code-auditor-mcp 4.1.1 → 5.0.1

package/dist/phase/rules/securityDefects.js

@@ -0,0 +1,167 @@
+/**
+ * Spec 68 §3.2 — the three single-file security rules (Spec 61 R6), migrated to
+ * `analyze(ctx)`. They read the `security-candidates` fact, whose producer
+ * (`securityCandidates.ts`) already resolved the structural half the legacy
+ * `UniversalSecurityAnalyzer` walked the AST to obtain:
+ *
+ *   - `command-injection-risk`       — a shell/process invocation whose command
+ *     is interpolated/concatenated (the producer resolved `unsafe`).
+ *   - `dynamic-require-of-project-path` — a computed require/import specifier
+ *     (the producer filtered out literals and carried the raw arg + callee text).
+ *   - `unescaped-html-interpolation` — a sink-reaching template substitution that
+ *     resolves to a member access (the producer ran the three-phase sink flow).
+ *
+ * The rule's job is the pure-text classification the producer could not do
+ * without deciding — `isConfigPath` (dynamic-require), the `isTestOrFixtureFile`
+ * skip (all three, matching the legacy per-file early return) — and the
+ * finding/message/resolution construction. The producers never decided "is this
+ * a finding"; they projected the positional context and the resolved
+ * name/prop, exactly as `secretCandidates.ts` does for `secret-candidates`.
+ *
+ * The helper functions (`isTestOrFixtureFile`, `isConfigPath`) are re-homed
+ * verbatim — copied, not imported, because `UniversalSecurityAnalyzer` is
+ * deleted in §15 and the rule must not couple the new pipeline to a class about
+ * to disappear. The finding messages are the full legacy literals (not the
+ * registry's shortened `{method}`/`{path}`/`{field}` templates), matching how
+ * `hardcoded-connection` and `hardcoded-secret` carry their pre-migration text.
+ */
+import { RULE_REGISTRY } from '../../analyzers/ruleRegistry.js';
+const META_INJ = RULE_REGISTRY['command-injection-risk'];
+const META_REQ = RULE_REGISTRY['dynamic-require-of-project-path'];
+const META_HTML = RULE_REGISTRY['unescaped-html-interpolation'];
+// ── Classification (re-homed verbatim from UniversalSecurityAnalyzer) ───────
+/** Is this path a test/fixture file? Excluded up front (precision-first). */
+function isTestOrFixtureFile(filePath) {
+    const lower = filePath.toLowerCase();
+    return (lower.includes('.test.') || lower.includes('.spec.') ||
+        lower.includes('__tests__') ||
+        lower.includes('/test/') || lower.includes('/tests/') ||
+        lower.includes('/fixtures/') || lower.includes('.fixture.') ||
+        lower.endsWith('_test.go'));
+}
+/** Is this specifier a project-config-path-derived one (the config candidate /
+ *  project-root join / directory-walk result this rule exists to catch)? */
+function isConfigPath(text) {
+    const lower = text.toLowerCase();
+    return /config/.test(lower) && /path|file|dir|join\(|resolve\(|pathtofileurl|href/.test(lower);
+}
+/** Emit one finding per candidate matching `spec`. The three single-file rules
+ *  repeat the same loop + test/fixture skip + finding/resolution scaffold; only
+ *  the classification (kind/accept) and the text (message/summary/symbol) vary. */
+function detectSecurityDefect(candidates, spec) {
+    const findings = [];
+    for (const c of candidates) {
+        if (c.kind !== spec.kind)
+            continue;
+        if (isTestOrFixtureFile(c.file))
+            continue;
+        const candidate = c;
+        if (spec.accept && !spec.accept(candidate))
+            continue;
+        findings.push({
+            ruleId: spec.ruleId,
+            severity: spec.severity,
+            message: spec.message(candidate),
+            file: candidate.file,
+            line: candidate.line,
+            column: candidate.column,
+            symbol: spec.symbol(candidate),
+            resolution: {
+                action: spec.resolutionAction,
+                summary: spec.resolutionSummary(candidate),
+                symbols: spec.resolutionSymbols(candidate),
+                files: [candidate.file],
+                lines: [candidate.line],
+            },
+        });
+    }
+    return findings;
+}
+/** Re-homes `checkCommandInjection`: emit a finding per unsafe shell call. */
+const COMMAND_INJECTION = {
+    kind: 'command-injection',
+    ruleId: 'command-injection-risk',
+    severity: 'critical',
+    symbol: (c) => c.fnName,
+    message: (c) => `Unsafe process invocation: ${c.fnName}() is passed a command built by interpolation/concatenation, so a value can become a shell command. ` +
+        'Pass the command as a string literal and arguments as an argv array (execFileSync/spawn), never a shell string.',
+    resolutionAction: 'use-argv-array',
+    resolutionSummary: (c) => `Replace ${c.fnName} with an argv-array form (execFileSync/spawn) whose command is a string literal ` +
+        'and whose arguments are separate array elements, so no shell interprets them.',
+    resolutionSymbols: (c) => [c.fnName],
+};
+/** Re-homes `checkDynamicRequire`: emit a finding per computed config-path require. */
+const DYNAMIC_REQUIRE = {
+    kind: 'dynamic-require',
+    accept: (c) => isConfigPath(c.argText),
+    ruleId: 'dynamic-require-of-project-path',
+    severity: 'critical',
+    // §7 — the computed specifier is what located this finding; two dynamic
+    // requires in one file must not collapse to one fingerprint.
+    symbol: (c) => c.argText,
+    message: (c) => `Dynamic require/import of a project config path: ${c.argText}. A path discovered from the project tree is executed ` +
+        "when it is require()'d or import()'d. Read config files without executing them (static extraction).",
+    resolutionAction: 'static-config-extraction',
+    resolutionSummary: () => 'Replace the dynamic require/import with static extraction (read the source and extract the literal export) ' +
+        'so a project-supplied config is never executed.',
+    resolutionSymbols: (c) => [c.calleeText],
+};
+/** Re-homes `checkUnescapedHtml` + `checkInterpolation`: emit a finding per
+ *  sink-reaching unescaped member-access interpolation. */
+const UNESCAPED_HTML = {
+    kind: 'unescaped-html',
+    ruleId: 'unescaped-html-interpolation',
+    severity: 'severe',
+    symbol: (c) => c.prop,
+    message: (c) => `Unescaped HTML interpolation: ${c.prop} is inserted into an HTML template without an escaping call. ` +
+        'Analysis-controlled strings (file paths, messages, previews) can carry markup — wrap the interpolation in escapeHtml() to prevent stored XSS.',
+    resolutionAction: 'escape-html-interpolation',
+    resolutionSummary: (c) => `Wrap the ${c.prop} interpolation in an escaping call (e.g. \${escapeHtml(${c.prop})}) before it reaches the HTML template.`,
+    resolutionSymbols: (c) => [c.prop],
+};
+const commandInjectionRisk = {
+    id: 'command-injection-risk',
+    analyzer: 'security',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['security-candidates'] },
+    severity: 'critical',
+    message: META_INJ.message,
+    docs: META_INJ.docs,
+    thresholds: META_INJ.thresholds,
+    samples: META_INJ.samples,
+    analyze(ctx) {
+        return detectSecurityDefect(ctx.facts['security-candidates'], COMMAND_INJECTION);
+    },
+};
+const dynamicRequireOfProjectPath = {
+    id: 'dynamic-require-of-project-path',
+    analyzer: 'security',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['security-candidates'] },
+    severity: 'critical',
+    message: META_REQ.message,
+    docs: META_REQ.docs,
+    thresholds: META_REQ.thresholds,
+    samples: META_REQ.samples,
+    analyze(ctx) {
+        return detectSecurityDefect(ctx.facts['security-candidates'], DYNAMIC_REQUIRE);
+    },
+};
+const unescapedHtmlInterpolation = {
+    id: 'unescaped-html-interpolation',
+    analyzer: 'security',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['security-candidates'] },
+    severity: 'severe',
+    message: META_HTML.message,
+    docs: META_HTML.docs,
+    thresholds: META_HTML.thresholds,
+    samples: META_HTML.samples,
+    analyze(ctx) {
+        return detectSecurityDefect(ctx.facts['security-candidates'], UNESCAPED_HTML);
+    },
+};
+/** The three single-file security rules this slice migrates, in registry order. */
+export const securityDefectRules = [
+    commandInjectionRisk,
+    dynamicRequireOfProjectPath,
+    unescapedHtmlInterpolation,
+];
+//# sourceMappingURL=securityDefects.js.map

package/dist/phase/rules/securityDefects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityDefects.js","sourceRoot":"","sources":["../../../src/phase/rules/securityDefects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE,MAAM,QAAQ,GAAG,aAAa,CAAC,wBAAwB,CAAC,CAAC;AACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,iCAAiC,CAAC,CAAC;AAClE,MAAM,SAAS,GAAG,aAAa,CAAC,8BAA8B,CAAC,CAAC;AAQhE,+EAA+E;AAE/E,6EAA6E;AAC7E,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpD,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC3B,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QACrD,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC3D,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED;4EAC4E;AAC5E,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,mDAAmD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjG,CAAC;AAqBD;;mFAEmF;AACnF,SAAS,oBAAoB,CAC3B,UAAwC,EACxC,IAA2B;IAE3B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,SAAS;QACnC,IAAI,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,MAAM,SAAS,GAAG,CAAmB,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,SAAS;QACrD,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAChC,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9B,UAAU,EAAE;gBACV,MAAM,EAAE,IAAI,CAAC,gBAAgB;gBAC7B,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;gBAC1C,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;gBAC1C,KAAK,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC;gBACvB,KAAK,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC;aACxB;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,MAAM,iBAAiB,GAA4C;IACjE,IAAI,EAAE,mBAAmB;IACzB,MAAM,EAAE,wBAAwB;IAChC,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM;IACvB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CACb,8BAA8B,CAAC,CAAC,MAAM,sGAAsG;QAC5I,iHAAiH;IACnH,gBAAgB,EAAE,gBAAgB;IAClC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CACvB,WAAW,CAAC,CAAC,MAAM,kFAAkF;QACrG,+EAA+E;IACjF,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;CACrC,CAAC;AAEF,uFAAuF;AACvF,MAAM,eAAe,GAA0C;IAC7D,IAAI,EAAE,iBAAiB;IACvB,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;IACtC,MAAM,EAAE,iCAAiC;IACzC,QAAQ,EAAE,UAAU;IACpB,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO;IACxB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CACb,oDAAoD,CAAC,CAAC,OAAO,wDAAwD;QACrH,qGAAqG;IACvG,gBAAgB,EAAE,0BAA0B;IAC5C,iBAAiB,EAAE,GAAG,EAAE,CACtB,6GAA6G;QAC7G,iDAAiD;IACnD,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;CACzC,CAAC;AAEF;2DAC2D;AAC3D,MAAM,cAAc,GAAyC;IAC3D,IAAI,EAAE,gBAAgB;IACtB,MAAM,EAAE,8BAA8B;IACtC,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;IACrB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CACb,iCAAiC,CAAC,CAAC,IAAI,+DAA+D;QACtG,+IAA+I;IACjJ,gBAAgB,EAAE,2BAA2B;IAC7C,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CACvB,YAAY,CAAC,CAAC,IAAI,0DAA0D,CAAC,CAAC,IAAI,0CAA0C;IAC9H,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,oBAAoB,GAAwC;IAChE,EAAE,EAAE,wBAAwB;IAC5B,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,qBAAqB,CAAC,EAAE;IACvF,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;IACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;IAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,OAAO,CAAC,GAAG;QACT,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACnF,CAAC;CACF,CAAC;AAEF,MAAM,2BAA2B,GAAwC;IACvE,EAAE,EAAE,iCAAiC;IACrC,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,qBAAqB,CAAC,EAAE;IACvF,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;IACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;IAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,OAAO,CAAC,GAAG;QACT,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,eAAe,CAAC,CAAC;IACjF,CAAC;CACF,CAAC;AAEF,MAAM,0BAA0B,GAAwC;IACtE,EAAE,EAAE,8BAA8B;IAClC,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,qBAAqB,CAAC,EAAE;IACvF,QAAQ,EAAE,QAAQ;IAClB,OAAO,EAAE,SAAS,CAAC,OAAO;IAC1B,IAAI,EAAE,SAAS,CAAC,IAAI;IACpB,UAAU,EAAE,SAAS,CAAC,UAAU;IAChC,OAAO,EAAE,SAAS,CAAC,OAAO;IAC1B,OAAO,CAAC,GAAG;QACT,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,cAAc,CAAC,CAAC;IAChF,CAAC;CACF,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAAmD;IACjF,oBAAoB;IACpB,2BAA2B;IAC3B,0BAA0B;CAC3B,CAAC"}

package/dist/phase/rules/solid.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Spec 68 §3.2 vertical slice — the SOLID rules, migrated to `analyze(ctx)`.
+ *
+ * These were the per-file AST checks inside `UniversalSOLIDAnalyzer`; now they
+ * read the `file-symbols` fact (a flat array of function / class / interface
+ * symbols with metrics pre-computed at process time) and do pure threshold
+ * comparison. No AST, no adapter, no source code reaches a rule — the tree died
+ * with the file.
+ *
+ * Eight TypeScript rules migrate here. The Go size rules are re-declared against
+ * the Go facts in §9: `struct-size` and `interface-size`'s Go arm read the
+ * `type-declarations` fact (§9); `switch-size`, `function-size` and the Go
+ * `liskov-substitution` read the §9 Go facts added in their own slices. The
+ * thresholds are the Go binary's hardcoded values (struct 15, interface 10),
+ * not the TS config keys (`maxInterfaceMembers` is the TS arm only).
+ *
+ * `message` / `docs` / `thresholds` / `samples` are the same text the rule
+ * registry already carries (ruleRegistry.ts) — pulled by reference so the two
+ * cannot drift before §15 folds the registry into these definitions. `severity`
+ * and `analyze` are new here; the registry never carried `severity`.
+ */
+import type { RuleDefinition } from '../types.js';
+type SolidNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript'];
+    readonly facts: readonly ['file-symbols'];
+};
+/** The Go-only SOLID size rules read the `type-declarations` fact (§9). */
+type GoNeeds = {
+    readonly formats: readonly ['go'];
+    readonly facts: readonly ['type-declarations'];
+};
+/** `interface-size` reads both arms: TS symbols + Go type declarations. */
+type InterfaceSizeNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript', 'go'];
+    readonly facts: readonly ['file-symbols', 'type-declarations'];
+};
+/** `open-closed` reads the resolution fact's class declarations to resolve an
+ *  `instanceof` target's `extends` chain (criterion 7c) alongside the
+ *  `file-symbols` fact it fires from. */
+type OpenClosedNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript'];
+    readonly facts: readonly ['file-symbols', 'resolution'];
+};
+/** The Go-only function-metric rules (`function-size`, `liskov-substitution`)
+ *  read the `go-functions` fact (§9). */
+type GoFunctionNeeds = {
+    readonly formats: readonly ['go'];
+    readonly facts: readonly ['go-functions'];
+};
+/** The Go-only `switch-size` rule reads the `go-switches` fact (§9). */
+type GoSwitchNeeds = {
+    readonly formats: readonly ['go'];
+    readonly facts: readonly ['go-switches'];
+};
+/** The eight TypeScript SOLID rules plus the §9 Go re-declarations, in registry
+ *  order. The element type is the *union* of each rule's `RuleDefinition<N>`
+ *  (not `any`) so the consumed-set check can recover the Go facts each declares;
+ *  a slice runner that feeds one broad context casts at the call site. */
+export declare const solidRules: (RuleDefinition<SolidNeeds> | RuleDefinition<OpenClosedNeeds> | RuleDefinition<InterfaceSizeNeeds> | RuleDefinition<GoNeeds> | RuleDefinition<GoFunctionNeeds> | RuleDefinition<GoSwitchNeeds>)[];
+export {};
+//# sourceMappingURL=solid.d.ts.map

package/dist/phase/rules/solid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"solid.d.ts","sourceRoot":"","sources":["../../../src/phase/rules/solid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EACV,cAAc,EAYf,MAAM,aAAa,CAAC;AASrB,KAAK,UAAU,GAAG;IAChB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;CAC3C,CAAC;AAEF,2EAA2E;AAC3E,KAAK,OAAO,GAAG;IACb,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC;CAChD,CAAC;AAEF,2EAA2E;AAC3E,KAAK,kBAAkB,GAAG;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACrE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;CAChE,CAAC;AAEF;;yCAEyC;AACzC,KAAK,eAAe,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;CACzD,CAAC;AAEF;yCACyC;AACzC,KAAK,eAAe,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;CAC3C,CAAC;AAEF,wEAAwE;AACxE,KAAK,aAAa,GAAG;IACnB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;CAC1C,CAAC;AAikBF;;;0EAG0E;AAC1E,eAAO,MAAM,UAAU,mMAatB,CAAC"}