circle-ir 3.84.0 → 3.85.1

package/dist/analysis/passes/scan-secrets-pass.d.ts

@@ -50,10 +50,18 @@ export declare class ScanSecretsPass implements AnalysisPass<ScanSecretsPassResu
     /** Length + shape + denylist filter before entropy is computed. */
     private isCandidate;
     /**
-     * Shannon-entropy gate. Base64-shaped strings need higher entropy than
-     * hex-shaped (hex alphabet is 4 bits/char by construction). When the
-     * surrounding line contains a credential-shaped variable name, both
-     * thresholds drop by 0.2 bits/char.
+     * Shannon-entropy gate (#125 Gate 4 — REQUIRED field-name match).
+     *
+     * The entropy layer emits ONLY when the enclosing assignment LHS
+     * identifier matches a credential keyword (password / secret / token /
+     * api_key / etc.). Without this requirement, the layer flagged every
+     * high-entropy string — attribution keys, base64 resource blobs, public
+     * encoding alphabets — as credentials. Provider patterns (Layer 1) and
+     * named-credential matcher (Layer 1b) remain the recall safety net for
+     * credentials that don't fit the `FIELD = "..."` shape.
+     *
+     * Base64-shaped strings need higher entropy than hex-shaped (hex alphabet
+     * is 4 bits/char by construction).
      */
     private passesEntropyGate;
 }

package/dist/analysis/passes/scan-secrets-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan-secrets-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/scan-secrets-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqQ9E,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,eAAgB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IACzE,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;IAqI5C,mEAAmE;IACnE,OAAO,CAAC,WAAW;IAanB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;CAO1B"}
+{"version":3,"file":"scan-secrets-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/scan-secrets-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAoc9E,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,eAAgB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IACzE,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;IAiK5C,mEAAmE;IACnE,OAAO,CAAC,WAAW;IAanB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,iBAAiB;CAO1B"}

package/dist/analysis/passes/scan-secrets-pass.js

@@ -46,6 +46,18 @@ const TEST_FILENAME_RE = /(?:\.(?:test|spec)\.[cm]?[jt]sx?|_test\.go|_test\.py|T
 function isTestFile(file) {
     return TEST_PATH_RE.test(file) || TEST_FILENAME_RE.test(file);
 }
+// ---------------------------------------------------------------------------
+// Generated-code skip heuristic (#125)
+//
+// Generated files routinely embed high-entropy attribution keys, provenance
+// hashes, and embedded resource blobs that trip the entropy layer. Wholesale
+// skip them, same as test files. Cognium-dev #125.
+// ---------------------------------------------------------------------------
+const GENERATED_PATH_RE = /(?:^|[\\/])(?:gen|generated|build[\\/]generated|src[\\/](?:main|test)[\\/]generated|target[\\/]generated-sources|target[\\/]generated-test-sources|node_modules[\\/]\.cache)(?:[\\/]|$)/i;
+const GENERATED_FILENAME_RE = /__[ch]\.java$|\.pb\.go$|_pb2\.py$|\.generated\.[cm]?[jt]sx?$/i;
+function isGeneratedFile(file) {
+    return GENERATED_PATH_RE.test(file) || GENERATED_FILENAME_RE.test(file);
+}
 const PROVIDER_PATTERNS = [
     {
         name: 'AWS access key',
@@ -262,16 +274,201 @@ function shannonEntropy(s) {
 /** Words near the literal that imply credential context — used to lower the entropy threshold. */
 const CREDENTIAL_NAME_RE = /(?:key|secret|token|password|passwd|credential|api[_-]?key)/i;
 // ---------------------------------------------------------------------------
+// Context-gate pre-scans (#125)
+//
+// The entropy layer alone fires on any high-entropy string. To kill the
+// noise from generated attribution keys, embedded resource blobs, and
+// public-spec constant tables, we layer three context-aware suppressions on
+// top of the entropy gate: annotation-arg span, array-literal span, and
+// enclosing field-name credential match.
+//
+// All three are regex-based (no AST), matching the existing pass design.
+// ---------------------------------------------------------------------------
+/**
+ * Pre-scan: return the set of 1-indexed line numbers that fall inside any
+ * `@Annotation( ... )` argument span (Java annotations, JS/TS decorators,
+ * Python decorators) or `#[...]` attribute span (Rust). String literals on
+ * suppressed lines are treated as annotation metadata, not credentials.
+ *
+ * Cognium-dev #125 Gate 1.
+ */
+function findAnnotationLineRanges(code) {
+    const lines = code.split('\n');
+    const inAnnotation = new Set();
+    // Match `@SomeAnnotation(` (Java/TS/Python with optional `.qualifier`) OR `#[`.
+    const OPEN_RE = /(?:@[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*\s*\(|#\[)/g;
+    for (let i = 0; i < lines.length; i++) {
+        OPEN_RE.lastIndex = 0;
+        let m;
+        while ((m = OPEN_RE.exec(lines[i])) !== null) {
+            const isRustAttr = m[0].startsWith('#[');
+            const openCh = isRustAttr ? '[' : '(';
+            const closeCh = isRustAttr ? ']' : ')';
+            // Walk forward tracking paren/bracket depth, skipping inside string literals.
+            let depth = 1;
+            let li = i;
+            let col = m.index + m[0].length;
+            // Soft cap to avoid runaway on unmatched parens.
+            let lineBudget = 200;
+            inAnnotation.add(li + 1);
+            while (depth > 0 && li < lines.length && lineBudget > 0) {
+                const ln = lines[li];
+                let inStr = null;
+                while (col < ln.length && depth > 0) {
+                    const ch = ln[col];
+                    if (inStr !== null) {
+                        if (ch === '\\') {
+                            col += 2;
+                            continue;
+                        }
+                        if (ch === inStr)
+                            inStr = null;
+                    }
+                    else if (ch === '"' || ch === "'" || ch === '`') {
+                        inStr = ch;
+                    }
+                    else if (ch === openCh) {
+                        depth++;
+                    }
+                    else if (ch === closeCh) {
+                        depth--;
+                    }
+                    col++;
+                }
+                if (depth > 0) {
+                    li++;
+                    col = 0;
+                    lineBudget--;
+                    if (li < lines.length)
+                        inAnnotation.add(li + 1);
+                }
+            }
+        }
+    }
+    return inAnnotation;
+}
+/**
+ * Pre-scan: return the set of 1-indexed line numbers that fall inside any
+ * array/object literal containing ≥3 string-literal elements (constant
+ * data table). Catches the `String[] X = { "...", "...", "...", ... }`
+ * shape (Java) and `const X = ["...", "...", "..."]` shape (JS/TS/Python).
+ *
+ * Cognium-dev #125 Gate 3.
+ */
+function findStringArrayLineRanges(code) {
+    const lines = code.split('\n');
+    const inArray = new Set();
+    // Match assignment opener to array/object literal: `= {`, `= [`.
+    const OPEN_RE = /=\s*([{\[])/g;
+    const STR_LITERAL_COUNT_RE = /(["'`])(?:\\.|(?!\1).)*\1/g;
+    for (let i = 0; i < lines.length; i++) {
+        OPEN_RE.lastIndex = 0;
+        let m;
+        while ((m = OPEN_RE.exec(lines[i])) !== null) {
+            const openCh = m[1];
+            const closeCh = openCh === '{' ? '}' : ']';
+            let depth = 1;
+            let li = i;
+            let col = m.index + m[0].length;
+            // #126 perf: tightened 500 → 100 as defense-in-depth. Any legitimate
+            // constant-table array fits well under 100 lines; pathological openers
+            // (unbalanced braces in generated/minified code) now bail faster.
+            let lineBudget = 100;
+            const spanLines = [li + 1];
+            let spanText = '';
+            while (depth > 0 && li < lines.length && lineBudget > 0) {
+                const ln = lines[li];
+                let inStr = null;
+                const start = col;
+                while (col < ln.length && depth > 0) {
+                    const ch = ln[col];
+                    if (inStr !== null) {
+                        if (ch === '\\') {
+                            col += 2;
+                            continue;
+                        }
+                        if (ch === inStr)
+                            inStr = null;
+                    }
+                    else if (ch === '"' || ch === "'" || ch === '`') {
+                        inStr = ch;
+                    }
+                    else if (ch === openCh) {
+                        depth++;
+                    }
+                    else if (ch === closeCh) {
+                        depth--;
+                    }
+                    col++;
+                }
+                spanText += ln.substring(start, col) + '\n';
+                if (depth > 0) {
+                    li++;
+                    col = 0;
+                    lineBudget--;
+                    if (li < lines.length)
+                        spanLines.push(li + 1);
+                }
+            }
+            // Count string literals inside the span; if ≥3, mark all span lines.
+            STR_LITERAL_COUNT_RE.lastIndex = 0;
+            let strCount = 0;
+            while (STR_LITERAL_COUNT_RE.exec(spanText) !== null) {
+                strCount++;
+                if (strCount >= 3)
+                    break;
+            }
+            if (strCount >= 3) {
+                for (const ln of spanLines)
+                    inArray.add(ln);
+            }
+        }
+    }
+    return inArray;
+}
+/**
+ * Per-literal field-name extractor (#125 Gate 4).
+ *
+ * Extracts the assignment LHS identifier preceding the quoted string on the
+ * given line. Returns null if the literal is not an assignment value
+ * (e.g. annotation arg, function call arg, return expression).
+ */
+const FIELD_ASSIGN_RE = /(?:^|[\s,(])([A-Za-z_$][\w$]*)\s*[:=]\s*["'`]/;
+function extractEnclosingFieldName(lineText) {
+    const m = FIELD_ASSIGN_RE.exec(lineText);
+    return m ? m[1] : null;
+}
+// ---------------------------------------------------------------------------
 // Per-line FP-guard substrings (entropy layer only)
 // ---------------------------------------------------------------------------
 const TEST_CALL_RE = /\b(?:expect|assert|describe|it|test)\s*\(/;
 const COMMENT_EXAMPLE_RE = /(?:\/\/|#)\s*(?:example|sample|test|fixture)/i;
+// ---------------------------------------------------------------------------
+// Cheap file-level entropy-candidate probe (#126 perf hotfix)
+//
+// 3.85.0 unconditionally ran the Gate 1 / Gate 3 span pre-scans on every
+// file (after the test/generated-path skip). On string-constant-heavy Java
+// repos (gson, Hystrix, openapi-generator) this caused 2.7×–17× slowdowns
+// and 30-min timeouts because annotation walking compounded with the
+// per-file cost while the entropy layer would never have fired anyway.
+//
+// FAST_CANDIDATE_PROBE_RE is a conservative pre-filter — it matches any
+// quoted run of ≥32 base64-shape chars (a strict superset of every shape
+// the entropy layer's `isCandidate()` accepts after the Gate 4 length
+// floor). If the probe fails, the file cannot contain a single entropy
+// candidate, so we skip the pre-scans AND the Layer 2 loop entirely.
+//
+// No recall loss: any literal that would have triggered the entropy layer
+// is guaranteed to also match this probe. Verified by the gate-set tests
+// in scan-secrets.test.ts.
+// ---------------------------------------------------------------------------
+const FAST_CANDIDATE_PROBE_RE = /["'`][A-Za-z0-9+/=_-]{32,}["'`]/;
 export class ScanSecretsPass {
     name = 'scan-secrets';
     category = 'security';
     run(ctx) {
         const file = ctx.graph.ir.meta.file;
-        if (isTestFile(file)) {
+        if (isTestFile(file) || isGeneratedFile(file)) {
             return { providerFindings: 0, entropyFindings: 0 };
         }
         const lines = ctx.code.split('\n');
@@ -285,6 +482,24 @@ export class ScanSecretsPass {
                 seen.add(`${f.line}:${f.rule_id}`);
             }
         }
+        // #126 perf hotfix: cheap probe to decide whether the entropy layer can
+        // fire at all. If the file has zero ≥32-char base64-shape literals, the
+        // entropy layer cannot produce any finding, so we skip the expensive
+        // Gate 1 / Gate 3 span pre-scans AND the Layer 2 loop entirely.
+        //
+        // Provider patterns (Layer 1) and named-credential matcher (Layer 1b)
+        // are unaffected — they run unconditionally below.
+        const hasEntropyCandidate = FAST_CANDIDATE_PROBE_RE.test(ctx.code);
+        // Pre-scan: line ranges to suppress in the entropy layer (#125 Gates 1 & 3).
+        // Provider patterns and named-credential layers are intentionally NOT gated
+        // by these — they retain full recall on real credential shapes.
+        // Only computed when the entropy layer has work to do.
+        const annotationLines = hasEntropyCandidate
+            ? findAnnotationLineRanges(ctx.code)
+            : new Set();
+        const arrayLines = hasEntropyCandidate
+            ? findStringArrayLineRanges(ctx.code)
+            : new Set();
         let providerFindings = 0;
         let entropyFindings = 0;
         // Layer 1: provider patterns (line-by-line).
@@ -352,48 +567,60 @@ export class ScanSecretsPass {
             providerFindings += 1;
         }
         // Layer 2: Shannon-entropy scan on string literals.
-        for (let i = 0; i < lines.length; i++) {
-            const lineText = lines[i];
-            const lineNum = i + 1;
-            if (TEST_CALL_RE.test(lineText))
-                continue;
-            if (COMMENT_EXAMPLE_RE.test(lineText))
-                continue;
-            // Reset regex state per line; STRING_LITERAL_RE is global.
-            STRING_LITERAL_RE.lastIndex = 0;
-            let match;
-            while ((match = STRING_LITERAL_RE.exec(lineText)) !== null) {
-                const value = match[2];
-                if (!this.isCandidate(value))
+        // #126 perf hotfix: short-circuit if the cheap probe found no candidate.
+        if (hasEntropyCandidate)
+            for (let i = 0; i < lines.length; i++) {
+                const lineText = lines[i];
+                const lineNum = i + 1;
+                if (TEST_CALL_RE.test(lineText))
                     continue;
-                if (!this.passesEntropyGate(value, lineText))
+                if (COMMENT_EXAMPLE_RE.test(lineText))
                     continue;
-                const key = `${lineNum}:hardcoded-credential-entropy`;
-                if (seen.has(key))
+                // #125 Gate 1: skip annotation-arg spans (e.g. `@Original(key="...")`).
+                if (annotationLines.has(lineNum))
                     continue;
-                // Also dedup against provider-pattern hits on the same line — the
-                // entropy branch is purely additive coverage.
-                if (seen.has(`${lineNum}:hardcoded-credential`))
+                // #125 Gate 3: skip array/object literal spans with ≥3 string elements
+                // (constant data tables — solar terms, encoding alphabets, etc.).
+                if (arrayLines.has(lineNum))
                     continue;
-                seen.add(key);
-                ctx.addFinding({
-                    id: `hardcoded-credential-entropy-${file}-${lineNum}`,
-                    pass: this.name,
-                    category: this.category,
-                    rule_id: 'hardcoded-credential-entropy',
-                    cwe: 'CWE-798',
-                    severity: 'high',
-                    level: 'warning',
-                    message: `Possible hardcoded secret: high-entropy string literal (${value.length} chars)`,
-                    file,
-                    line: lineNum,
-                    snippet: lineText.trim().substring(0, 120),
-                    fix: 'If this is a credential, move it to environment / secrets manager. If it is sample data, add an `example` / `test` marker or disable this pass via `disabledPasses: [\'scan-secrets\']`.',
-                    evidence: { kind: 'entropy', length: value.length },
-                });
-                entropyFindings += 1;
+                // Reset regex state per line; STRING_LITERAL_RE is global.
+                STRING_LITERAL_RE.lastIndex = 0;
+                let match;
+                while ((match = STRING_LITERAL_RE.exec(lineText)) !== null) {
+                    const value = match[2];
+                    if (!this.isCandidate(value))
+                        continue;
+                    // #125 Gate 4 length floor: short high-entropy literals are too noisy.
+                    if (value.length < 32)
+                        continue;
+                    if (!this.passesEntropyGate(value, lineText))
+                        continue;
+                    const key = `${lineNum}:hardcoded-credential-entropy`;
+                    if (seen.has(key))
+                        continue;
+                    // Also dedup against provider-pattern hits on the same line — the
+                    // entropy branch is purely additive coverage.
+                    if (seen.has(`${lineNum}:hardcoded-credential`))
+                        continue;
+                    seen.add(key);
+                    ctx.addFinding({
+                        id: `hardcoded-credential-entropy-${file}-${lineNum}`,
+                        pass: this.name,
+                        category: this.category,
+                        rule_id: 'hardcoded-credential-entropy',
+                        cwe: 'CWE-798',
+                        severity: 'high',
+                        level: 'warning',
+                        message: `Possible hardcoded secret: high-entropy string literal (${value.length} chars)`,
+                        file,
+                        line: lineNum,
+                        snippet: lineText.trim().substring(0, 120),
+                        fix: 'If this is a credential, move it to environment / secrets manager. If it is sample data, add an `example` / `test` marker or disable this pass via `disabledPasses: [\'scan-secrets\']`.',
+                        evidence: { kind: 'entropy', length: value.length },
+                    });
+                    entropyFindings += 1;
+                }
             }
-        }
         return { providerFindings, entropyFindings };
     }
     /** Length + shape + denylist filter before entropy is computed. */
@@ -417,17 +644,26 @@ export class ScanSecretsPass {
         return true;
     }
     /**
-     * Shannon-entropy gate. Base64-shaped strings need higher entropy than
-     * hex-shaped (hex alphabet is 4 bits/char by construction). When the
-     * surrounding line contains a credential-shaped variable name, both
-     * thresholds drop by 0.2 bits/char.
+     * Shannon-entropy gate (#125 Gate 4 — REQUIRED field-name match).
+     *
+     * The entropy layer emits ONLY when the enclosing assignment LHS
+     * identifier matches a credential keyword (password / secret / token /
+     * api_key / etc.). Without this requirement, the layer flagged every
+     * high-entropy string — attribution keys, base64 resource blobs, public
+     * encoding alphabets — as credentials. Provider patterns (Layer 1) and
+     * named-credential matcher (Layer 1b) remain the recall safety net for
+     * credentials that don't fit the `FIELD = "..."` shape.
+     *
+     * Base64-shaped strings need higher entropy than hex-shaped (hex alphabet
+     * is 4 bits/char by construction).
      */
     passesEntropyGate(value, lineText) {
+        const fieldName = extractEnclosingFieldName(lineText);
+        if (fieldName === null || !CREDENTIAL_NAME_RE.test(fieldName))
+            return false;
         const isHex = HEXISH_RE.test(value);
-        const boost = CREDENTIAL_NAME_RE.test(lineText) ? 0.2 : 0;
-        const threshold = isHex ? (3.5 - boost) : (4.3 - boost);
-        const h = shannonEntropy(value);
-        return h >= threshold;
+        const threshold = isHex ? 3.3 : 4.1;
+        return shannonEntropy(value) >= threshold;
     }
 }
 //# sourceMappingURL=scan-secrets-pass.js.map

package/dist/analysis/passes/scan-secrets-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan-secrets-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/scan-secrets-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAKH,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,0EAA0E;AAC1E,MAAM,YAAY,GAAG,2FAA2F,CAAC;AACjH,MAAM,gBAAgB,GAAG,gFAAgF,CAAC;AAE1G,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAiBD,MAAM,iBAAiB,GAAsB;IAC3C;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,sBAAsB;QAC7B,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,sGAAsG;KAC5G;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,wGAAwG;KAC9G;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,kEAAkE;KACxE;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,kFAAkF;KACxF;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,oFAAoF;KAC1F;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,2EAA2E;KACjF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE,8BAA8B;QACrC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,0FAA0F;KAChG;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,8BAA8B;QACrC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS;QAClC,GAAG,EAAE,oIAAoI;KAC1I;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,wBAAwB;QAC/B,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,0FAA0F;KAChG;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,+BAA+B;QACtC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,oEAAoE;KAC1E;IACD;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,kCAAkC;QACzC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,mDAAmD;KACzD;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,+EAA+E;KACrF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,sEAAsE;QAC7E,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,sGAAsG;KAC5G;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,6DAA6D;QACpE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,qIAAqI;KAC3I;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,iGAAiG;KACvG;CACF,CAAC;AAEF,8EAA8E;AAC9E,uCAAuC;AACvC,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,0DAA0D;AAC1D,2EAA2E;AAC3E,qEAAqE;AACrE,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,EAAE;AACF,aAAa;AACb,gEAAgE;AAChE,uCAAuC;AACvC,4EAA4E;AAC5E,sDAAsD;AACtD,0EAA0E;AAC1E,iFAAiF;AACjF,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,8EAA8E;AAE9E,MAAM,eAAe,GACnB,8JAA8J,CAAC;AAEjK,MAAM,qBAAqB,GAAG,yDAAyD,CAAC;AACxF,MAAM,qBAAqB,GAAG,uCAAuC,CAAC;AACtE,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAE5D,iGAAiG;AACjG,SAAS,4BAA4B,CAAC,IAAY;IAChD,sFAAsF;IACtF,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,qEAAqE;IACrE,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnB,oEAAoE;IACpE,wEAAwE;IACxE,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,wCAAwC;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,6CAA6C;IAC7C,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAC3C,MAAM,SAAS,GAAG,gBAAgB,CAAC;AACnC,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,MAAM,cAAc,GAClB,qOAAqO,CAAC;AAExO,4GAA4G;AAC5G,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0FAA0F;AAC1F,SAAS,eAAe,CAAC,CAAS;IAChC,mEAAmE;IACnE,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,mBAAmB,CAAC,CAAS;IACpC,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IACpC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAClB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kGAAkG;AAClG,MAAM,kBAAkB,GAAG,8DAA8D,CAAC;AAE1F,8EAA8E;AAC9E,oDAAoD;AACpD,8EAA8E;AAE9E,MAAM,YAAY,GAAG,2CAA2C,CAAC;AACjE,MAAM,kBAAkB,GAAG,+CAA+C,CAAC;AAY3E,MAAM,OAAO,eAAe;IACjB,IAAI,GAAG,cAAc,CAAC;IACtB,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAEpC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,gBAAgB,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACrD,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;QACxC,mEAAmE;QACnE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,IAAI,CAAC,CAAC,OAAO,KAAK,sBAAsB,IAAI,CAAC,CAAC,OAAO,KAAK,8BAA8B,EAAE,CAAC;gBACzF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,IAAI,eAAe,GAAG,CAAC,CAAC;QAExB,6CAA6C;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvC,IAAI,CAAC,CAAC;oBAAE,SAAS;gBAEjB,MAAM,GAAG,GAAG,GAAG,OAAO,uBAAuB,CAAC;gBAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAEd,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,wBAAwB,IAAI,IAAI,OAAO,EAAE;oBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,sBAAsB;oBAC/B,GAAG,EAAE,SAAS;oBACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,OAAO,EAAE,yBAAyB,OAAO,CAAC,IAAI,WAAW;oBACzD,IAAI;oBACJ,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;oBAC1C,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;iBACnE,CAAC,CAAC;gBACH,gBAAgB,IAAI,CAAC,CAAC;gBACtB,sEAAsE;gBACtE,4DAA4D;gBAC5D,MAAM;YACR,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,2EAA2E;QAC3E,qEAAqE;QACrE,gEAAgE;QAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;YAEtB,MAAM,GAAG,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG;gBAAE,SAAS;YAEnB,MAAM,GAAG,GAAG,GAAG,OAAO,uBAAuB,CAAC;YAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEd,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,wBAAwB,IAAI,IAAI,OAAO,EAAE;gBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,sBAAsB;gBAC/B,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,2BAA2B,GAAG,CAAC,IAAI,6BAA6B;gBACzE,IAAI;gBACJ,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC1C,GAAG,EAAE,iHAAiH;gBACtH,QAAQ,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;aACvD,CAAC,CAAC;YACH,gBAAgB,IAAI,CAAC,CAAC;QACxB,CAAC;QAED,oDAAoD;QACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;YAEtB,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC1C,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAEhD,2DAA2D;YAC3D,iBAAiB,CAAC,SAAS,GAAG,CAAC,CAAC;YAChC,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACvC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC;oBAAE,SAAS;gBAEvD,MAAM,GAAG,GAAG,GAAG,OAAO,+BAA+B,CAAC;gBACtD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,kEAAkE;gBAClE,8CAA8C;gBAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,uBAAuB,CAAC;oBAAE,SAAS;gBAC1D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAEd,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,gCAAgC,IAAI,IAAI,OAAO,EAAE;oBACrD,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,8BAA8B;oBACvC,GAAG,EAAE,SAAS;oBACd,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,2DAA2D,KAAK,CAAC,MAAM,SAAS;oBACzF,IAAI;oBACJ,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;oBAC1C,GAAG,EAAE,0LAA0L;oBAC/L,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;iBACpD,CAAC,CAAC;gBACH,eAAe,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;IAC/C,CAAC;IAED,mEAAmE;IAC3D,WAAW,CAAC,CAAS;QAC3B,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,eAAe,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,aAAa,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,sEAAsE;QACtE,wCAAwC;QACxC,IAAI,mBAAmB,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,KAAa,EAAE,QAAgB;QACvD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,SAAS,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"scan-secrets-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/scan-secrets-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAKH,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,0EAA0E;AAC1E,MAAM,YAAY,GAAG,2FAA2F,CAAC;AACjH,MAAM,gBAAgB,GAAG,gFAAgF,CAAC;AAE1G,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,uCAAuC;AACvC,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,mDAAmD;AACnD,8EAA8E;AAE9E,MAAM,iBAAiB,GACrB,0LAA0L,CAAC;AAC7L,MAAM,qBAAqB,GAAG,+DAA+D,CAAC;AAE9F,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1E,CAAC;AAiBD,MAAM,iBAAiB,GAAsB;IAC3C;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,sBAAsB;QAC7B,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,sGAAsG;KAC5G;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,wGAAwG;KAC9G;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,kEAAkE;KACxE;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,kFAAkF;KACxF;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,oFAAoF;KAC1F;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,2EAA2E;KACjF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE,8BAA8B;QACrC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,0FAA0F;KAChG;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,8BAA8B;QACrC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS;QAClC,GAAG,EAAE,oIAAoI;KAC1I;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,wBAAwB;QAC/B,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,0FAA0F;KAChG;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,+BAA+B;QACtC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,oEAAoE;KAC1E;IACD;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,kCAAkC;QACzC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,mDAAmD;KACzD;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,+EAA+E;KACrF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,sEAAsE;QAC7E,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,sGAAsG;KAC5G;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,6DAA6D;QACpE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,qIAAqI;KAC3I;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO;QACpC,GAAG,EAAE,iGAAiG;KACvG;CACF,CAAC;AAEF,8EAA8E;AAC9E,uCAAuC;AACvC,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,0DAA0D;AAC1D,2EAA2E;AAC3E,qEAAqE;AACrE,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,EAAE;AACF,aAAa;AACb,gEAAgE;AAChE,uCAAuC;AACvC,4EAA4E;AAC5E,sDAAsD;AACtD,0EAA0E;AAC1E,iFAAiF;AACjF,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,8EAA8E;AAE9E,MAAM,eAAe,GACnB,8JAA8J,CAAC;AAEjK,MAAM,qBAAqB,GAAG,yDAAyD,CAAC;AACxF,MAAM,qBAAqB,GAAG,uCAAuC,CAAC;AACtE,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAE5D,iGAAiG;AACjG,SAAS,4BAA4B,CAAC,IAAY;IAChD,sFAAsF;IACtF,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,qEAAqE;IACrE,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnB,oEAAoE;IACpE,wEAAwE;IACxE,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,wCAAwC;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,6CAA6C;IAC7C,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAC3C,MAAM,SAAS,GAAG,gBAAgB,CAAC;AACnC,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,MAAM,cAAc,GAClB,qOAAqO,CAAC;AAExO,4GAA4G;AAC5G,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0FAA0F;AAC1F,SAAS,eAAe,CAAC,CAAS;IAChC,mEAAmE;IACnE,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,mBAAmB,CAAC,CAAS;IACpC,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IACpC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAClB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kGAAkG;AAClG,MAAM,kBAAkB,GAAG,8DAA8D,CAAC;AAE1F,8EAA8E;AAC9E,gCAAgC;AAChC,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,4EAA4E;AAC5E,wEAAwE;AACxE,yCAAyC;AACzC,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAE9E;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,gFAAgF;IAChF,MAAM,OAAO,GAAG,gDAAgD,CAAC;IACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACtC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACvC,8EAA8E;YAC9E,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,EAAE,GAAG,CAAC,CAAC;YACX,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAChC,iDAAiD;YACjD,IAAI,UAAU,GAAG,GAAG,CAAC;YACrB,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACzB,OAAO,KAAK,GAAG,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;gBACxD,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;gBACrB,IAAI,KAAK,GAA2B,IAAI,CAAC;gBACzC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACpC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;oBACnB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;wBACnB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;4BAAC,GAAG,IAAI,CAAC,CAAC;4BAAC,SAAS;wBAAC,CAAC;wBACxC,IAAI,EAAE,KAAK,KAAK;4BAAE,KAAK,GAAG,IAAI,CAAC;oBACjC,CAAC;yBAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;wBAClD,KAAK,GAAG,EAAqB,CAAC;oBAChC,CAAC;yBAAM,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;wBACzB,KAAK,EAAE,CAAC;oBACV,CAAC;yBAAM,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;wBAC1B,KAAK,EAAE,CAAC;oBACV,CAAC;oBACD,GAAG,EAAE,CAAC;gBACR,CAAC;gBACD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACd,EAAE,EAAE,CAAC;oBACL,GAAG,GAAG,CAAC,CAAC;oBACR,UAAU,EAAE,CAAC;oBACb,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM;wBAAE,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,iEAAiE;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC;IAC/B,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,EAAE,GAAG,CAAC,CAAC;YACX,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAChC,qEAAqE;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,IAAI,UAAU,GAAG,GAAG,CAAC;YACrB,MAAM,SAAS,GAAa,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,OAAO,KAAK,GAAG,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;gBACxD,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;gBACrB,IAAI,KAAK,GAA2B,IAAI,CAAC;gBACzC,MAAM,KAAK,GAAG,GAAG,CAAC;gBAClB,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACpC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;oBACnB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;wBACnB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;4BAAC,GAAG,IAAI,CAAC,CAAC;4BAAC,SAAS;wBAAC,CAAC;wBACxC,IAAI,EAAE,KAAK,KAAK;4BAAE,KAAK,GAAG,IAAI,CAAC;oBACjC,CAAC;yBAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;wBAClD,KAAK,GAAG,EAAqB,CAAC;oBAChC,CAAC;yBAAM,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;wBACzB,KAAK,EAAE,CAAC;oBACV,CAAC;yBAAM,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;wBAC1B,KAAK,EAAE,CAAC;oBACV,CAAC;oBACD,GAAG,EAAE,CAAC;gBACR,CAAC;gBACD,QAAQ,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;gBAC5C,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACd,EAAE,EAAE,CAAC;oBACL,GAAG,GAAG,CAAC,CAAC;oBACR,UAAU,EAAE,CAAC;oBACb,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM;wBAAE,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;YACD,qEAAqE;YACrE,oBAAoB,CAAC,SAAS,GAAG,CAAC,CAAC;YACnC,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,OAAO,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;gBACpD,QAAQ,EAAE,CAAC;gBACX,IAAI,QAAQ,IAAI,CAAC;oBAAE,MAAM;YAC3B,CAAC;YACD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,KAAK,MAAM,EAAE,IAAI,SAAS;oBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,eAAe,GACnB,+CAA+C,CAAC;AAElD,SAAS,yBAAyB,CAAC,QAAgB;IACjD,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,oDAAoD;AACpD,8EAA8E;AAE9E,MAAM,YAAY,GAAG,2CAA2C,CAAC;AACjE,MAAM,kBAAkB,GAAG,+CAA+C,CAAC;AAE3E,8EAA8E;AAC9E,8DAA8D;AAC9D,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,2BAA2B;AAC3B,8EAA8E;AAE9E,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAYlE,MAAM,OAAO,eAAe;IACjB,IAAI,GAAG,cAAc,CAAC;IACtB,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAEpC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,gBAAgB,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QACrD,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;QACxC,mEAAmE;QACnE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,IAAI,CAAC,CAAC,OAAO,KAAK,sBAAsB,IAAI,CAAC,CAAC,OAAO,KAAK,8BAA8B,EAAE,CAAC;gBACzF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,gEAAgE;QAChE,EAAE;QACF,sEAAsE;QACtE,mDAAmD;QACnD,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEnE,6EAA6E;QAC7E,4EAA4E;QAC5E,gEAAgE;QAChE,uDAAuD;QACvD,MAAM,eAAe,GAAgB,mBAAmB;YACtD,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC;YACpC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;QACtB,MAAM,UAAU,GAAgB,mBAAmB;YACjD,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC;YACrC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;QAEtB,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,IAAI,eAAe,GAAG,CAAC,CAAC;QAExB,6CAA6C;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvC,IAAI,CAAC,CAAC;oBAAE,SAAS;gBAEjB,MAAM,GAAG,GAAG,GAAG,OAAO,uBAAuB,CAAC;gBAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAEd,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,wBAAwB,IAAI,IAAI,OAAO,EAAE;oBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,sBAAsB;oBAC/B,GAAG,EAAE,SAAS;oBACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,OAAO,EAAE,yBAAyB,OAAO,CAAC,IAAI,WAAW;oBACzD,IAAI;oBACJ,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;oBAC1C,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;iBACnE,CAAC,CAAC;gBACH,gBAAgB,IAAI,CAAC,CAAC;gBACtB,sEAAsE;gBACtE,4DAA4D;gBAC5D,MAAM;YACR,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,2EAA2E;QAC3E,qEAAqE;QACrE,gEAAgE;QAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;YAEtB,MAAM,GAAG,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG;gBAAE,SAAS;YAEnB,MAAM,GAAG,GAAG,GAAG,OAAO,uBAAuB,CAAC;YAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEd,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,wBAAwB,IAAI,IAAI,OAAO,EAAE;gBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,sBAAsB;gBAC/B,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,2BAA2B,GAAG,CAAC,IAAI,6BAA6B;gBACzE,IAAI;gBACJ,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC1C,GAAG,EAAE,iHAAiH;gBACtH,QAAQ,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;aACvD,CAAC,CAAC;YACH,gBAAgB,IAAI,CAAC,CAAC;QACxB,CAAC;QAED,oDAAoD;QACpD,yEAAyE;QACzE,IAAI,mBAAmB;YAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;gBAEtB,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBAC1C,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBAChD,wEAAwE;gBACxE,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;oBAAE,SAAS;gBAC3C,uEAAuE;gBACvE,kEAAkE;gBAClE,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;oBAAE,SAAS;gBAEtC,2DAA2D;gBAC3D,iBAAiB,CAAC,SAAS,GAAG,CAAC,CAAC;gBAChC,IAAI,KAA6B,CAAC;gBAClC,OAAO,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACvB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;wBAAE,SAAS;oBACvC,uEAAuE;oBACvE,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;wBAAE,SAAS;oBAChC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC;wBAAE,SAAS;oBAEvD,MAAM,GAAG,GAAG,GAAG,OAAO,+BAA+B,CAAC;oBACtD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,SAAS;oBAC5B,kEAAkE;oBAClE,8CAA8C;oBAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,uBAAuB,CAAC;wBAAE,SAAS;oBAC1D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAEd,GAAG,CAAC,UAAU,CAAC;wBACb,EAAE,EAAE,gCAAgC,IAAI,IAAI,OAAO,EAAE;wBACrD,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,OAAO,EAAE,8BAA8B;wBACvC,GAAG,EAAE,SAAS;wBACd,QAAQ,EAAE,MAAM;wBAChB,KAAK,EAAE,SAAS;wBAChB,OAAO,EAAE,2DAA2D,KAAK,CAAC,MAAM,SAAS;wBACzF,IAAI;wBACJ,IAAI,EAAE,OAAO;wBACb,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;wBAC1C,GAAG,EAAE,0LAA0L;wBAC/L,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;qBACpD,CAAC,CAAC;oBACH,eAAe,IAAI,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QAED,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;IAC/C,CAAC;IAED,mEAAmE;IAC3D,WAAW,CAAC,CAAS;QAC3B,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,eAAe,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,aAAa,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,sEAAsE;QACtE,wCAAwC;QACxC,IAAI,mBAAmB,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,iBAAiB,CAAC,KAAa,EAAE,QAAgB;QACvD,MAAM,SAAS,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpC,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;IAC5C,CAAC;CACF"}

package/dist/browser/circle-ir.js

@@ -28845,6 +28845,11 @@ var TEST_FILENAME_RE = /(?:\.(?:test|spec)\.[cm]?[jt]sx?|_test\.go|_test\.py|Tes
 function isTestFile(file) {
   return TEST_PATH_RE3.test(file) || TEST_FILENAME_RE.test(file);
 }
+var GENERATED_PATH_RE = /(?:^|[\\/])(?:gen|generated|build[\\/]generated|src[\\/](?:main|test)[\\/]generated|target[\\/]generated-sources|target[\\/]generated-test-sources|node_modules[\\/]\.cache)(?:[\\/]|$)/i;
+var GENERATED_FILENAME_RE = /__[ch]\.java$|\.pb\.go$|_pb2\.py$|\.generated\.[cm]?[jt]sx?$/i;
+function isGeneratedFile(file) {
+  return GENERATED_PATH_RE.test(file) || GENERATED_FILENAME_RE.test(file);
+}
 var PROVIDER_PATTERNS = [
   {
     name: "AWS access key",
@@ -29011,14 +29016,126 @@ function shannonEntropy(s) {
   return h;
 }
 var CREDENTIAL_NAME_RE = /(?:key|secret|token|password|passwd|credential|api[_-]?key)/i;
+function findAnnotationLineRanges(code) {
+  const lines = code.split("\n");
+  const inAnnotation = /* @__PURE__ */ new Set();
+  const OPEN_RE = /(?:@[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*\s*\(|#\[)/g;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    OPEN_RE.lastIndex = 0;
+    let m;
+    while ((m = OPEN_RE.exec(lines[i2])) !== null) {
+      const isRustAttr = m[0].startsWith("#[");
+      const openCh = isRustAttr ? "[" : "(";
+      const closeCh = isRustAttr ? "]" : ")";
+      let depth = 1;
+      let li = i2;
+      let col = m.index + m[0].length;
+      let lineBudget = 200;
+      inAnnotation.add(li + 1);
+      while (depth > 0 && li < lines.length && lineBudget > 0) {
+        const ln = lines[li];
+        let inStr = null;
+        while (col < ln.length && depth > 0) {
+          const ch = ln[col];
+          if (inStr !== null) {
+            if (ch === "\\") {
+              col += 2;
+              continue;
+            }
+            if (ch === inStr) inStr = null;
+          } else if (ch === '"' || ch === "'" || ch === "`") {
+            inStr = ch;
+          } else if (ch === openCh) {
+            depth++;
+          } else if (ch === closeCh) {
+            depth--;
+          }
+          col++;
+        }
+        if (depth > 0) {
+          li++;
+          col = 0;
+          lineBudget--;
+          if (li < lines.length) inAnnotation.add(li + 1);
+        }
+      }
+    }
+  }
+  return inAnnotation;
+}
+function findStringArrayLineRanges(code) {
+  const lines = code.split("\n");
+  const inArray = /* @__PURE__ */ new Set();
+  const OPEN_RE = /=\s*([{\[])/g;
+  const STR_LITERAL_COUNT_RE = /(["'`])(?:\\.|(?!\1).)*\1/g;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    OPEN_RE.lastIndex = 0;
+    let m;
+    while ((m = OPEN_RE.exec(lines[i2])) !== null) {
+      const openCh = m[1];
+      const closeCh = openCh === "{" ? "}" : "]";
+      let depth = 1;
+      let li = i2;
+      let col = m.index + m[0].length;
+      let lineBudget = 100;
+      const spanLines = [li + 1];
+      let spanText = "";
+      while (depth > 0 && li < lines.length && lineBudget > 0) {
+        const ln = lines[li];
+        let inStr = null;
+        const start2 = col;
+        while (col < ln.length && depth > 0) {
+          const ch = ln[col];
+          if (inStr !== null) {
+            if (ch === "\\") {
+              col += 2;
+              continue;
+            }
+            if (ch === inStr) inStr = null;
+          } else if (ch === '"' || ch === "'" || ch === "`") {
+            inStr = ch;
+          } else if (ch === openCh) {
+            depth++;
+          } else if (ch === closeCh) {
+            depth--;
+          }
+          col++;
+        }
+        spanText += ln.substring(start2, col) + "\n";
+        if (depth > 0) {
+          li++;
+          col = 0;
+          lineBudget--;
+          if (li < lines.length) spanLines.push(li + 1);
+        }
+      }
+      STR_LITERAL_COUNT_RE.lastIndex = 0;
+      let strCount = 0;
+      while (STR_LITERAL_COUNT_RE.exec(spanText) !== null) {
+        strCount++;
+        if (strCount >= 3) break;
+      }
+      if (strCount >= 3) {
+        for (const ln of spanLines) inArray.add(ln);
+      }
+    }
+  }
+  return inArray;
+}
+var FIELD_ASSIGN_RE = /(?:^|[\s,(])([A-Za-z_$][\w$]*)\s*[:=]\s*["'`]/;
+function extractEnclosingFieldName(lineText) {
+  const m = FIELD_ASSIGN_RE.exec(lineText);
+  return m ? m[1] : null;
+}
 var TEST_CALL_RE = /\b(?:expect|assert|describe|it|test)\s*\(/;
 var COMMENT_EXAMPLE_RE = /(?:\/\/|#)\s*(?:example|sample|test|fixture)/i;
+var FAST_CANDIDATE_PROBE_RE = /["'`][A-Za-z0-9+/=_-]{32,}["'`]/;
 var ScanSecretsPass = class {
   name = "scan-secrets";
   category = "security";
   run(ctx) {
     const file = ctx.graph.ir.meta.file;
-    if (isTestFile(file)) {
+    if (isTestFile(file) || isGeneratedFile(file)) {
       return { providerFindings: 0, entropyFindings: 0 };
     }
     const lines = ctx.code.split("\n");
@@ -29030,6 +29147,9 @@ var ScanSecretsPass = class {
         seen.add(`${f.line}:${f.rule_id}`);
       }
     }
+    const hasEntropyCandidate = FAST_CANDIDATE_PROBE_RE.test(ctx.code);
+    const annotationLines = hasEntropyCandidate ? findAnnotationLineRanges(ctx.code) : /* @__PURE__ */ new Set();
+    const arrayLines = hasEntropyCandidate ? findStringArrayLineRanges(ctx.code) : /* @__PURE__ */ new Set();
     let providerFindings = 0;
     let entropyFindings = 0;
     for (let i2 = 0; i2 < lines.length; i2++) {
@@ -29085,16 +29205,19 @@ var ScanSecretsPass = class {
       });
       providerFindings += 1;
     }
-    for (let i2 = 0; i2 < lines.length; i2++) {
+    if (hasEntropyCandidate) for (let i2 = 0; i2 < lines.length; i2++) {
       const lineText = lines[i2];
       const lineNum = i2 + 1;
       if (TEST_CALL_RE.test(lineText)) continue;
       if (COMMENT_EXAMPLE_RE.test(lineText)) continue;
+      if (annotationLines.has(lineNum)) continue;
+      if (arrayLines.has(lineNum)) continue;
       STRING_LITERAL_RE.lastIndex = 0;
       let match;
       while ((match = STRING_LITERAL_RE.exec(lineText)) !== null) {
         const value = match[2];
         if (!this.isCandidate(value)) continue;
+        if (value.length < 32) continue;
         if (!this.passesEntropyGate(value, lineText)) continue;
         const key = `${lineNum}:hardcoded-credential-entropy`;
         if (seen.has(key)) continue;
@@ -29132,17 +29255,25 @@ var ScanSecretsPass = class {
     return true;
   }
   /**
-   * Shannon-entropy gate. Base64-shaped strings need higher entropy than
-   * hex-shaped (hex alphabet is 4 bits/char by construction). When the
-   * surrounding line contains a credential-shaped variable name, both
-   * thresholds drop by 0.2 bits/char.
+   * Shannon-entropy gate (#125 Gate 4 — REQUIRED field-name match).
+   *
+   * The entropy layer emits ONLY when the enclosing assignment LHS
+   * identifier matches a credential keyword (password / secret / token /
+   * api_key / etc.). Without this requirement, the layer flagged every
+   * high-entropy string — attribution keys, base64 resource blobs, public
+   * encoding alphabets — as credentials. Provider patterns (Layer 1) and
+   * named-credential matcher (Layer 1b) remain the recall safety net for
+   * credentials that don't fit the `FIELD = "..."` shape.
+   *
+   * Base64-shaped strings need higher entropy than hex-shaped (hex alphabet
+   * is 4 bits/char by construction).
    */
   passesEntropyGate(value, lineText) {
+    const fieldName = extractEnclosingFieldName(lineText);
+    if (fieldName === null || !CREDENTIAL_NAME_RE.test(fieldName)) return false;
     const isHex = HEXISH_RE.test(value);
-    const boost = CREDENTIAL_NAME_RE.test(lineText) ? 0.2 : 0;
-    const threshold = isHex ? 3.5 - boost : 4.3 - boost;
-    const h = shannonEntropy(value);
-    return h >= threshold;
+    const threshold = isHex ? 3.3 : 4.1;
+    return shannonEntropy(value) >= threshold;
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.84.0",
+  "version": "3.85.1",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",