dravix-agent 0.1.0

package/dist/engines/js-sinks.js

@@ -0,0 +1,370 @@
+import { makeFindingId } from "../findings.js";
+import { isLineSuppressed, isTestOrFixturePath } from "./pragma.js";
+// ── Helpers ──────────────────────────────────────────────────────────────
+/** A JS arg "looks tainted" if it is NOT a pure string/number literal. */
+function looksTainted(arg) {
+    const s = arg.trim();
+    if (s === "")
+        return false;
+    // Template literal with substitution: `...${x}...` is ALWAYS tainted.
+    if (/^`[^`]*\$\{/.test(s))
+        return true;
+    // Plain string literal (no concat with var indicators).
+    if (/^['"`]/.test(s)) {
+        if (/[+]\s*[a-zA-Z_$]/.test(s))
+            return true; // "...".concat-like
+        return false;
+    }
+    // Numeric literal.
+    if (/^-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(s))
+        return false;
+    // boolean / null / undefined literals.
+    if (/^(?:true|false|null|undefined)$/.test(s))
+        return false;
+    // Anything else: variable, function call, property access → tainted.
+    return true;
+}
+/** First positional arg from a parenthesized call body. */
+function firstPositionalArg(body) {
+    let depth = 0;
+    let inStr = null;
+    for (let i = 0; i < body.length; i++) {
+        const c = body[i];
+        if (inStr) {
+            if (c === inStr && body[i - 1] !== "\\")
+                inStr = null;
+            continue;
+        }
+        if (c === '"' || c === "'" || c === "`") {
+            inStr = c;
+            continue;
+        }
+        if (c === "(" || c === "[" || c === "{")
+            depth++;
+        else if (c === ")" || c === "]" || c === "}")
+            depth--;
+        else if (c === "," && depth === 0)
+            return body.slice(0, i).trim();
+    }
+    return body.trim();
+}
+/** Common taint sources in browser/Node code. Used by SSRF / open-redirect /
+ * path-traversal rules to confirm input flows from user-controlled places. */
+const TAINT_SOURCE_RE = /\b(?:req\.(?:params|query|body|headers|cookies)|request\.(?:params|query|body)|process\.argv|process\.env\b(?!\.NODE_ENV\b)|location\.(?:hash|search|href|pathname)|document\.URL|window\.name|new\s+URL\s*\([^)]*location\.)/;
+function containsTaintSource(s) {
+    return TAINT_SOURCE_RE.test(s);
+}
+// ── Rules ────────────────────────────────────────────────────────────────
+const RULES = [
+    // ── Code execution ─────────────────────────────────────────────────────
+    {
+        id: "eval-tainted",
+        cwe: "CWE-95",
+        severity: "critical",
+        what: "eval() called with non-literal argument",
+        // (?<![\w.]) avoids matching obj.eval (own-eval methods)
+        pattern: /(?<![\w.])eval\s*\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g,
+        isDangerous: (first) => looksTainted(first),
+        remediation: "Never eval user input. For JSON use JSON.parse; for dynamic dispatch use a name→function map. " +
+            "If a constant calculation is required, use a vetted expression evaluator (mathjs, expr-eval) " +
+            "with a sandbox.",
+    },
+    {
+        id: "new-function-tainted",
+        cwe: "CWE-95",
+        severity: "critical",
+        what: "new Function(...) — eval-equivalent",
+        pattern: /\bnew\s+Function\s*\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g,
+        isDangerous: () => true,
+        remediation: "new Function() compiles a string into a function and is identical to eval in capability. " +
+            "Refactor to a pre-compiled lookup table; for plugin systems consider iframes/Workers with " +
+            "structured-clone messaging.",
+    },
+    {
+        id: "settimer-string",
+        cwe: "CWE-95",
+        severity: "high",
+        what: "setTimeout / setInterval called with a string body (implicit eval)",
+        pattern: /\b(?:setTimeout|setInterval)\s*\(\s*(['"`])/g,
+        isDangerous: () => true,
+        remediation: "Pass a function literal: setTimeout(() => { ... }, 1000). String-form setTimeout implicitly " +
+            "evals its first argument and is treated as eval by browsers and CSP.",
+    },
+    // ── XSS ────────────────────────────────────────────────────────────────
+    {
+        id: "innerhtml-tainted",
+        cwe: "CWE-79",
+        severity: "critical",
+        what: ".innerHTML assigned a non-literal value — DOM XSS",
+        // Capture the RHS of the assignment (heuristic: up to ; or newline).
+        pattern: /\.innerHTML\s*=\s*([^;\n]+)/g,
+        isDangerous: (rhs) => looksTainted(rhs),
+        remediation: "Use .textContent for text (auto-escaped) or DOMPurify.sanitize(html) before assigning to innerHTML. " +
+            "For rich content build the DOM imperatively: createElement + textContent + appendChild.",
+    },
+    {
+        id: "outerhtml-tainted",
+        cwe: "CWE-79",
+        severity: "critical",
+        what: ".outerHTML assigned a non-literal value — DOM XSS",
+        pattern: /\.outerHTML\s*=\s*([^;\n]+)/g,
+        isDangerous: (rhs) => looksTainted(rhs),
+        remediation: "Replace the element with replaceWith(textNode) or replaceChildren() — do not assign outerHTML " +
+            "with attacker-controlled markup.",
+    },
+    {
+        id: "document-write",
+        cwe: "CWE-79",
+        severity: "critical",
+        what: "document.write / writeln called with non-literal — XSS + page-parse corruption",
+        pattern: /\bdocument\.(?:write|writeln)\s*\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g,
+        isDangerous: (first) => looksTainted(first),
+        remediation: "Build the DOM via document.createElement + appendChild. document.write is sync, blocks the " +
+            "parser, and turns any HTML string into live nodes — XSS-sink by design.",
+    },
+    {
+        id: "react-dangerously-set-innerhtml",
+        cwe: "CWE-79",
+        severity: "critical",
+        what: "React dangerouslySetInnerHTML — XSS sink unless sanitized",
+        // Match the prop with a __html that references a variable (not literal).
+        pattern: /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:\s*([^}]+)\}/g,
+        isDangerous: (val) => looksTainted(val),
+        remediation: "Always run user-controlled HTML through DOMPurify.sanitize() before passing as __html. Better: " +
+            "represent content as React children (auto-escaped) and avoid raw HTML entirely.",
+    },
+    // ── Command injection ──────────────────────────────────────────────────
+    {
+        id: "child-process-exec",
+        cwe: "CWE-78",
+        severity: "critical",
+        what: "child_process.exec / execSync called with non-literal command — OS command injection",
+        // Match BOTH child_process.exec(...) AND bare exec(...). Bare exec is
+        // very common (RegExp.exec, jest .exec) — gate to files that actually
+        // import child_process so the rule doesn't fire on regex / matcher use.
+        pattern: /\b(?:child_process\.|cp\.)?(?:exec|execSync)\s*\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g,
+        fileGate: (c) => /\bchild_process\b|require\s*\(\s*['"`]child_process['"`]\s*\)|from\s+['"`]child_process['"`]/.test(c),
+        isDangerous: (first) => looksTainted(first),
+        remediation: "exec / execSync invoke /bin/sh -c. Use execFile / execFileSync (no shell) with an arg array: " +
+            "execFile('git', ['log', '--oneline'], cb). Validate the binary against an allow-list.",
+    },
+    {
+        id: "spawn-shell-true",
+        cwe: "CWE-78",
+        severity: "critical",
+        what: "spawn / spawnSync called with shell:true and tainted command",
+        pattern: /\b(?:child_process\.)?(?:spawn|spawnSync)\s*\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g,
+        isDangerous: (first, all) => /shell\s*:\s*true\b/.test(all) && looksTainted(first),
+        remediation: "Drop shell:true (the default is false — safer). Pass the command + args as separate values: " +
+            "spawn('nslookup', [domain]). shell:true means the runtime invokes /bin/sh -c <string>, opening " +
+            "the gate for ; | & $() chains.",
+    },
+    // ── Path traversal ─────────────────────────────────────────────────────
+    {
+        id: "fs-tainted",
+        cwe: "CWE-22",
+        severity: "high",
+        what: "fs.{readFile,writeFile,unlink,createReadStream,...} called with path derived from request input",
+        pattern: /\bfs\.(?:readFile|readFileSync|createReadStream|writeFile|writeFileSync|unlink|unlinkSync)\s*\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g,
+        isDangerous: (first) => containsTaintSource(first),
+        remediation: "Use path.resolve(safeBase, path.basename(userInput)) and verify the resolved path STARTS WITH " +
+            "the safe base directory. Even better: maintain a map of allowed file ids → static paths.",
+    },
+    // ── SSRF ───────────────────────────────────────────────────────────────
+    {
+        id: "ssrf-fetch-tainted",
+        cwe: "CWE-918",
+        severity: "high",
+        what: "fetch / axios / got / http.get / request called with URL from user input — SSRF",
+        pattern: /\b(?:fetch|axios(?:\.[a-z]+)?|got(?:\.[a-z]+)?|http\.get|https\.get|request)\s*\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g,
+        isDangerous: (first) => containsTaintSource(first),
+        remediation: "Parse the URL with new URL(input), require scheme to be http(s), and reject targets in " +
+            "loopback / link-local / RFC1918 / metadata-service ranges (169.254.169.254). Maintain " +
+            "an allow-list of permitted hosts per integration.",
+    },
+    // ── Weak crypto ────────────────────────────────────────────────────────
+    {
+        id: "weak-crypto-createhash",
+        cwe: "CWE-327",
+        severity: "high",
+        what: "crypto.createHash called with md5 or sha1",
+        pattern: /\bcrypto\.createHash\s*\(\s*['"`]([^'"`]+)['"`]\s*\)/g,
+        isDangerous: (alg) => /^(md5|sha1|md4)$/i.test(alg),
+        remediation: "Use crypto.createHash('sha256') or createHash('sha3-256'). For password hashing use " +
+            "argon2 (npm: argon2 or argon2-cffi) or bcrypt. MD5 and SHA-1 are practically collisionable.",
+    },
+    {
+        id: "math-random-for-security",
+        cwe: "CWE-338",
+        severity: "high",
+        what: "Math.random() used in a security-sensitive context",
+        pattern: /\bMath\.random\s*\(\s*\)/g,
+        // Only fire if the file contains a security keyword somewhere — random
+        // for dice / UI / animation is fine.
+        // Case-insensitive substring (camelCase aware via plain substring match).
+        fileGate: (c) => /(?:token|password|nonce|csrf|sessionid|api[_-]?key|authkey|signingkey)/i.test(c) ||
+            /\bsecret\b/i.test(c),
+        isDangerous: () => true,
+        remediation: "Use crypto.randomBytes(N).toString('hex') or crypto.randomUUID(). Math.random is a PRNG " +
+            "(typically Xorshift128+) — predictable and unsuitable for any token or secret.",
+    },
+    // ── JWT misuse ─────────────────────────────────────────────────────────
+    {
+        id: "jwt-alg-none",
+        cwe: "CWE-347",
+        severity: "critical",
+        what: "jwt.verify called with algorithms:['none'] — accepts any forged token",
+        pattern: /\bjwt\.verify\s*\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g,
+        isDangerous: (_first, all) => /algorithms\s*:\s*\[[^\]]*['"]none['"]/i.test(all),
+        remediation: "Pin exactly one algorithm: jwt.verify(token, key, { algorithms: ['HS256'] }). 'none' bypasses " +
+            "signature verification entirely — the attacker can forge any payload.",
+    },
+    {
+        id: "jwt-no-algorithms",
+        cwe: "CWE-327",
+        severity: "high",
+        what: "jwt.verify without an algorithms allowlist — enables algorithm-confusion attacks",
+        pattern: /\bjwt\.verify\s*\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g,
+        isDangerous: (_first, all) => !/\balgorithms\s*:/.test(all),
+        remediation: "Always set { algorithms: ['HS256'] } (or your one true algorithm). Without it the library " +
+            "trusts the JWT header's 'alg' field — an attacker can swap RS256 → HS256 and sign with the " +
+            "public key as the HMAC secret.",
+    },
+    {
+        id: "jwt-hardcoded-secret",
+        cwe: "CWE-798",
+        severity: "critical",
+        what: "jwt.sign / verify with a hardcoded short secret (likely test/placeholder)",
+        pattern: /\bjwt\.(?:sign|verify)\s*\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g,
+        isDangerous: (_first, all) => {
+            // Look for second-arg pattern: , "shortstring" or , 'shortstring'
+            const m = all.match(/,\s*['"`]([^'"`]{1,15})['"`]/);
+            return Boolean(m && m[1] && !/^[A-Z_]+$/.test(m[1])); // exclude env-var ALL_CAPS placeholders
+        },
+        remediation: "Load the secret from env (process.env.JWT_SECRET) and generate it with at least 32 random bytes " +
+            "(crypto.randomBytes(32).toString('hex')). Short or hardcoded secrets are crackable offline in seconds.",
+    },
+    // ── Open redirect ──────────────────────────────────────────────────────
+    {
+        id: "open-redirect-res",
+        cwe: "CWE-601",
+        severity: "high",
+        what: "res.redirect called with user-controlled URL — open redirect / phishing pivot",
+        pattern: /\bres\.redirect\s*\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g,
+        isDangerous: (first) => containsTaintSource(first),
+        remediation: "Validate the destination: parse with new URL(value, app-base), confirm origin matches your " +
+            "own host, or maintain an allow-list of safe relative paths. Never redirect to a raw req.query value.",
+    },
+    // ── CORS misconfig ─────────────────────────────────────────────────────
+    {
+        id: "cors-wildcard-credentials",
+        cwe: "CWE-942",
+        severity: "critical",
+        what: "CORS Access-Control-Allow-Origin: * combined with Allow-Credentials: true — data exfiltration",
+        // Multi-line match: ACAO wildcard within 400 chars of credentials true
+        pattern: /['"`]Access-Control-Allow-Origin['"`]\s*[,:]\s*['"`]\*['"`][\s\S]{0,400}?['"`]Access-Control-Allow-Credentials['"`]\s*[,:]\s*['"`]true['"`]/g,
+        isDangerous: () => true,
+        remediation: "Set ACAO to a SPECIFIC origin (or a tight allow-list of origins) when credentials are allowed. " +
+            "The combination ACAO=* + ACAC=true is invalid per spec and exposes authenticated endpoints to " +
+            "every origin — modern browsers refuse it but proxies / caches may strip the credentials header.",
+    },
+    // ── Prototype pollution ────────────────────────────────────────────────
+    {
+        id: "proto-pollution-lodash",
+        cwe: "CWE-1321",
+        severity: "high",
+        what: "lodash _.merge / setWith / defaultsDeep with attacker-controlled source — prototype pollution",
+        pattern: /\b_\.(?:merge|mergeWith|set|setWith|defaultsDeep)\s*\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g,
+        isDangerous: (first, all) => containsTaintSource(first) || containsTaintSource(all),
+        remediation: "Switch to Object.assign({}, ...) or structuredClone + targeted merge. If you must use lodash, " +
+            "lock to >=4.17.21 AND use _.cloneDeep + an allow-list of keys. Prototype pollution gives RCE in " +
+            "many popular libraries (express, mongoose).",
+    },
+    {
+        id: "proto-pollution-assign-prototype",
+        cwe: "CWE-1321",
+        severity: "high",
+        what: "Object.assign(<obj>.prototype, ...) — mutates the prototype chain",
+        pattern: /\bObject\.assign\s*\(\s*[a-zA-Z_$][\w$]*\.prototype\s*,/g,
+        isDangerous: () => true,
+        remediation: "Don't mutate built-in or library prototypes. Add methods on instances or via class extension. " +
+            "Mutating prototypes affects every object in the program and is a common privilege-escalation primitive.",
+    },
+];
+// ── Engine ───────────────────────────────────────────────────────────────
+export class JsSinksEngine {
+    name = "js-sinks";
+    languages = ["javascript", "typescript"];
+    async available() {
+        return true;
+    }
+    async run(input) {
+        const t0 = Date.now();
+        const findings = [];
+        if (input.lang !== "javascript" && input.lang !== "typescript") {
+            return { engine: this.name, findings: [], unavailable: false, durationMs: 0 };
+        }
+        // Auto-skip test / fixture / sink-engine source files: they contain
+        // the very patterns we look for by definition. The LLM critic still
+        // runs on those files so genuine planted bugs are still caught.
+        if (isTestOrFixturePath(input.filePath)) {
+            return { engine: this.name, findings: [], unavailable: false, durationMs: 0 };
+        }
+        const content = input.content;
+        const lines = content.split(/\r?\n/);
+        const seen = new Set(); // dedup overlapping rules on same site
+        for (const rule of RULES) {
+            if (rule.fileGate && !rule.fileGate(content))
+                continue;
+            rule.pattern.lastIndex = 0;
+            let m;
+            while ((m = rule.pattern.exec(content)) !== null) {
+                const allArgs = m[1] ?? "";
+                const firstArg = firstPositionalArg(allArgs);
+                if (!rule.isDangerous(firstArg, allArgs, content))
+                    continue;
+                const upTo = content.slice(0, m.index);
+                const line = upTo.split(/\r?\n/).length;
+                const snippet = (lines[line - 1] ?? "").slice(0, 400);
+                if (isLineSuppressed(snippet, rule.id))
+                    continue;
+                const id = makeFindingId({
+                    engine: this.name,
+                    file: input.filePath,
+                    line,
+                    rule_id: rule.id,
+                });
+                if (seen.has(id))
+                    continue;
+                seen.add(id);
+                findings.push({
+                    id,
+                    engine: "js-sinks",
+                    file: input.filePath,
+                    line,
+                    rule_id: rule.id,
+                    cwe: rule.cwe,
+                    severity: rule.severity,
+                    message: `${rule.what}. Likely ${rule.cwe} — review and remediate before merging.`,
+                    evidence: { snippet },
+                    confidence: 0.75,
+                    source: "pattern",
+                    remediation: rule.remediation,
+                });
+            }
+        }
+        return {
+            engine: this.name,
+            findings,
+            unavailable: false,
+            durationMs: Date.now() - t0,
+        };
+    }
+}
+export const _testing = {
+    RULES,
+    looksTainted,
+    firstPositionalArg,
+    containsTaintSource,
+};
+//# sourceMappingURL=js-sinks.js.map

package/dist/engines/js-sinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"js-sinks.js","sourceRoot":"","sources":["../../src/engines/js-sinks.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAW,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAapE,4EAA4E;AAE5E,0EAA0E;AAC1E,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC3B,sEAAsE;IACtE,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,wDAAwD;IACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,oBAAoB;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,mBAAmB;IACnB,IAAI,oCAAoC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,uCAAuC;IACvC,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,qEAAqE;IACrE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2DAA2D;AAC3D,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;gBAAE,KAAK,GAAG,IAAI,CAAC;YACtD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,KAAK,GAAG,CAAC,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACjD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC;AAED;8EAC8E;AAC9E,MAAM,eAAe,GACnB,+NAA+N,CAAC;AAElO,SAAS,mBAAmB,CAAC,CAAS;IACpC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,4EAA4E;AAE5E,MAAM,KAAK,GAA4B;IACrC,0EAA0E;IAC1E;QACE,EAAE,EAAE,cAAc;QAClB,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,yCAAyC;QAC/C,yDAAyD;QACzD,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;QAC3C,WAAW,EACT,gGAAgG;YAChG,+FAA+F;YAC/F,iBAAiB;KACpB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,uDAAuD;QAChE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI;QACvB,WAAW,EACT,2FAA2F;YAC3F,4FAA4F;YAC5F,6BAA6B;KAChC;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,oEAAoE;QAC1E,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI;QACvB,WAAW,EACT,8FAA8F;YAC9F,sEAAsE;KACzE;IACD,0EAA0E;IAC1E;QACE,EAAE,EAAE,mBAAmB;QACvB,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,mDAAmD;QACzD,qEAAqE;QACrE,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC;QACvC,WAAW,EACT,sGAAsG;YACtG,yFAAyF;KAC5F;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,mDAAmD;QACzD,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC;QACvC,WAAW,EACT,gGAAgG;YAChG,kCAAkC;KACrC;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,gFAAgF;QACtF,OAAO,EACL,oEAAoE;QACtE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;QAC3C,WAAW,EACT,6FAA6F;YAC7F,yEAAyE;KAC5E;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,2DAA2D;QACjE,yEAAyE;QACzE,OAAO,EAAE,iEAAiE;QAC1E,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC;QACvC,WAAW,EACT,iGAAiG;YACjG,iFAAiF;KACpF;IACD,0EAA0E;IAC1E;QACE,EAAE,EAAE,oBAAoB;QACxB,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,sFAAsF;QAC5F,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,OAAO,EACL,mFAAmF;QACrF,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,8FAA8F,CAAC,IAAI,CACjG,CAAC,CACF;QACH,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;QAC3C,WAAW,EACT,+FAA+F;YAC/F,uFAAuF;KAC1F;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,8DAA8D;QACpE,OAAO,EACL,gFAAgF;QAClF,WAAW,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC;QAClF,WAAW,EACT,8FAA8F;YAC9F,iGAAiG;YACjG,gCAAgC;KACnC;IACD,0EAA0E;IAC1E;QACE,EAAE,EAAE,YAAY;QAChB,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,MAAM;QAChB,IAAI,EACF,iGAAiG;QACnG,OAAO,EACL,iIAAiI;QACnI,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAClD,WAAW,EACT,gGAAgG;YAChG,0FAA0F;KAC7F;IACD,0EAA0E;IAC1E;QACE,EAAE,EAAE,oBAAoB;QACxB,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,IAAI,EACF,iFAAiF;QACnF,OAAO,EACL,mHAAmH;QACrH,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAClD,WAAW,EACT,yFAAyF;YACzF,wFAAwF;YACxF,mDAAmD;KACtD;IACD,0EAA0E;IAC1E;QACE,EAAE,EAAE,wBAAwB;QAC5B,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,2CAA2C;QACjD,OAAO,EACL,uDAAuD;QACzD,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QACnD,WAAW,EACT,sFAAsF;YACtF,6FAA6F;KAChG;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,oDAAoD;QAC1D,OAAO,EAAE,2BAA2B;QACpC,uEAAuE;QACvE,qCAAqC;QACrC,0EAA0E;QAC1E,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,yEAAyE,CAAC,IAAI,CAAC,CAAC,CAAC;YACjF,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI;QACvB,WAAW,EACT,0FAA0F;YAC1F,gFAAgF;KACnF;IACD,0EAA0E;IAC1E;QACE,EAAE,EAAE,cAAc;QAClB,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,uEAAuE;QAC7E,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAC3B,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC;QACpD,WAAW,EACT,gGAAgG;YAChG,uEAAuE;KAC1E;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,kFAAkF;QACxF,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3D,WAAW,EACT,4FAA4F;YAC5F,6FAA6F;YAC7F,gCAAgC;KACnC;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,2EAA2E;QACjF,OAAO,EACL,6DAA6D;QAC/D,WAAW,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;YAC3B,kEAAkE;YAClE,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACpD,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,wCAAwC;QAChG,CAAC;QACD,WAAW,EACT,kGAAkG;YAClG,wGAAwG;KAC3G;IACD,0EAA0E;IAC1E;QACE,EAAE,EAAE,mBAAmB;QACvB,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,+EAA+E;QACrF,OAAO,EAAE,sDAAsD;QAC/D,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAClD,WAAW,EACT,6FAA6F;YAC7F,sGAAsG;KACzG;IACD,0EAA0E;IAC1E;QACE,EAAE,EAAE,2BAA2B;QAC/B,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,UAAU;QACpB,IAAI,EACF,+FAA+F;QACjG,uEAAuE;QACvE,OAAO,EACL,8IAA8I;QAChJ,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI;QACvB,WAAW,EACT,iGAAiG;YACjG,gGAAgG;YAChG,iGAAiG;KACpG;IACD,0EAA0E;IAC1E;QACE,EAAE,EAAE,wBAAwB;QAC5B,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,MAAM;QAChB,IAAI,EACF,+FAA+F;QACjG,OAAO,EACL,wFAAwF;QAC1F,WAAW,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC;QACnF,WAAW,EACT,gGAAgG;YAChG,kGAAkG;YAClG,6CAA6C;KAChD;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,mEAAmE;QACzE,OAAO,EACL,0DAA0D;QAC5D,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI;QACvB,WAAW,EACT,gGAAgG;YAChG,yGAAyG;KAC5G;CACF,CAAC;AAEF,4EAA4E;AAE5E,MAAM,OAAO,aAAa;IACf,IAAI,GAAG,UAAmB,CAAC;IAC3B,SAAS,GAAwB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAEvE,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAqB;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/D,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAChF,CAAC;QACD,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,IAAI,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,uCAAuC;QAEvE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACvD,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjD,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBAC7C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC;oBAAE,SAAS;gBAE5D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBACxC,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACtD,IAAI,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;oBAAE,SAAS;gBACjD,MAAM,EAAE,GAAG,aAAa,CAAC;oBACvB,MAAM,EAAE,IAAI,CAAC,IAAI;oBACjB,IAAI,EAAE,KAAK,CAAC,QAAQ;oBACpB,IAAI;oBACJ,OAAO,EAAE,IAAI,CAAC,EAAE;iBACjB,CAAC,CAAC;gBACH,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,SAAS;gBAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE;oBACF,MAAM,EAAE,UAAU;oBAClB,IAAI,EAAE,KAAK,CAAC,QAAQ;oBACpB,IAAI;oBACJ,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,GAAG,yCAAyC;oBAClF,QAAQ,EAAE,EAAE,OAAO,EAAE;oBACrB,UAAU,EAAE,IAAI;oBAChB,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,IAAI;YACjB,QAAQ;YACR,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;SAC5B,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,KAAK;IACL,YAAY;IACZ,kBAAkB;IAClB,mBAAmB;CACpB,CAAC"}

package/dist/engines/llm-critic.d.ts

@@ -0,0 +1,130 @@
+import { z } from "zod";
+import { Finding } from "../findings.js";
+import { type VulRagHit } from "../index/vulrag.js";
+import type { Engine } from "./types.js";
+export declare class CriticAuthError extends Error {
+}
+export declare class CriticUnavailableError extends Error {
+}
+declare const VerdictRow: z.ZodObject<{
+    rule_id: z.ZodString;
+    cwe: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    severity: z.ZodEnum<["info", "low", "medium", "high", "critical"]>;
+    line: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    message: z.ZodString;
+    evidence: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    remediation: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    confidence: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    message: string;
+    rule_id: string;
+    severity: "info" | "low" | "medium" | "high" | "critical";
+    evidence: string;
+    confidence: number;
+    remediation: string;
+    line?: number | null | undefined;
+    cwe?: string | null | undefined;
+}, {
+    message: string;
+    rule_id: string;
+    severity: "info" | "low" | "medium" | "high" | "critical";
+    confidence: number;
+    line?: number | null | undefined;
+    cwe?: string | null | undefined;
+    evidence?: string | undefined;
+    remediation?: string | undefined;
+}>;
+declare function findClaudeCli(): Promise<string | null>;
+/** Test-only: reset the cached PATH lookup. */
+export declare function _resetCliCacheForTests(): void;
+/** Strip ASCII control chars (Cc), bidi overrides, and the Unicode tag block
+ * (U+E0000..U+E007F) which is invisible to humans but encodes instructions
+ * to LLMs (trojan-source / invisible-tag attack research, 2024-2025). */
+declare function sanitizeForPrompt(s: string, maxLen: number): string;
+interface PromptInputs {
+    filePath: string;
+    content: string;
+    lang: string;
+    priorFindings: ReadonlyArray<Finding>;
+    projectContextJson?: string;
+    vulrag: ReadonlyArray<VulRagHit>;
+}
+declare function buildPrompt(inputs: PromptInputs): string;
+declare function extractJsonObject(text: string): unknown | null;
+declare function verdictRowsToFindings(rows: z.infer<typeof VerdictRow>[], ctx: {
+    file: string;
+    contentLineCount: number;
+    vulragHits: ReadonlyArray<VulRagHit>;
+}): Finding[];
+declare function critiqueCacheKey(parts: {
+    contentHash: string;
+    priorFindingsHash: string;
+    contextHash: string;
+    vulragHash: string;
+    model: string;
+    effort: string;
+}): string;
+export declare const llmCriticEngine: Engine;
+export declare const _testing: {
+    buildPrompt: typeof buildPrompt;
+    sanitizeForPrompt: typeof sanitizeForPrompt;
+    extractJsonObject: typeof extractJsonObject;
+    verdictRowsToFindings: typeof verdictRowsToFindings;
+    critiqueCacheKey: typeof critiqueCacheKey;
+    VerdictEnvelope: z.ZodObject<{
+        findings: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            rule_id: z.ZodString;
+            cwe: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            severity: z.ZodEnum<["info", "low", "medium", "high", "critical"]>;
+            line: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            message: z.ZodString;
+            evidence: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            remediation: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            confidence: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            message: string;
+            rule_id: string;
+            severity: "info" | "low" | "medium" | "high" | "critical";
+            evidence: string;
+            confidence: number;
+            remediation: string;
+            line?: number | null | undefined;
+            cwe?: string | null | undefined;
+        }, {
+            message: string;
+            rule_id: string;
+            severity: "info" | "low" | "medium" | "high" | "critical";
+            confidence: number;
+            line?: number | null | undefined;
+            cwe?: string | null | undefined;
+            evidence?: string | undefined;
+            remediation?: string | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        findings: {
+            message: string;
+            rule_id: string;
+            severity: "info" | "low" | "medium" | "high" | "critical";
+            evidence: string;
+            confidence: number;
+            remediation: string;
+            line?: number | null | undefined;
+            cwe?: string | null | undefined;
+        }[];
+    }, {
+        findings?: {
+            message: string;
+            rule_id: string;
+            severity: "info" | "low" | "medium" | "high" | "critical";
+            confidence: number;
+            line?: number | null | undefined;
+            cwe?: string | null | undefined;
+            evidence?: string | undefined;
+            remediation?: string | undefined;
+        }[] | undefined;
+    }>;
+    findClaudeCli: typeof findClaudeCli;
+    PROMPT_VERSION: string;
+};
+export {};
+//# sourceMappingURL=llm-critic.d.ts.map

package/dist/engines/llm-critic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-critic.d.ts","sourceRoot":"","sources":["../../src/engines/llm-critic.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,OAAO,EAA8C,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/D,OAAO,KAAK,EAAE,MAAM,EAAmC,MAAM,YAAY,CAAC;AAkC1E,qBAAa,eAAgB,SAAQ,KAAK;CAAG;AAC7C,qBAAa,sBAAuB,SAAQ,KAAK;CAAG;AAOpD,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;EASd,CAAC;AAeH,iBAAe,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2BrD;AAED,+CAA+C;AAC/C,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAID;;yEAEyE;AACzE,iBAAS,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAiB5D;AAID,UAAU,YAAY;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;CAClC;AAED,iBAAS,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAiFjD;AAiED,iBAAS,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAYvD;AAED,iBAAS,qBAAqB,CAC5B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,EAAE,EAClC,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;CAAE,GACpF,OAAO,EAAE,CAmDX;AAID,iBAAS,gBAAgB,CAAC,KAAK,EAAE;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAgBT;AAkLD,eAAO,MAAM,eAAe,EAAE,MAA8B,CAAC;AAG7D,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CASpB,CAAC"}