driftdetect-detectors 0.1.0

package/dist/security/rate-limiting.js

@@ -0,0 +1,535 @@
+/**
+ * Rate Limiting Detector - Rate limiting and throttling pattern detection
+ *
+ * Detects rate limiting patterns including:
+ * - Rate limiter middleware
+ * - Throttling implementations
+ * - Request quotas
+ * - Sliding window patterns
+ * - Token bucket algorithms
+ *
+ * @requirements 16.7 - Rate limiting patterns
+ */
+import { RegexDetector } from '../base/regex-detector.js';
+// ============================================================================
+// Constants
+// ============================================================================
+export const RATE_LIMITER_PATTERNS = [
+    // TypeScript/JavaScript patterns
+    /rateLimit\s*\(/gi,
+    /rateLimiter/gi,
+    /RateLimiter/gi,
+    /rate-limit/gi,
+    /express-rate-limit/gi,
+    /koa-ratelimit/gi,
+    /fastify-rate-limit/gi,
+    /@nestjs\/throttler/gi,
+    /rate_limit/gi,
+    /RateLimit/gi,
+    /slowDown\s*\(/gi,
+    /express-slow-down/gi,
+    // Python patterns - FastAPI, Flask, Django
+    /slowapi/gi,
+    /Limiter\s*\(/gi,
+    /@limiter\.limit\s*\(/gi,
+    /RateLimitMiddleware/gi,
+    /flask_limiter/gi,
+    /django_ratelimit/gi,
+    /@ratelimit\s*\(/gi,
+];
+export const THROTTLE_PATTERNS = [
+    /throttle\s*\(/gi,
+    /Throttle\s*\(/gi,
+    /throttler/gi,
+    /Throttler/gi,
+    /ThrottlerModule/gi,
+    /ThrottlerGuard/gi,
+    /@Throttle\s*\(/gi,
+    /useThrottle/gi,
+    /withThrottle/gi,
+    /throttleTime/gi,
+    /debounceTime/gi,
+];
+export const REQUEST_QUOTA_PATTERNS = [
+    /quota/gi,
+    /requestQuota/gi,
+    /apiQuota/gi,
+    /usageLimit/gi,
+    /dailyLimit/gi,
+    /monthlyLimit/gi,
+    /requestsPerDay/gi,
+    /requestsPerHour/gi,
+    /maxRequests/gi,
+    /requestCount/gi,
+];
+export const SLIDING_WINDOW_PATTERNS = [
+    /slidingWindow/gi,
+    /sliding-window/gi,
+    /sliding_window/gi,
+    /windowMs/gi,
+    /windowSize/gi,
+    /timeWindow/gi,
+    /rollingWindow/gi,
+];
+export const TOKEN_BUCKET_PATTERNS = [
+    /tokenBucket/gi,
+    /token-bucket/gi,
+    /token_bucket/gi,
+    /TokenBucket/gi,
+    /bucketSize/gi,
+    /tokensPerInterval/gi,
+    /refillRate/gi,
+    /limiter\.consume/gi,
+    /rate-limiter-flexible/gi,
+    /RateLimiterMemory/gi,
+    /RateLimiterRedis/gi,
+];
+export const LEAKY_BUCKET_PATTERNS = [
+    /leakyBucket/gi,
+    /leaky-bucket/gi,
+    /leaky_bucket/gi,
+    /LeakyBucket/gi,
+    /drainRate/gi,
+    /bucketCapacity/gi,
+];
+export const FIXED_WINDOW_PATTERNS = [
+    /fixedWindow/gi,
+    /fixed-window/gi,
+    /fixed_window/gi,
+    /FixedWindow/gi,
+    /windowStart/gi,
+    /resetTime/gi,
+];
+export const REDIS_RATE_LIMIT_PATTERNS = [
+    /redis.*rate/gi,
+    /rate.*redis/gi,
+    /ioredis.*limit/gi,
+    /RedisStore/gi,
+    /redis-rate-limiter/gi,
+    /RateLimiterRedis/gi,
+    /redisClient.*incr/gi,
+    /redis\.incr/gi,
+    /MULTI.*INCR.*EXPIRE.*EXEC/gi,
+];
+// Violation patterns
+export const WEAK_RATE_LIMIT_PATTERNS = [
+    /max\s*:\s*(?:1000|10000|100000)/gi,
+    /limit\s*:\s*(?:1000|10000|100000)/gi,
+    /windowMs\s*:\s*(?:1000|60000)\s*[,}]/gi, // 1 second or 1 minute windows
+    /points\s*:\s*(?:1000|10000)/gi,
+];
+export const HARDCODED_LIMIT_PATTERNS = [
+    /max\s*:\s*\d+\s*[,}]/gi,
+    /limit\s*:\s*\d+\s*[,}]/gi,
+    /points\s*:\s*\d+\s*[,}]/gi,
+    /windowMs\s*:\s*\d+\s*[,}]/gi,
+];
+export const API_ENDPOINT_PATTERNS = [
+    // TypeScript/JavaScript patterns
+    /app\.(?:get|post|put|patch|delete)\s*\(/gi,
+    /router\.(?:get|post|put|patch|delete)\s*\(/gi,
+    /@(?:Get|Post|Put|Patch|Delete)\s*\(/gi,
+    /\.route\s*\(/gi,
+    /fastify\.(?:get|post|put|patch|delete)\s*\(/gi,
+    // Python patterns - FastAPI, Flask, Django
+    /@app\.(?:get|post|put|patch|delete)\s*\(/gi,
+    /@router\.(?:get|post|put|patch|delete)\s*\(/gi,
+    /@api_view\s*\(\s*\[/gi,
+    /path\s*\(\s*['"`]/gi,
+    /url\s*\(\s*r?['"`]/gi,
+    /def\s+\w+\s*\(\s*request/gi,
+];
+// ============================================================================
+// Analysis Functions
+// ============================================================================
+export function shouldExcludeFile(filePath) {
+    const excludePatterns = [
+        /\.test\.[jt]sx?$/,
+        /\.spec\.[jt]sx?$/,
+        /__tests__\//,
+        /\.d\.ts$/,
+        /node_modules\//,
+        /\.min\.[jt]s$/,
+    ];
+    return excludePatterns.some((p) => p.test(filePath));
+}
+export function detectRateLimiters(content, filePath) {
+    const results = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const pattern of RATE_LIMITER_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(line)) !== null) {
+                let library = 'unknown';
+                if (/express-rate-limit/i.test(line))
+                    library = 'express-rate-limit';
+                else if (/koa-ratelimit/i.test(line))
+                    library = 'koa-ratelimit';
+                else if (/fastify-rate-limit/i.test(line))
+                    library = 'fastify-rate-limit';
+                else if (/slowDown|express-slow-down/i.test(line))
+                    library = 'express-slow-down';
+                results.push({
+                    type: 'rate-limiter',
+                    file: filePath,
+                    line: i + 1,
+                    column: match.index + 1,
+                    matchedText: match[0],
+                    library,
+                    context: line.trim(),
+                });
+            }
+        }
+    }
+    return results;
+}
+export function detectThrottling(content, filePath) {
+    const results = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const pattern of THROTTLE_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(line)) !== null) {
+                let library = 'unknown';
+                if (/ThrottlerModule|ThrottlerGuard|@Throttle/i.test(line))
+                    library = '@nestjs/throttler';
+                else if (/throttleTime|debounceTime/i.test(line))
+                    library = 'rxjs';
+                results.push({
+                    type: 'throttle',
+                    file: filePath,
+                    line: i + 1,
+                    column: match.index + 1,
+                    matchedText: match[0],
+                    library,
+                    context: line.trim(),
+                });
+            }
+        }
+    }
+    return results;
+}
+export function detectRequestQuotas(content, filePath) {
+    const results = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const pattern of REQUEST_QUOTA_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(line)) !== null) {
+                results.push({
+                    type: 'request-quota',
+                    file: filePath,
+                    line: i + 1,
+                    column: match.index + 1,
+                    matchedText: match[0],
+                    context: line.trim(),
+                });
+            }
+        }
+    }
+    return results;
+}
+export function detectSlidingWindow(content, filePath) {
+    const results = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const pattern of SLIDING_WINDOW_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(line)) !== null) {
+                results.push({
+                    type: 'sliding-window',
+                    file: filePath,
+                    line: i + 1,
+                    column: match.index + 1,
+                    matchedText: match[0],
+                    algorithm: 'sliding-window',
+                    context: line.trim(),
+                });
+            }
+        }
+    }
+    return results;
+}
+export function detectTokenBucket(content, filePath) {
+    const results = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const pattern of TOKEN_BUCKET_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(line)) !== null) {
+                let library = 'unknown';
+                if (/rate-limiter-flexible|RateLimiter(?:Memory|Redis)/i.test(line)) {
+                    library = 'rate-limiter-flexible';
+                }
+                results.push({
+                    type: 'token-bucket',
+                    file: filePath,
+                    line: i + 1,
+                    column: match.index + 1,
+                    matchedText: match[0],
+                    algorithm: 'token-bucket',
+                    library,
+                    context: line.trim(),
+                });
+            }
+        }
+    }
+    return results;
+}
+export function detectLeakyBucket(content, filePath) {
+    const results = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const pattern of LEAKY_BUCKET_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(line)) !== null) {
+                results.push({
+                    type: 'leaky-bucket',
+                    file: filePath,
+                    line: i + 1,
+                    column: match.index + 1,
+                    matchedText: match[0],
+                    algorithm: 'leaky-bucket',
+                    context: line.trim(),
+                });
+            }
+        }
+    }
+    return results;
+}
+export function detectFixedWindow(content, filePath) {
+    const results = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const pattern of FIXED_WINDOW_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(line)) !== null) {
+                results.push({
+                    type: 'fixed-window',
+                    file: filePath,
+                    line: i + 1,
+                    column: match.index + 1,
+                    matchedText: match[0],
+                    algorithm: 'fixed-window',
+                    context: line.trim(),
+                });
+            }
+        }
+    }
+    return results;
+}
+export function detectRedisRateLimit(content, filePath) {
+    const results = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const pattern of REDIS_RATE_LIMIT_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(line)) !== null) {
+                results.push({
+                    type: 'redis-rate-limit',
+                    file: filePath,
+                    line: i + 1,
+                    column: match.index + 1,
+                    matchedText: match[0],
+                    library: 'redis',
+                    context: line.trim(),
+                });
+            }
+        }
+    }
+    return results;
+}
+export function detectWeakRateLimits(content, filePath) {
+    const results = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const pattern of WEAK_RATE_LIMIT_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(line)) !== null) {
+                results.push({
+                    type: 'weak-rate-limit',
+                    file: filePath,
+                    line: i + 1,
+                    column: match.index + 1,
+                    matchedText: match[0],
+                    issue: 'Rate limit may be too permissive',
+                    suggestedFix: 'Consider stricter limits based on your use case',
+                    severity: 'medium',
+                });
+            }
+        }
+    }
+    return results;
+}
+export function detectHardcodedLimits(content, filePath) {
+    const results = [];
+    const lines = content.split('\n');
+    // Only flag if there's rate limiting but limits are hardcoded
+    const hasRateLimiting = RATE_LIMITER_PATTERNS.some((p) => new RegExp(p.source, p.flags).test(content));
+    if (!hasRateLimiting)
+        return results;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Skip if using environment variables
+        if (/process\.env|import\.meta\.env/.test(line))
+            continue;
+        for (const pattern of HARDCODED_LIMIT_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(line)) !== null) {
+                results.push({
+                    type: 'hardcoded-limits',
+                    file: filePath,
+                    line: i + 1,
+                    column: match.index + 1,
+                    matchedText: match[0],
+                    issue: 'Rate limit values are hardcoded',
+                    suggestedFix: 'Use environment variables for rate limit configuration',
+                    severity: 'low',
+                });
+            }
+        }
+    }
+    return results;
+}
+export function detectMissingRateLimits(content, filePath) {
+    const results = [];
+    // Check if this is a route/controller file
+    const isRouteFile = /route|controller|handler|endpoint/i.test(filePath) ||
+        API_ENDPOINT_PATTERNS.some((p) => new RegExp(p.source, p.flags).test(content));
+    if (!isRouteFile)
+        return results;
+    // Check if rate limiting is present
+    const hasRateLimiting = RATE_LIMITER_PATTERNS.some((p) => new RegExp(p.source, p.flags).test(content)) ||
+        THROTTLE_PATTERNS.some((p) => new RegExp(p.source, p.flags).test(content));
+    if (!hasRateLimiting) {
+        // Find the first API endpoint to report the violation
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            for (const pattern of API_ENDPOINT_PATTERNS) {
+                const regex = new RegExp(pattern.source, pattern.flags);
+                const match = regex.exec(line);
+                if (match) {
+                    results.push({
+                        type: 'missing-rate-limit',
+                        file: filePath,
+                        line: i + 1,
+                        column: match.index + 1,
+                        matchedText: match[0],
+                        issue: 'API endpoint without rate limiting',
+                        suggestedFix: 'Add rate limiting middleware to protect against abuse',
+                        severity: 'high',
+                    });
+                    return results; // Only report once per file
+                }
+            }
+        }
+    }
+    return results;
+}
+export function analyzeRateLimiting(content, filePath) {
+    if (shouldExcludeFile(filePath)) {
+        return {
+            patterns: [],
+            violations: [],
+            hasRateLimiting: false,
+            usesRedis: false,
+            confidence: 1.0,
+        };
+    }
+    const patterns = [
+        ...detectRateLimiters(content, filePath),
+        ...detectThrottling(content, filePath),
+        ...detectRequestQuotas(content, filePath),
+        ...detectSlidingWindow(content, filePath),
+        ...detectTokenBucket(content, filePath),
+        ...detectLeakyBucket(content, filePath),
+        ...detectFixedWindow(content, filePath),
+        ...detectRedisRateLimit(content, filePath),
+    ];
+    const violations = [
+        ...detectWeakRateLimits(content, filePath),
+        ...detectHardcodedLimits(content, filePath),
+        ...detectMissingRateLimits(content, filePath),
+    ];
+    const hasRateLimiting = patterns.some((p) => p.type === 'rate-limiter' || p.type === 'throttle' || p.type === 'token-bucket');
+    const usesRedis = patterns.some((p) => p.type === 'redis-rate-limit');
+    // Determine algorithm
+    let algorithm;
+    const algorithmPattern = patterns.find((p) => p.type === 'sliding-window' || p.type === 'token-bucket' ||
+        p.type === 'leaky-bucket' || p.type === 'fixed-window');
+    if (algorithmPattern) {
+        algorithm = algorithmPattern.algorithm;
+    }
+    let confidence = 0.7;
+    if (hasRateLimiting)
+        confidence += 0.15;
+    if (usesRedis)
+        confidence += 0.1;
+    if (violations.length === 0)
+        confidence += 0.05;
+    confidence = Math.min(confidence, 0.95);
+    return {
+        patterns,
+        violations,
+        hasRateLimiting,
+        usesRedis,
+        algorithm,
+        confidence,
+    };
+}
+// ============================================================================
+// Detector Class
+// ============================================================================
+export class RateLimitingDetector extends RegexDetector {
+    id = 'security/rate-limiting';
+    name = 'Rate Limiting Detector';
+    description = 'Detects rate limiting patterns and identifies missing or weak rate limits';
+    category = 'security';
+    subcategory = 'rate-limiting';
+    supportedLanguages = ['typescript', 'javascript', 'python'];
+    async detect(context) {
+        if (!this.supportsLanguage(context.language)) {
+            return this.createEmptyResult();
+        }
+        const analysis = analyzeRateLimiting(context.content, context.file);
+        if (analysis.patterns.length === 0 && analysis.violations.length === 0) {
+            return this.createEmptyResult();
+        }
+        return this.createResult([], [], analysis.confidence, {
+            custom: {
+                patterns: analysis.patterns,
+                violations: analysis.violations,
+                hasRateLimiting: analysis.hasRateLimiting,
+                usesRedis: analysis.usesRedis,
+                algorithm: analysis.algorithm,
+            },
+        });
+    }
+    generateQuickFix(_violation) {
+        return null;
+    }
+}
+export function createRateLimitingDetector() {
+    return new RateLimitingDetector();
+}
+//# sourceMappingURL=rate-limiting.js.map

package/dist/security/rate-limiting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiting.js","sourceRoot":"","sources":["../../src/security/rate-limiting.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAuD1D,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iCAAiC;IACjC,kBAAkB;IAClB,eAAe;IACf,eAAe;IACf,cAAc;IACd,sBAAsB;IACtB,iBAAiB;IACjB,sBAAsB;IACtB,sBAAsB;IACtB,cAAc;IACd,aAAa;IACb,iBAAiB;IACjB,qBAAqB;IACrB,2CAA2C;IAC3C,WAAW;IACX,gBAAgB;IAChB,wBAAwB;IACxB,uBAAuB;IACvB,iBAAiB;IACjB,oBAAoB;IACpB,mBAAmB;CACX,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,iBAAiB;IACjB,iBAAiB;IACjB,aAAa;IACb,aAAa;IACb,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,SAAS;IACT,gBAAgB;IAChB,YAAY;IACZ,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,kBAAkB;IAClB,mBAAmB;IACnB,eAAe;IACf,gBAAgB;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,YAAY;IACZ,cAAc;IACd,cAAc;IACd,iBAAiB;CACT,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,cAAc;IACd,qBAAqB;IACrB,cAAc;IACd,oBAAoB;IACpB,yBAAyB;IACzB,qBAAqB;IACrB,oBAAoB;CACZ,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,kBAAkB;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,aAAa;CACL,CAAC;AAEX,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,cAAc;IACd,sBAAsB;IACtB,oBAAoB;IACpB,qBAAqB;IACrB,eAAe;IACf,6BAA6B;CACrB,CAAC;AAEX,qBAAqB;AACrB,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,mCAAmC;IACnC,qCAAqC;IACrC,wCAAwC,EAAE,+BAA+B;IACzE,+BAA+B;CACvB,CAAC;AAEX,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,wBAAwB;IACxB,0BAA0B;IAC1B,2BAA2B;IAC3B,6BAA6B;CACrB,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iCAAiC;IACjC,2CAA2C;IAC3C,8CAA8C;IAC9C,uCAAuC;IACvC,gBAAgB;IAChB,+CAA+C;IAC/C,2CAA2C;IAC3C,4CAA4C;IAC5C,+CAA+C;IAC/C,uBAAuB;IACvB,qBAAqB;IACrB,sBAAsB;IACtB,4BAA4B;CACpB,CAAC;AAEX,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,eAAe,GAAG;QACtB,kBAAkB;QAClB,kBAAkB;QAClB,aAAa;QACb,UAAU;QACV,gBAAgB;QAChB,eAAe;KAChB,CAAC;IACF,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,QAAgB;IAEhB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,IAAI,OAAO,GAAG,SAAS,CAAC;gBACxB,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,GAAG,oBAAoB,CAAC;qBAChE,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,GAAG,eAAe,CAAC;qBAC3D,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,GAAG,oBAAoB,CAAC;qBACrE,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,GAAG,mBAAmB,CAAC;gBAEjF,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;oBACvB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;oBACrB,OAAO;oBACP,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,QAAgB;IAEhB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,IAAI,OAAO,GAAG,SAAS,CAAC;gBACxB,IAAI,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,GAAG,mBAAmB,CAAC;qBACrF,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,GAAG,MAAM,CAAC;gBAEnE,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;oBACvB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;oBACrB,OAAO;oBACP,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,QAAgB;IAEhB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;oBACvB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;oBACrB,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,QAAgB;IAEhB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,gBAAgB;oBACtB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;oBACvB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;oBACrB,SAAS,EAAE,gBAAgB;oBAC3B,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,QAAgB;IAEhB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,IAAI,OAAO,GAAG,SAAS,CAAC;gBACxB,IAAI,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpE,OAAO,GAAG,uBAAuB,CAAC;gBACpC,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;oBACvB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;oBACrB,SAAS,EAAE,cAAc;oBACzB,OAAO;oBACP,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,QAAgB;IAEhB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;oBACvB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;oBACrB,SAAS,EAAE,cAAc;oBACzB,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,QAAgB;IAEhB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;oBACvB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;oBACrB,SAAS,EAAE,cAAc;oBACzB,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,QAAgB;IAEhB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,kBAAkB;oBACxB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;oBACvB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;oBACrB,OAAO,EAAE,OAAO;oBAChB,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,QAAgB;IAEhB,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,wBAAwB,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,iBAAiB;oBACvB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;oBACvB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;oBACrB,KAAK,EAAE,kCAAkC;oBACzC,YAAY,EAAE,iDAAiD;oBAC/D,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,QAAgB;IAEhB,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,8DAA8D;IAC9D,MAAM,eAAe,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAC5C,CAAC;IAEF,IAAI,CAAC,eAAe;QAAE,OAAO,OAAO,CAAC;IAErC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,sCAAsC;QACtC,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAE1D,KAAK,MAAM,OAAO,IAAI,wBAAwB,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,kBAAkB;oBACxB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;oBACvB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;oBACrB,KAAK,EAAE,iCAAiC;oBACxC,YAAY,EAAE,wDAAwD;oBACtE,QAAQ,EAAE,KAAK;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,QAAgB;IAEhB,MAAM,OAAO,GAA6B,EAAE,CAAC;IAE7C,2CAA2C;IAC3C,MAAM,WAAW,GACf,oCAAoC,CAAC,IAAI,CAAC,QAAQ,CAAC;QACnD,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAEjF,IAAI,CAAC,WAAW;QAAE,OAAO,OAAO,CAAC;IAEjC,oCAAoC;IACpC,MAAM,eAAe,GACnB,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9E,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE7E,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,sDAAsD;QACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACvB,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBACxD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,oBAAoB;wBAC1B,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;wBACvB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;wBACrB,KAAK,EAAE,oCAAoC;wBAC3C,YAAY,EAAE,uDAAuD;wBACrE,QAAQ,EAAE,MAAM;qBACjB,CAAC,CAAC;oBACH,OAAO,OAAO,CAAC,CAAC,4BAA4B;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,QAAgB;IAEhB,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,EAAE;YACd,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,GAAG;SAChB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAA2B;QACvC,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACxC,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACtC,GAAG,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACzC,GAAG,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACzC,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACvC,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACvC,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACvC,GAAG,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC;KAC3C,CAAC;IAEF,MAAM,UAAU,GAA6B;QAC3C,GAAG,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC1C,GAAG,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC3C,GAAG,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC;KAC9C,CAAC;IAEF,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,CACvF,CAAC;IACF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IAEtE,sBAAsB;IACtB,IAAI,SAA6B,CAAC;IAClC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;QACxD,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,CAC9D,CAAC;IACF,IAAI,gBAAgB,EAAE,CAAC;QACrB,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC;IACzC,CAAC;IAED,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,IAAI,eAAe;QAAE,UAAU,IAAI,IAAI,CAAC;IACxC,IAAI,SAAS;QAAE,UAAU,IAAI,GAAG,CAAC;IACjC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,UAAU,IAAI,IAAI,CAAC;IAChD,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAExC,OAAO;QACL,QAAQ;QACR,UAAU;QACV,eAAe;QACf,SAAS;QACT,SAAS;QACT,UAAU;KACX,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IAC5C,EAAE,GAAG,wBAAwB,CAAC;IAC9B,IAAI,GAAG,wBAAwB,CAAC;IAChC,WAAW,GAClB,2EAA2E,CAAC;IACrE,QAAQ,GAAoB,UAAU,CAAC;IACvC,WAAW,GAAG,eAAe,CAAC;IAC9B,kBAAkB,GAAe,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAEjF,KAAK,CAAC,MAAM,CAAC,OAAyB;QACpC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAEpE,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClC,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,UAAU,EAAE;YACpD,MAAM,EAAE;gBACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,eAAe,EAAE,QAAQ,CAAC,eAAe;gBACzC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B;SACF,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,UAAqB;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,IAAI,oBAAoB,EAAE,CAAC;AACpC,CAAC"}

package/dist/security/secret-management.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Secret Management Detector - Secret and credential handling pattern detection
+ *
+ * Detects secret management patterns including:
+ * - Hardcoded secrets and credentials
+ * - Environment variable usage
+ * - Secret manager integrations
+ * - API key patterns
+ * - Credential rotation patterns
+ *
+ * @requirements 16.6 - Secret management patterns
+ */
+import type { Violation, QuickFix, PatternCategory, Language } from 'driftdetect-core';
+import { RegexDetector } from '../base/regex-detector.js';
+import type { DetectionContext, DetectionResult } from '../base/base-detector.js';
+export type SecretPatternType = 'env-variable' | 'secret-manager' | 'vault-integration' | 'key-rotation' | 'credential-store' | 'config-encryption';
+export type SecretViolationType = 'hardcoded-secret' | 'hardcoded-api-key' | 'hardcoded-password' | 'hardcoded-token' | 'exposed-credential' | 'insecure-storage';
+export interface SecretPatternInfo {
+    type: SecretPatternType;
+    file: string;
+    line: number;
+    column: number;
+    matchedText: string;
+    provider?: string | undefined;
+    context?: string | undefined;
+}
+export interface SecretViolationInfo {
+    type: SecretViolationType;
+    file: string;
+    line: number;
+    column: number;
+    matchedText: string;
+    issue: string;
+    suggestedFix?: string | undefined;
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    secretType?: string | undefined;
+}
+export interface SecretManagementAnalysis {
+    patterns: SecretPatternInfo[];
+    violations: SecretViolationInfo[];
+    usesEnvVariables: boolean;
+    usesSecretManager: boolean;
+    usesVault: boolean;
+    confidence: number;
+}
+export declare const ENV_VARIABLE_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
+export declare const SECRET_MANAGER_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
+export declare const VAULT_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
+export declare const KEY_ROTATION_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
+export declare const CREDENTIAL_STORE_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
+export declare const CONFIG_ENCRYPTION_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
+export declare const HARDCODED_SECRET_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
+export declare const HARDCODED_API_KEY_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
+export declare const HARDCODED_PASSWORD_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp];
+export declare const HARDCODED_TOKEN_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp];
+export declare const EXPOSED_CREDENTIAL_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp];
+export declare const INSECURE_STORAGE_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp];
+export declare function shouldExcludeFile(filePath: string): boolean;
+export declare function detectEnvVariables(content: string, filePath: string): SecretPatternInfo[];
+export declare function detectSecretManager(content: string, filePath: string): SecretPatternInfo[];
+export declare function detectVaultIntegration(content: string, filePath: string): SecretPatternInfo[];
+export declare function detectKeyRotation(content: string, filePath: string): SecretPatternInfo[];
+export declare function detectCredentialStore(content: string, filePath: string): SecretPatternInfo[];
+export declare function detectConfigEncryption(content: string, filePath: string): SecretPatternInfo[];
+export declare function detectHardcodedSecrets(content: string, filePath: string): SecretViolationInfo[];
+export declare function detectHardcodedApiKeys(content: string, filePath: string): SecretViolationInfo[];
+export declare function detectHardcodedPasswords(content: string, filePath: string): SecretViolationInfo[];
+export declare function detectHardcodedTokens(content: string, filePath: string): SecretViolationInfo[];
+export declare function detectExposedCredentials(content: string, filePath: string): SecretViolationInfo[];
+export declare function detectInsecureStorage(content: string, filePath: string): SecretViolationInfo[];
+export declare function analyzeSecretManagement(content: string, filePath: string): SecretManagementAnalysis;
+export declare class SecretManagementDetector extends RegexDetector {
+    readonly id = "security/secret-management";
+    readonly name = "Secret Management Detector";
+    readonly description = "Detects secret management patterns and identifies hardcoded credentials";
+    readonly category: PatternCategory;
+    readonly subcategory = "secret-management";
+    readonly supportedLanguages: Language[];
+    detect(context: DetectionContext): Promise<DetectionResult>;
+    generateQuickFix(_violation: Violation): QuickFix | null;
+}
+export declare function createSecretManagementDetector(): SecretManagementDetector;
+//# sourceMappingURL=secret-management.d.ts.map

package/dist/security/secret-management.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-management.d.ts","sourceRoot":"","sources":["../../src/security/secret-management.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAMlF,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,MAAM,MAAM,mBAAmB,GAC3B,kBAAkB,GAClB,mBAAmB,GACnB,oBAAoB,GACpB,iBAAiB,GACjB,oBAAoB,GACpB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,eAAO,MAAM,qBAAqB,2EASxB,CAAC;AAEX,eAAO,MAAM,uBAAuB,2FAW1B,CAAC;AAEX,eAAO,MAAM,cAAc,mFAUjB,CAAC;AAEX,eAAO,MAAM,qBAAqB,2EASxB,CAAC;AAEX,eAAO,MAAM,yBAAyB,2EAS5B,CAAC;AAEX,eAAO,MAAM,0BAA0B,2EAS7B,CAAC;AAGX,eAAO,MAAM,yBAAyB,2EAS5B,CAAC;AAEX,eAAO,MAAM,0BAA0B,mFAU7B,CAAC;AAEX,eAAO,MAAM,2BAA2B,mDAM9B,CAAC;AAEX,eAAO,MAAM,wBAAwB,2CAK3B,CAAC;AAEX,eAAO,MAAM,2BAA2B,2CAK9B,CAAC;AAEX,eAAO,MAAM,yBAAyB,2CAK5B,CAAC;AAMX,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAa3D;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,iBAAiB,EAAE,CAuBrB;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,iBAAiB,EAAE,CA6BrB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,iBAAiB,EAAE,CAwBrB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,iBAAiB,EAAE,CAuBrB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,iBAAiB,EAAE,CAuBrB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,iBAAiB,EAAE,CAuBrB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,mBAAmB,EAAE,CA6BvB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,mBAAmB,EAAE,CAqCvB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,mBAAmB,EAAE,CA8BvB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,mBAAmB,EAAE,CAgCvB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,mBAAmB,EAAE,CAyBvB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,mBAAmB,EAAE,CAyBvB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,wBAAwB,CAgD1B;AAMD,qBAAa,wBAAyB,SAAQ,aAAa;IACzD,QAAQ,CAAC,EAAE,gCAAgC;IAC3C,QAAQ,CAAC,IAAI,gCAAgC;IAC7C,QAAQ,CAAC,WAAW,6EACwD;IAC5E,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAc;IAChD,QAAQ,CAAC,WAAW,uBAAuB;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAA0C;IAE3E,MAAM,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAsBjE,gBAAgB,CAAC,UAAU,EAAE,SAAS,GAAG,QAAQ,GAAG,IAAI;CAGzD;AAED,wBAAgB,8BAA8B,IAAI,wBAAwB,CAEzE"}