !== null) {
+                    const matchedValue = match[1] || match[0];
+                    const entropy = calculateEntropy(matchedValue);
+                    if (pattern.entropyThreshold && entropy < pattern.entropyThreshold) {
+                        continue;
+                    }
+                    const snippet = createMaskedSnippet(line, match.index, matchedValue.length);
+                    const location = {
+                        file: file.value,
+                        line: lineNumber,
+                        column: match.index + 1,
+                        snippet,
+                    };
+                    secrets.push({
+                        type: pattern.type,
+                        location,
+                        entropy,
+                        isValid: validateSecret(pattern.type, matchedValue),
+                    });
+                }
+            }
+        }
+    }
+    catch (error) {
+        console.error(`Failed to scan file for secrets: ${file.value}`, error);
+    }
+    return secrets;
+}
+//# sourceMappingURL=security-auditor-secrets.js.map

package/v3/dist/domains/security-compliance/services/security-auditor-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-auditor-secrets.js","sourceRoot":"","sources":["../../../../src/domains/security-compliance/services/security-auditor-secrets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAkBlC;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO;QACL,WAAW;QACX;YACE,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,mBAAmB;SAC3B;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,4GAA4G;YACnH,gBAAgB,EAAE,GAAG;SACtB;QACD,gBAAgB;QAChB;YACE,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,sBAAsB;SAC9B;QACD;YACE,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,sBAAsB;SAC9B;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,8BAA8B;SACtC;QACD,mBAAmB;QACnB;YACE,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,kFAAkF;YACzF,gBAAgB,EAAE,GAAG;SACtB;QACD,iBAAiB;QACjB;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,qBAAqB;SAC7B;QACD,cAAc;QACd;YACE,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,2BAA2B;SACnC;QACD;YACE,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,2BAA2B;SACnC;QACD,eAAe;QACf;YACE,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,8CAA8C;SACtD;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,iDAAiD;SACzD;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,yDAAyD;SACjE;QACD,YAAY;QACZ;YACE,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,uEAAuE;YAC9E,gBAAgB,EAAE,GAAG;SACtB;QACD,8BAA8B;QAC9B;YACE,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,6DAA6D;SACrE;QACD,aAAa;QACb;YACE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,uDAAuD;YAC9D,gBAAgB,EAAE,GAAG;SACtB;QACD,eAAe;QACf;YACE,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,+BAA+B;SACvC;QACD,iBAAiB;QACjB;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,wBAAwB;SAChC;QACD,SAAS;QACT;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,oBAAoB;SAC5B;QACD,WAAW;QACX;YACE,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,2CAA2C;SACnD;QACD,eAAe;QACf;YACE,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,iCAAiC;SACzC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEvC,MAAM,aAAa,GAA2B,EAAE,CAAC;IAEjD,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IAEvB,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAC9C,OAAO,IAAI,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,UAAkB,EAAE,WAAmB;IACvF,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,MAAM,YAAY,GAAG,EAAE,CAAC;IAExB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,aAAa,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,YAAY,CAAC,CAAC;IAE3E,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEzC,6DAA6D;IAC7D,MAAM,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;IACvC,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,GAAG,WAAW,CAAC,CAAC;IAElF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/G,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,GAAG,WAAW,CAAC,CAAC;IACtG,CAAC;IAED,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IACzC,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;IAEjD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAA4B,EAAE,KAAa;IACxE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7E,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAC5B,KAAK,UAAU;YACb,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACjG,KAAK,aAAa;YAChB,OAAO,IAAI,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,IAAI,CAAC;QACd;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAc;IACrD,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAC;QAE3C,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;YAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;YAC9B,MAAM,UAAU,GAAG,SAAS,GAAG,CAAC,CAAC;YAEjC,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;gBACrC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;gBAE5B,IAAI,KAA6B,CAAC;gBAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;oBAE1C,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;oBAE/C,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;wBACnE,SAAS;oBACX,CAAC;oBAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;oBAE5E,MAAM,QAAQ,GAA0B;wBACtC,IAAI,EAAE,IAAI,CAAC,KAAK;wBAChB,IAAI,EAAE,UAAU;wBAChB,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;wBACvB,OAAO;qBACR,CAAC;oBAEF,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,QAAQ;wBACR,OAAO;wBACP,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC;qBACpD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}