code-auditor-mcp 4.1.1 → 5.0.1

package/dist/phase/securityCandidates.js

@@ -0,0 +1,469 @@
+/**
+ * Spec 68 §3.2 — the per-file `security-candidates` producer.
+ *
+ * Projects the three single-file security constructs (Spec 61 R6) onto the
+ * serializable `SecurityCandidate` fact. It re-homes the *structural* half of
+ * `UniversalSecurityAnalyzer` — the AST walk that decides whether a shell call's
+ * command is interpolated/concatenated, whether a require/import specifier is
+ * computed, and whether a template substitution reaches an HTML sink unescaped —
+ * while leaving the *pure-text* classification (`isConfigPath`, the
+ * test/fixture skip) and the finding construction (message/resolution/severity)
+ * to the rule.
+ *
+ * The producer never decides "is this a finding": it projects the positional
+ * context and the resolved name/prop, exactly as `secretCandidates.ts` does for
+ * `secret-candidates`. For `unescaped-html` the producer re-homes the full
+ * three-phase sink-flow analysis (`collectLocalFlow` → `collectSinkRoots` →
+ * `propagateSinkFlow`) and the per-substitution resolution of the interpolated
+ * member access; the rule's only job is to skip test/fixture files and assemble
+ * the message/resolution.
+ */
+import { walkAST, getNodeText, getFieldNode } from '../languages/adapterBridge.js';
+/** Child-process entry points whose first argument is the command string. */
+const SHELL_PROCESS_FUNCTIONS = new Set([
+    'execSync', 'exec', 'execFile', 'execFileSync',
+    'spawn', 'spawnSync', 'fork', 'execAsync',
+]);
+/** Escaping-call names that neutralize an HTML interpolation. */
+const ESCAPE_FNS = new Set([
+    'escapeHtml', 'htmlEscape', 'escape', 'escapeHTML',
+    'sanitize', 'sanitizeHtml', 'h', 'e',
+]);
+/** Method names whose result still carries the receiver's value (taint flows). */
+const RECEIVER_PASSTHROUGH_METHODS = new Set([
+    'join', 'concat', 'toString', 'valueOf', 'slice', 'substring', 'substr',
+    'trim', 'trimStart', 'trimEnd', 'replace', 'replaceAll',
+    'toLowerCase', 'toUpperCase', 'padStart', 'padEnd', 'at', 'charAt',
+    'filter', 'sort', 'flat', 'reverse',
+]);
+/** Array methods whose result is built from the callback's returned value. */
+const MAP_VALUE_METHODS = new Set(['map', 'flatMap']);
+/** Object names treated as an HTTP response whose `.send`/`.write` emits HTML. */
+const HTTP_RESPONSE_OBJECTS = new Set(['res', 'response', 'resp', 'reply']);
+/** A string-valued constant: a `string` node or a substitution-free template. */
+function isStringConstant(node) {
+    if (!node)
+        return false;
+    if (node.type === 'string')
+        return true;
+    if (node.type === 'template_string') {
+        const hasSub = (node.children ?? []).some((c) => c.type === 'template_substitution');
+        return !hasSub;
+    }
+    return false;
+}
+/** A substitution's expression is a compile-time literal, not a computed value. */
+function isLiteralNode(node) {
+    if (!node)
+        return false;
+    if (['string', 'number', 'true', 'false', 'null', 'undefined'].includes(node.type))
+        return true;
+    if (node.type === 'template_string') {
+        const hasSub = (node.children ?? []).some((c) => c.type === 'template_substitution');
+        if (!hasSub)
+            return true;
+    }
+    return false;
+}
+/** The first argument (child of the `arguments` node) of a call, if any. */
+function firstArgument(node) {
+    const args = node.children?.find((c) => c.type === 'arguments');
+    return args?.children?.[0];
+}
+/** `node` is a bare `require(x)` call — callee is the identifier `require`. */
+function isBareRequire(node, sourceCode) {
+    const fn = node.children?.[0];
+    return fn?.type === 'identifier' && getNodeText(fn, sourceCode) === 'require';
+}
+/** `node` is a `createRequire(...)(x)` call — callee is itself a createRequire call. */
+function isCreateRequireInvocation(node, sourceCode) {
+    const fn = node.children?.[0];
+    if (fn?.type !== 'call_expression')
+        return false;
+    const innerFn = fn.children?.[0];
+    return innerFn?.type === 'identifier' && getNodeText(innerFn, sourceCode) === 'createRequire';
+}
+/** The operator text of a `binary_expression`, if it is the given token. */
+function binaryOperatorIs(node, token, sourceCode) {
+    const op = getFieldNode(node, 'operator');
+    if (op)
+        return getNodeText(op, sourceCode).trim() === token;
+    return (node.children ?? []).some((c) => getNodeText(c, sourceCode) === token);
+}
+/** The property name of a `member_expression` (`sessionData.path` → `path`). */
+function memberPropertyName(node, sourceCode) {
+    const prop = node.children?.find((c) => c.type === 'property_identifier');
+    return prop ? getNodeText(prop, sourceCode) : null;
+}
+/** Collect the expressions a function body can return (for taint-through-return). */
+function collectReturnExpressions(bodyNode) {
+    const out = [];
+    walkAST(bodyNode, (n) => {
+        if (n.type === 'return_statement') {
+            const expr = (n.children ?? []).find((c) => c.type !== ';');
+            if (expr)
+                out.push(expr);
+        }
+    });
+    return out;
+}
+/**
+ * The sink arguments of an HTML-emitting call (`res.send`/`document.write`/
+ * `insertAdjacentHTML`/`setHTMLUnsafe`/`.html(x)`), or [] for any other call.
+ */
+function htmlSinkArguments(callNode, sourceCode) {
+    const fn = callNode.children?.[0];
+    if (fn?.type !== 'member_expression')
+        return [];
+    const prop = memberPropertyName(fn, sourceCode);
+    const obj = fn.children?.find((c) => c.type === 'identifier');
+    const objName = obj ? getNodeText(obj, sourceCode) : null;
+    if (prop === 'insertAdjacentHTML') {
+        const args = callNode.children?.find((c) => c.type === 'arguments');
+        const values = (args?.children ?? []).filter((c) => c.type !== ',');
+        const html = values[1];
+        return html ? [html] : [];
+    }
+    if (prop === 'send' || prop === 'write') {
+        if (!objName || (!HTTP_RESPONSE_OBJECTS.has(objName) && objName !== 'document'))
+            return [];
+        const first = firstArgument(callNode);
+        return first ? [first] : [];
+    }
+    if (prop === 'setHTMLUnsafe') {
+        const first = firstArgument(callNode);
+        return first ? [first] : [];
+    }
+    if (prop === 'html') {
+        const args = callNode.children?.find((c) => c.type === 'arguments');
+        const first = args?.children?.[0];
+        return first ? [first] : [];
+    }
+    return [];
+}
+/** The expressions a function body can return, used for taint-through-return. */
+function returnsOf(fnNode) {
+    if (fnNode.type === 'arrow_function') {
+        const block = fnNode.children?.find((c) => c.type === 'statement_block');
+        if (!block) {
+            for (let i = (fnNode.children ?? []).length - 1; i >= 0; i--) {
+                const c = fnNode.children[i];
+                if (c.type === 'formal_parameters' || c.type === '=>')
+                    continue;
+                return [c];
+            }
+            return [];
+        }
+        return collectReturnExpressions(block);
+    }
+    const block = fnNode.children?.find((c) => c.type === 'statement_block');
+    return block ? collectReturnExpressions(block) : [];
+}
+/** Phase 1 — local value flow: bindings + per-function-name return expressions. */
+function collectLocalFlow(ast, sourceCode) {
+    const bindings = new Map();
+    const returnsByName = new Map();
+    walkAST(ast.root, (node) => {
+        if (node.type === 'variable_declarator') {
+            const name = getFieldNode(node, 'name');
+            const value = getFieldNode(node, 'value');
+            if (name && value) {
+                const n = getNodeText(name, sourceCode);
+                const arr = bindings.get(n) ?? [];
+                arr.push(value);
+                bindings.set(n, arr);
+                if (value.type === 'arrow_function' || value.type === 'function_expression') {
+                    const rets = returnsOf(value);
+                    if (rets.length)
+                        returnsByName.set(n, rets);
+                }
+            }
+        }
+        else if (node.type === 'function_declaration') {
+            const name = getFieldNode(node, 'name');
+            if (name) {
+                const rets = returnsOf(node);
+                if (rets.length)
+                    returnsByName.set(getNodeText(name, sourceCode), rets);
+            }
+        }
+    });
+    return { bindings, returnsByName };
+}
+/** Phase 2 — sink roots: every expression injected into an HTML sink. */
+function collectSinkRoots(ast, sourceCode) {
+    const sinkRoots = [];
+    walkAST(ast.root, (node) => {
+        if (node.type === 'call_expression') {
+            for (const a of htmlSinkArguments(node, sourceCode))
+                sinkRoots.push(a);
+        }
+        else if (node.type === 'assignment_expression') {
+            const left = getFieldNode(node, 'left');
+            const right = getFieldNode(node, 'right');
+            if (left?.type === 'member_expression' && right) {
+                const prop = memberPropertyName(left, sourceCode);
+                if (prop === 'innerHTML' || prop === 'outerHTML')
+                    sinkRoots.push(right);
+            }
+        }
+        else if (node.type === 'pair') {
+            const key = getFieldNode(node, 'key');
+            const value = getFieldNode(node, 'value');
+            if (key && value) {
+                const keyText = getNodeText(key, sourceCode);
+                const isHtmlKey = key.type === 'property_identifier'
+                    ? keyText === '__html'
+                    : keyText === '"__html"' || keyText === "'__html'";
+                if (isHtmlKey)
+                    sinkRoots.push(value);
+            }
+        }
+        else if (node.type === 'jsx_attribute') {
+            const nameNode = node.children?.find((c) => c.type === 'property_identifier' || c.type === 'identifier');
+            if (nameNode && getNodeText(nameNode, sourceCode) === 'dangerouslySetInnerHTML') {
+                const valueNode = node.children?.find((c) => c.type === 'jsx_expression' || c.type === 'string');
+                if (valueNode) {
+                    if (valueNode.type === 'jsx_expression') {
+                        const inner = valueNode.children?.find((c) => c.type !== '{' && c.type !== '}');
+                        if (inner)
+                            sinkRoots.push(inner);
+                    }
+                    else {
+                        sinkRoots.push(valueNode);
+                    }
+                }
+            }
+        }
+        else if (node.type === 'template_string') {
+            const isVHtml = (node.children ?? []).some((c) => c.type === 'string_fragment' && /v-html\s*=/i.test(getNodeText(c, sourceCode)));
+            if (isVHtml)
+                sinkRoots.push(node);
+        }
+    });
+    return sinkRoots;
+}
+/** Phase 3 — backward propagation from sink roots to the templates that reach them. */
+function propagateSinkFlow(sinkRoots, bindings, returnsByName, sourceCode) {
+    const producers = (e) => {
+        switch (e.type) {
+            case 'identifier':
+                return bindings.get(getNodeText(e, sourceCode)) ?? [];
+            case 'template_string':
+                return (e.children ?? [])
+                    .filter((c) => c.type === 'template_substitution')
+                    .map((s) => s.children?.[0])
+                    .filter((x) => !!x);
+            case 'parenthesized_expression': {
+                const inner = e.children?.[0];
+                return inner ? [inner] : [];
+            }
+            case 'binary_expression': {
+                const left = getFieldNode(e, 'left');
+                const right = getFieldNode(e, 'right');
+                return [left, right].filter((x) => !!x);
+            }
+            case 'ternary_expression': {
+                const cons = getFieldNode(e, 'consequence');
+                const alt = getFieldNode(e, 'alternative');
+                return [cons, alt].filter((x) => !!x);
+            }
+            case 'call_expression': {
+                const fn = e.children?.[0];
+                if (fn?.type === 'identifier') {
+                    return returnsByName.get(getNodeText(fn, sourceCode)) ?? [];
+                }
+                if (fn?.type === 'member_expression') {
+                    const prop = memberPropertyName(fn, sourceCode);
+                    if (prop && MAP_VALUE_METHODS.has(prop)) {
+                        const cb = firstArgument(e);
+                        if (cb && (cb.type === 'arrow_function' || cb.type === 'function_expression')) {
+                            return returnsOf(cb);
+                        }
+                        return [];
+                    }
+                    if (prop && RECEIVER_PASSTHROUGH_METHODS.has(prop)) {
+                        const obj = fn.children?.find((c) => c.type !== 'property_identifier' && c.type !== '.' && c.type !== '?.');
+                        return obj ? [obj] : [];
+                    }
+                }
+                return [];
+            }
+            default:
+                return [];
+        }
+    };
+    const sinkTemplates = new Set();
+    const seen = new Set();
+    const queue = [...sinkRoots];
+    while (queue.length) {
+        const e = queue.shift();
+        if (seen.has(e))
+            continue;
+        seen.add(e);
+        if (e.type === 'template_string')
+            sinkTemplates.add(e);
+        for (const p of producers(e)) {
+            if (!seen.has(p))
+                queue.push(p);
+        }
+    }
+    return sinkTemplates;
+}
+/** The templates whose value reaches an HTML sink, per file. */
+function computeHtmlSinkTemplates(ast, sourceCode) {
+    const { bindings, returnsByName } = collectLocalFlow(ast, sourceCode);
+    const sinkRoots = collectSinkRoots(ast, sourceCode);
+    return propagateSinkFlow(sinkRoots, bindings, returnsByName, sourceCode);
+}
+/** The `command-injection` candidate for a shell call whose command is unsafe. */
+function commandInjectionCandidate(node, sourceCode, filePath) {
+    const fn = node.children?.[0];
+    if (fn?.type !== 'identifier')
+        return null;
+    const fnName = getNodeText(fn, sourceCode);
+    if (!SHELL_PROCESS_FUNCTIONS.has(fnName))
+        return null;
+    const cmd = firstArgument(node);
+    if (!cmd)
+        return null;
+    let unsafe = false;
+    if (cmd.type === 'template_string') {
+        unsafe = (cmd.children ?? []).some((c) => c.type === 'template_substitution');
+    }
+    else if (cmd.type === 'binary_expression') {
+        if (binaryOperatorIs(cmd, '+', sourceCode)) {
+            const left = getFieldNode(cmd, 'left');
+            const right = getFieldNode(cmd, 'right');
+            unsafe = !isLiteralNode(left) || !isLiteralNode(right);
+        }
+    }
+    if (!unsafe)
+        return null;
+    return {
+        kind: 'command-injection',
+        fnName,
+        file: filePath,
+        line: node.location.start.line,
+        column: node.location.start.column,
+    };
+}
+/** The `dynamic-require` candidate for a computed require/import specifier. */
+function dynamicRequireCandidate(node, sourceCode, filePath) {
+    const fn = node.children?.[0];
+    let isForm = false;
+    if (isBareRequire(node, sourceCode) || fn?.type === 'import') {
+        isForm = true;
+    }
+    else if (isCreateRequireInvocation(node, sourceCode)) {
+        isForm = true;
+    }
+    if (!isForm)
+        return null;
+    const arg = firstArgument(node);
+    if (!arg)
+        return null;
+    if (isLiteralNode(arg))
+        return null;
+    return {
+        kind: 'dynamic-require',
+        argText: getNodeText(arg, sourceCode),
+        calleeText: getNodeText(fn, sourceCode),
+        file: filePath,
+        line: node.location.start.line,
+        column: node.location.start.column,
+    };
+}
+/** Resolve one template substitution to a `prop`-carrying candidate, or null. */
+function interpolationCandidate(sub, sourceCode, filePath) {
+    const expr = sub.children?.[0];
+    if (!expr)
+        return null;
+    if (expr.type === 'call_expression') {
+        const fn = expr.children?.[0];
+        if (fn?.type === 'identifier' && ESCAPE_FNS.has(getNodeText(fn, sourceCode)))
+            return null;
+    }
+    let value = expr;
+    while (value.type === 'binary_expression') {
+        const opNode = getFieldNode(value, 'operator');
+        const op = opNode ? getNodeText(opNode, sourceCode).trim() : null;
+        if (op !== '||' && op !== '??')
+            return null;
+        const left = getFieldNode(value, 'left');
+        const right = getFieldNode(value, 'right');
+        if (!left || !right)
+            return null;
+        if (!isStringConstant(right))
+            return null;
+        value = left;
+    }
+    if (value.type !== 'member_expression')
+        return null;
+    const prop = memberPropertyName(value, sourceCode);
+    if (!prop)
+        return null;
+    return {
+        kind: 'unescaped-html',
+        prop,
+        file: filePath,
+        line: sub.location.start.line,
+        column: sub.location.start.column,
+    };
+}
+/** The `unescaped-html` candidates for one sink-reaching template, honoring the
+ *  script/style context so a substitution inside `<script>`/`<style>` is not
+ *  misread as an HTML interpolation. */
+function unescapedHtmlCandidates(template, sourceCode, filePath) {
+    const out = [];
+    let scriptDepth = 0;
+    let styleDepth = 0;
+    for (const child of template.children ?? []) {
+        if (child.type === 'string_fragment') {
+            const text = getNodeText(child, sourceCode);
+            const openScript = (text.match(/<script\b/gi) ?? []).length;
+            const closeScript = (text.match(/<\/script\s*>/gi) ?? []).length;
+            const openStyle = (text.match(/<style\b/gi) ?? []).length;
+            const closeStyle = (text.match(/<\/style\s*>/gi) ?? []).length;
+            scriptDepth = Math.max(0, scriptDepth + openScript - closeScript);
+            styleDepth = Math.max(0, styleDepth + openStyle - closeStyle);
+        }
+        else if (child.type === 'template_substitution') {
+            if (scriptDepth > 0 || styleDepth > 0)
+                continue;
+            const c = interpolationCandidate(child, sourceCode, filePath);
+            if (c)
+                out.push(c);
+        }
+    }
+    return out;
+}
+/**
+ * One file's security constructs as `SecurityCandidate[]`.
+ *
+ * @param file - The parsed file whose security constructs are projected.
+ * @returns The file's command-injection, dynamic-require, and HTML-sink candidates.
+ */
+export function extractSecurityCandidates(file) {
+    const out = [];
+    const sourceCode = file.source;
+    const filePath = file.file;
+    walkAST(file.ast.root, (node) => {
+        if (node.type !== 'call_expression')
+            return;
+        const inj = commandInjectionCandidate(node, sourceCode, filePath);
+        if (inj)
+            out.push(inj);
+        const req = dynamicRequireCandidate(node, sourceCode, filePath);
+        if (req)
+            out.push(req);
+    });
+    const sinkTemplates = computeHtmlSinkTemplates(file.ast, sourceCode);
+    walkAST(file.ast.root, (node) => {
+        if (node.type === 'template_string' && sinkTemplates.has(node)) {
+            out.push(...unescapedHtmlCandidates(node, sourceCode, filePath));
+        }
+    });
+    return out;
+}
+//# sourceMappingURL=securityCandidates.js.map

package/dist/phase/securityCandidates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityCandidates.js","sourceRoot":"","sources":["../../src/phase/securityCandidates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAGnF,6EAA6E;AAC7E,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc;IAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW;CAC1C,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY;IAClD,UAAU,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG;CACrC,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ;IACvE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY;IACvD,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ;IAClE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;CACpC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAEtD,kFAAkF;AAClF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5E,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,IAAyB;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC;QACrF,OAAO,CAAC,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,IAAyB;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChG,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,IAAa;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IAChE,OAAO,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,IAAa,EAAE,UAAkB;IACtD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,EAAE,IAAI,KAAK,YAAY,IAAI,WAAW,CAAC,EAAE,EAAE,UAAU,CAAC,KAAK,SAAS,CAAC;AAChF,CAAC;AAED,wFAAwF;AACxF,SAAS,yBAAyB,CAAC,IAAa,EAAE,UAAkB;IAClE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,EAAE,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,OAAO,OAAO,EAAE,IAAI,KAAK,YAAY,IAAI,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,eAAe,CAAC;AAChG,CAAC;AAED,4EAA4E;AAC5E,SAAS,gBAAgB,CAAC,IAAa,EAAE,KAAa,EAAE,UAAkB;IACxE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,EAAE;QAAE,OAAO,WAAW,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,gFAAgF;AAChF,SAAS,kBAAkB,CAAC,IAAa,EAAE,UAAkB;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,qFAAqF;AACrF,SAAS,wBAAwB,CAAC,QAAiB;IACjD,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;YAC5D,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,QAAiB,EAAE,UAAkB;IAC9D,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,EAAE,IAAI,KAAK,mBAAmB;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,kBAAkB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1D,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,UAAU,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3F,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,MAAe;IAChC,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;oBAAE,SAAS;gBAChE,OAAO,CAAC,CAAC,CAAC,CAAC;YACb,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,mFAAmF;AACnF,SAAS,gBAAgB,CACvB,GAAQ,EACR,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC9C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAqB,CAAC;IAEnD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;gBAClB,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChB,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACrB,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBAC5E,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;oBAC9B,IAAI,IAAI,CAAC,MAAM;wBAAE,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC7B,IAAI,IAAI,CAAC,MAAM;oBAAE,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;AACrC,CAAC;AAED,yEAAyE;AACzE,SAAS,gBAAgB,CAAC,GAAQ,EAAE,UAAkB;IACpD,MAAM,SAAS,GAAc,EAAE,CAAC;IAEhC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,IAAI,IAAI,EAAE,IAAI,KAAK,mBAAmB,IAAI,KAAK,EAAE,CAAC;gBAChD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAClD,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW;oBAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,KAAK,qBAAqB;oBAClD,CAAC,CAAC,OAAO,KAAK,QAAQ;oBACtB,CAAC,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,UAAU,CAAC;gBACrD,IAAI,SAAS;oBAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CACnE,CAAC;YACF,IAAI,QAAQ,IAAI,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,yBAAyB,EAAE,CAAC;gBAChF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAC1D,CAAC;gBACF,IAAI,SAAS,EAAE,CAAC;oBACd,IAAI,SAAS,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;wBACxC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;wBAChF,IAAI,KAAK;4BAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnC,CAAC;yBAAM,CAAC;wBACN,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CACtF,CAAC;YACF,IAAI,OAAO;gBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uFAAuF;AACvF,SAAS,iBAAiB,CACxB,SAAoB,EACpB,QAAgC,EAChC,aAAqC,EACrC,UAAkB;IAElB,MAAM,SAAS,GAAG,CAAC,CAAU,EAAa,EAAE;QAC1C,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,YAAY;gBACf,OAAO,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YACxD,KAAK,iBAAiB;gBACpB,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;qBACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,CAAC;qBACjD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;qBAC3B,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,KAAK,0BAA0B,CAAC,CAAC,CAAC;gBAChC,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC9B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,CAAC;YACD,KAAK,mBAAmB,CAAC,CAAC,CAAC;gBACzB,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;gBACrC,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACvC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,KAAK,oBAAoB,CAAC,CAAC,CAAC;gBAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;gBAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;gBAC3C,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,EAAE,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC9B,OAAO,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC9D,CAAC;gBACD,IAAI,EAAE,EAAE,IAAI,KAAK,mBAAmB,EAAE,CAAC;oBACrC,MAAM,IAAI,GAAG,kBAAkB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;oBAChD,IAAI,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACxC,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;wBAC5B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,gBAAgB,IAAI,EAAE,CAAC,IAAI,KAAK,qBAAqB,CAAC,EAAE,CAAC;4BAC9E,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;wBACvB,CAAC;wBACD,OAAO,EAAE,CAAC;oBACZ,CAAC;oBACD,IAAI,IAAI,IAAI,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACnD,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAC7E,CAAC;wBACF,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1B,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD;gBACE,OAAO,EAAE,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAW,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,MAAM,KAAK,GAAc,CAAC,GAAG,SAAS,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB;YAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,gEAAgE;AAChE,SAAS,wBAAwB,CAAC,GAAQ,EAAE,UAAkB;IAC5D,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACpD,OAAO,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;AAC3E,CAAC;AAED,kFAAkF;AAClF,SAAS,yBAAyB,CAAC,IAAa,EAAE,UAAkB,EAAE,QAAgB;IACpF,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,EAAE,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACnC,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC;IAChF,CAAC;SAAM,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC5C,IAAI,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACzC,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,MAAM;QACN,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI;QAC9B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM;KACnC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,uBAAuB,CAAC,IAAa,EAAE,UAAkB,EAAE,QAAgB;IAClF,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7D,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;SAAM,IAAI,yBAAyB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC;QACrC,UAAU,EAAE,WAAW,CAAC,EAAG,EAAE,UAAU,CAAC;QACxC,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI;QAC9B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM;KACnC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,sBAAsB,CAAC,GAAY,EAAE,UAAkB,EAAE,QAAgB;IAChF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,EAAE,EAAE,IAAI,KAAK,YAAY,IAAI,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5F,CAAC;IACD,IAAI,KAAK,GAAY,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,IAAI;QACJ,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI;QAC7B,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM;KAClC,CAAC;AACJ,CAAC;AAED;;wCAEwC;AACxC,SAAS,uBAAuB,CAAC,QAAiB,EAAE,UAAkB,EAAE,QAAgB;IACtF,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC5C,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAC5D,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACjE,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAC1D,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAC/D,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC,CAAC;YAClE,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YAClD,IAAI,WAAW,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC;gBAAE,SAAS;YAChD,MAAM,CAAC,GAAG,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC9D,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;IAE3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO;QAC5C,MAAM,GAAG,GAAG,yBAAyB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/phase/seeded-defects.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Spec 68 §16 — the compile-time checks, seeded permanently.
+ *
+ * Each block below is deliberately broken and sits under `@ts-expect-error`.
+ * The `@ts-expect-error` is what turns criterion 4's seeded demonstration into
+ * a permanent test instead of a one-time manual act: it is *satisfied* only
+ * while the corresponding check in checks.ts is healthy enough that the broken
+ * assignment fails to type-check. If a future edit weakens a check so that the
+ * assignment starts to compile, the `@ts-expect-error` becomes an unused
+ * directive and `tsc --noEmit` fails — the regression is caught at build time,
+ * not found by hand.
+ *
+ * This file is intentionally NOT a `*.spec.ts` / `*.test.ts`: those suffixes
+ * are excluded from the tsconfig, and this file's entire job is to be seen by
+ * the type-checker. It is never imported and emits nothing at runtime.
+ */
+export {};
+//# sourceMappingURL=seeded-defects.d.ts.map

package/dist/phase/seeded-defects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seeded-defects.d.ts","sourceRoot":"","sources":["../../src/phase/seeded-defects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}

package/dist/phase/seeded-defects.js

@@ -0,0 +1,61 @@
+/**
+ * Spec 68 §16 — the compile-time checks, seeded permanently.
+ *
+ * Each block below is deliberately broken and sits under `@ts-expect-error`.
+ * The `@ts-expect-error` is what turns criterion 4's seeded demonstration into
+ * a permanent test instead of a one-time manual act: it is *satisfied* only
+ * while the corresponding check in checks.ts is healthy enough that the broken
+ * assignment fails to type-check. If a future edit weakens a check so that the
+ * assignment starts to compile, the `@ts-expect-error` becomes an unused
+ * directive and `tsc --noEmit` fails — the regression is caught at build time,
+ * not found by hand.
+ *
+ * This file is intentionally NOT a `*.spec.ts` / `*.test.ts`: those suffixes
+ * are excluded from the tsconfig, and this file's entire job is to be seen by
+ * the type-checker. It is never imported and emits nothing at runtime.
+ */
+// 1. Residue #1 — every fact kind has a producer. `Exclude<FactKind,
+//    ProducedFactKind>` is `never` only when every kind is produced; assigning a
+//    FactKind value to `never` must not compile.
+// @ts-expect-error — an unproduced fact kind would make this a non-never type
+const _unproduced = 'file-symbols';
+// 2. Residue #2 — every produced kind is consumed by a migrated rule or corpus
+//    processor. `Exclude<ProducedFactKind, ConsumedFactKind>` is `never` only
+//    when every produced kind is read; assigning a produced kind to `never` must
+//    not compile. The seed names `file-symbols`, so it liveness-fails the moment
+//    that kind stops being declared by any rule or corpus processor (the
+//    `@ts-expect-error` goes unused).
+// @ts-expect-error — an unconsumed produced kind would make this a non-never type
+const _unconsumed = 'file-symbols';
+// 3. Serializability — no fact kind carries a method. A function is not
+//    `Serializable`, so a fact shaped like this could never cross the
+//    Process→Analyze boundary as a value.
+// @ts-expect-error — a function is not Serializable
+const _notSerializable = () => { };
+// 4. Single producer — `ProducerMap` is an exhaustive mapped type over
+//    `FileFactKind` (each key a second mapped type over its `SupplyingFormats`).
+//    An object literal missing every file-kind key must not satisfy it (a
+//    second producer for one (kind, format) is caught the same way, as a
+//    duplicate key). `CORPUS_PRODUCERS` is checked the same way by its own
+//    `satisfies CorpusProducerMap` in producers.ts.
+// @ts-expect-error — {} lacks every file-kind key, so it cannot satisfy ProducerMap
+const _incompleteProducers = {};
+// 5. Map disjointness — a fact kind must not be produced by both a file
+//    producer and a corpus producer (two producers for one kind). The
+//    intersection of the two maps' key sets is `never` only while they are
+//    disjoint; assigning a FactKind literal to it must not compile. If a kind
+//    were present in both, the intersection would widen to that kind's name and
+//    this assignment would compile — the `@ts-expect-error` goes unused and the
+//    build fails.
+// @ts-expect-error — an overlapping kind would make this a non-never type
+const _overlap = 'resolution';
+// 6. Producer-side oracle (Spec 69 R1 criterion 1) — `FileProcessor` requires
+//    `oracle`. A processor literal that omits it must not satisfy the type, the
+//    producer-side forcing function mirroring a rule's `needs` (criterion 4's
+//    seeded demonstration in Spec 68). If a future edit makes `oracle` optional,
+//    this literal starts to compile and the `@ts-expect-error` goes unused — the
+//    build fails.
+// @ts-expect-error — a FileProcessor without `oracle` must not satisfy the type
+const _noOracle = { id: 'file-symbols.typescript', produces: 'file-symbols', format: 'typescript', process: (_file) => [] };
+export {};
+//# sourceMappingURL=seeded-defects.js.map

package/dist/phase/seeded-defects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seeded-defects.js","sourceRoot":"","sources":["../../src/phase/seeded-defects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,qEAAqE;AACrE,iFAAiF;AACjF,iDAAiD;AACjD,8EAA8E;AAC9E,MAAM,WAAW,GAAwC,cAA0B,CAAC;AAEpF,+EAA+E;AAC/E,8EAA8E;AAC9E,iFAAiF;AACjF,iFAAiF;AACjF,yEAAyE;AACzE,sCAAsC;AACtC,kFAAkF;AAClF,MAAM,WAAW,GAAgD,cAAkC,CAAC;AAEpG,wEAAwE;AACxE,sEAAsE;AACtE,0CAA0C;AAC1C,oDAAoD;AACpD,MAAM,gBAAgB,GAAiB,GAAG,EAAE,GAAE,CAAC,CAAC;AAEhD,uEAAuE;AACvE,iFAAiF;AACjF,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,oDAAoD;AACpD,oFAAoF;AACpF,MAAM,oBAAoB,GAAgB,EAAE,CAAC;AAE7C,wEAAwE;AACxE,sEAAsE;AACtE,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,kBAAkB;AAClB,0EAA0E;AAC1E,MAAM,QAAQ,GAA2D,YAAY,CAAC;AAEtF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,iFAAiF;AACjF,iFAAiF;AACjF,kBAAkB;AAClB,gFAAgF;AAChF,MAAM,SAAS,GAAgD,EAAE,EAAE,EAAE,yBAAyB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,EAAW,EAAE,CAAC"}

package/dist/phase/stringLiterals.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Spec 68 §3.2 — the per-file `string-literals` producer.
+ *
+ * Projects every string / template-string node onto the serializable
+ * `StringLiteralFact`: the raw source text (`getNodeText`, quotes/backticks
+ * included) plus the 1-based start position. The raw text is the grouping key,
+ * matching `UniversalDRYAnalyzer.checkDuplicateStrings` which read `getNodeText`
+ * and compared the quoted string verbatim.
+ *
+ * `enclosingFunction` is the enclosing-identity label computed here (where the
+ * AST still lives) via the shared `findEnclosingFunctionIdentity` +
+ * `functionIdentityLabel` — the same pair `UniversalDataAccessAnalyzer`'s
+ * `enclosingIdentity` used for `hardcoded-connection`'s symbol. The rule only
+ * reads the label; the tree is gone before it runs.
+ */
+import type { AstFile, StringLiteralFact } from './types.js';
+/**
+ * One file's string/template-string literals as `StringLiteralFact[]`.
+ *
+ * @param file - The parsed file whose literals are projected.
+ * @returns The file's string literals with their enclosing-function labels.
+ */
+export declare function extractStringLiterals(file: AstFile): StringLiteralFact[];
+//# sourceMappingURL=stringLiterals.d.ts.map

package/dist/phase/stringLiterals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stringLiterals.d.ts","sourceRoot":"","sources":["../../src/phase/stringLiterals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAM7D;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,EAAE,CAaxE"}

package/dist/phase/stringLiterals.js

@@ -0,0 +1,35 @@
+/**
+ * Spec 68 §3.2 — the per-file `string-literals` producer.
+ *
+ * Projects every string / template-string node onto the serializable
+ * `StringLiteralFact`: the raw source text (`getNodeText`, quotes/backticks
+ * included) plus the 1-based start position. The raw text is the grouping key,
+ * matching `UniversalDRYAnalyzer.checkDuplicateStrings` which read `getNodeText`
+ * and compared the quoted string verbatim.
+ *
+ * `enclosingFunction` is the enclosing-identity label computed here (where the
+ * AST still lives) via the shared `findEnclosingFunctionIdentity` +
+ * `functionIdentityLabel` — the same pair `UniversalDataAccessAnalyzer`'s
+ * `enclosingIdentity` used for `hardcoded-connection`'s symbol. The rule only
+ * reads the label; the tree is gone before it runs.
+ */
+import { findEnclosingFunctionIdentity, functionIdentityLabel, } from '../analyzers/universal/schema/codeAnalysis.js';
+/**
+ * One file's string/template-string literals as `StringLiteralFact[]`.
+ *
+ * @param file - The parsed file whose literals are projected.
+ * @returns The file's string literals with their enclosing-function labels.
+ */
+export function extractStringLiterals(file) {
+    const nodes = file.adapter.findNodes(file.ast, {
+        custom: (node) => node.type === 'string' || node.type === 'template_string',
+    });
+    return nodes.map((node) => ({
+        file: file.file,
+        value: file.adapter.getNodeText(node, file.source),
+        line: node.location.start.line,
+        column: node.location.start.column,
+        enclosingFunction: functionIdentityLabel(findEnclosingFunctionIdentity(node, file.adapter, file.file)),
+    }));
+}
+//# sourceMappingURL=stringLiterals.js.map