guardrail-security 1.0.2 → 2.0.0

package/dist/secrets/index.d.ts

@@ -7,4 +7,8 @@ export * from './patterns';
 export { secretsGuardian, SecretsGuardian } from './guardian';
 export { preCommitHook } from './pre-commit';
 export { vaultIntegration } from './vault-integration';
+export { loadCustomPatterns, ConfigValidationError } from './config-loader';
+export { Allowlist } from './allowlist';
+export { adjustRiskByContext, getContextDescription } from './contextual-risk';
+export { scanGitHistory } from './git-scanner';
 //# sourceMappingURL=index.d.ts.map

package/dist/secrets/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}

package/dist/secrets/index.js

@@ -19,7 +19,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.vaultIntegration = exports.preCommitHook = exports.SecretsGuardian = exports.secretsGuardian = void 0;
+exports.scanGitHistory = exports.getContextDescription = exports.adjustRiskByContext = exports.Allowlist = exports.ConfigValidationError = exports.loadCustomPatterns = exports.vaultIntegration = exports.preCommitHook = exports.SecretsGuardian = exports.secretsGuardian = void 0;
 __exportStar(require("./patterns"), exports);
 var guardian_1 = require("./guardian");
 Object.defineProperty(exports, "secretsGuardian", { enumerable: true, get: function () { return guardian_1.secretsGuardian; } });
@@ -28,3 +28,13 @@ var pre_commit_1 = require("./pre-commit");
 Object.defineProperty(exports, "preCommitHook", { enumerable: true, get: function () { return pre_commit_1.preCommitHook; } });
 var vault_integration_1 = require("./vault-integration");
 Object.defineProperty(exports, "vaultIntegration", { enumerable: true, get: function () { return vault_integration_1.vaultIntegration; } });
+var config_loader_1 = require("./config-loader");
+Object.defineProperty(exports, "loadCustomPatterns", { enumerable: true, get: function () { return config_loader_1.loadCustomPatterns; } });
+Object.defineProperty(exports, "ConfigValidationError", { enumerable: true, get: function () { return config_loader_1.ConfigValidationError; } });
+var allowlist_1 = require("./allowlist");
+Object.defineProperty(exports, "Allowlist", { enumerable: true, get: function () { return allowlist_1.Allowlist; } });
+var contextual_risk_1 = require("./contextual-risk");
+Object.defineProperty(exports, "adjustRiskByContext", { enumerable: true, get: function () { return contextual_risk_1.adjustRiskByContext; } });
+Object.defineProperty(exports, "getContextDescription", { enumerable: true, get: function () { return contextual_risk_1.getContextDescription; } });
+var git_scanner_1 = require("./git-scanner");
+Object.defineProperty(exports, "scanGitHistory", { enumerable: true, get: function () { return git_scanner_1.scanGitHistory; } });

package/dist/secrets/patterns.d.ts

@@ -7,36 +7,65 @@ export declare enum SecretType {
     DATABASE_URL = "database_url",
     JWT_SECRET = "jwt_secret",
     AWS_ACCESS_KEY = "aws_access_key",
-    OTHER = "other",
     AWS_SECRET_KEY = "aws_secret_key",
     GITHUB_TOKEN = "github_token",
     GOOGLE_API_KEY = "google_api_key",
     STRIPE_KEY = "stripe_key",
-    JWT_TOKEN = "jwt_token",
     SLACK_TOKEN = "slack_token",
-    API_KEY_GENERIC = "api_key_generic"
+    JWT_TOKEN = "jwt_token",
+    API_KEY_GENERIC = "api_key_generic",
+    PASSWORD_GENERIC = "password_generic",
+    OTHER = "other"
 }
-/**
- * Secret detection pattern
- */
+export type RiskLevel = 'high' | 'medium' | 'low';
 export interface SecretPattern {
     type: SecretType;
     name: string;
+    /**
+     * IMPORTANT:
+     * - Store patterns WITHOUT the `g` flag (we clone to global during scanning).
+     * - Keep needed flags like `i` on this regex; the scanner preserves them.
+     */
     pattern: RegExp;
+    /**
+     * Which capture group contains the actual secret value.
+     * If omitted, scanner will use group 1 if present, else group 0.
+     */
+    valueGroup?: number;
+    /**
+     * Entropy threshold (Shannon). Used to reduce false positives.
+     */
     minEntropy?: number;
+    /**
+     * Risk drives recommendations & severity.
+     */
+    risk: RiskLevel;
     description: string;
     examples: string[];
+    /**
+     * Optional custom redaction for display (safe logging/UI).
+     * If omitted, the scanner uses a default masking strategy.
+     */
+    redact?: (value: string, match: RegExpMatchArray) => string;
 }
 /**
  * Comprehensive secret detection patterns
+ * Notes:
+ * - Examples are clearly fake.
+ * - Patterns are designed to be high-signal; add more vendors as needed.
+ */
+export declare const SECRET_PATTERNS: ReadonlyArray<SecretPattern>;
+/**
+ * Test/example value patterns (used for down-weighting confidence, optional exclusion).
  */
-export declare const SECRET_PATTERNS: SecretPattern[];
+export declare const TEST_PATTERNS: ReadonlyArray<RegExp>;
 /**
- * Test/example value patterns (to exclude false positives)
+ * Context patterns that are strongly associated with false positives (schemas/validators/etc).
+ * Scanner uses these to skip matches in certain code lines.
  */
-export declare const TEST_PATTERNS: RegExp[];
+export declare const CONTEXT_EXCLUSION_PATTERNS: ReadonlyArray<RegExp>;
 /**
- * Common false positive values
+ * Common false positive literal values
  */
 export declare const FALSE_POSITIVE_VALUES: Set<string>;
 //# sourceMappingURL=patterns.d.ts.map

package/dist/secrets/patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/secrets/patterns.ts"],"names":[],"mappings":"AACA,oBAAY,UAAU;IACpB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,KAAK,UAAU;IACf,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;IAC7B,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,eAAe,oBAAoB;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAyG1C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,UAkBzB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAiBhC,CAAC"}
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/secrets/patterns.ts"],"names":[],"mappings":"AAIA,oBAAY,UAAU;IACpB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,UAAU,eAAe;IAEzB,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;IAEjC,YAAY,iBAAiB;IAC7B,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,WAAW,gBAAgB;IAE3B,SAAS,cAAc;IACvB,eAAe,oBAAoB;IACnC,gBAAgB,qBAAqB;IAErC,KAAK,UAAU;CAChB;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IAEb;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,IAAI,EAAE,SAAS,CAAC;IAEhB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IAEnB;;;OAGG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,KAAK,MAAM,CAAC;CAC7D;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,aAAa,CAwIxD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,aAAa,CAAC,MAAM,CAY/C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAE,aAAa,CAAC,MAAM,CA2B5D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAiBhC,CAAC"}

package/dist/secrets/patterns.js

@@ -1,7 +1,9 @@
 "use strict";
+/* patterns.ts
+ * Enterprise-grade secret patterns & false-positive controls
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FALSE_POSITIVE_VALUES = exports.TEST_PATTERNS = exports.SECRET_PATTERNS = exports.SecretType = void 0;
-// Define SecretType locally since it's not exported from database
+exports.FALSE_POSITIVE_VALUES = exports.CONTEXT_EXCLUSION_PATTERNS = exports.TEST_PATTERNS = exports.SECRET_PATTERNS = exports.SecretType = void 0;
 var SecretType;
 (function (SecretType) {
     SecretType["API_KEY"] = "api_key";
@@ -12,116 +14,148 @@ var SecretType;
     SecretType["DATABASE_URL"] = "database_url";
     SecretType["JWT_SECRET"] = "jwt_secret";
     SecretType["AWS_ACCESS_KEY"] = "aws_access_key";
-    SecretType["OTHER"] = "other";
     SecretType["AWS_SECRET_KEY"] = "aws_secret_key";
     SecretType["GITHUB_TOKEN"] = "github_token";
     SecretType["GOOGLE_API_KEY"] = "google_api_key";
     SecretType["STRIPE_KEY"] = "stripe_key";
-    SecretType["JWT_TOKEN"] = "jwt_token";
     SecretType["SLACK_TOKEN"] = "slack_token";
+    SecretType["JWT_TOKEN"] = "jwt_token";
     SecretType["API_KEY_GENERIC"] = "api_key_generic";
+    SecretType["PASSWORD_GENERIC"] = "password_generic";
+    SecretType["OTHER"] = "other";
 })(SecretType || (exports.SecretType = SecretType = {}));
 /**
  * Comprehensive secret detection patterns
+ * Notes:
+ * - Examples are clearly fake.
+ * - Patterns are designed to be high-signal; add more vendors as needed.
  */
 exports.SECRET_PATTERNS = [
-    // AWS Access Keys
+    // ---------- AWS ----------
     {
-        type: 'AWS_ACCESS_KEY',
+        type: SecretType.AWS_ACCESS_KEY,
         name: 'AWS Access Key ID',
-        pattern: /(AKIA[0-9A-Z]{16})/,
+        pattern: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/,
+        valueGroup: 0,
         minEntropy: 3.5,
-        description: 'AWS Access Key ID (starts with AKIA)',
-        examples: ['AKIAIOSFODNN7EXAMPLE'],
+        risk: 'high',
+        description: 'AWS Access Key ID (AKIA/ASIA + 16 chars)',
+        examples: ['AKIAIOSFODNN7EXAMPLE', 'ASIAIOSFODNN7EXAMPLE'],
     },
-    // AWS Secret Keys
     {
-        type: 'AWS_SECRET_KEY',
+        type: SecretType.AWS_SECRET_KEY,
         name: 'AWS Secret Access Key',
-        pattern: /aws[_\s]*secret[_\s]*access[_\s]*key[_\s]*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/i,
+        pattern: /\baws[_\s-]*secret[_\s-]*access[_\s-]*key\b\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/i,
+        valueGroup: 1,
         minEntropy: 4.5,
-        description: 'AWS Secret Access Key (40 characters)',
+        risk: 'high',
+        description: 'AWS Secret Access Key assigned in config (40 chars)',
         examples: ['aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'],
     },
-    // GitHub Personal Access Tokens
+    // ---------- GitHub ----------
     {
-        type: 'GITHUB_TOKEN',
-        name: 'GitHub Personal Access Token',
-        pattern: /(ghp_[a-zA-Z0-9]{36}|gho_[a-zA-Z0-9]{36}|ghu_[a-zA-Z0-9]{36}|ghs_[a-zA-Z0-9]{36}|ghr_[a-zA-Z0-9]{36})/,
-        description: 'GitHub Personal Access Token (ghp_, gho_, ghu_, ghs_, ghr_)',
+        type: SecretType.GITHUB_TOKEN,
+        name: 'GitHub Token',
+        pattern: /\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b/,
+        valueGroup: 0,
+        risk: 'high',
+        description: 'GitHub personal/app tokens (ghp_/gho_/...)',
         examples: ['ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'],
     },
-    // Google API Keys
+    // ---------- Google ----------
     {
-        type: 'GOOGLE_API_KEY',
+        type: SecretType.GOOGLE_API_KEY,
         name: 'Google API Key',
-        pattern: /(AIza[0-9A-Za-z\-_]{35})/,
-        description: 'Google API Key (starts with AIza)',
+        pattern: /\bAIza[0-9A-Za-z\-_]{35}\b/,
+        valueGroup: 0,
+        risk: 'medium',
+        description: 'Google API Key (AIzA...)',
         examples: ['AIzaSyDaGmWKa4JsXZ-HjGw7ISLn_3namBGewQe'],
     },
-    // Stripe API Keys
+    // ---------- Stripe ----------
     {
-        type: 'STRIPE_KEY',
-        name: 'Stripe API Key',
-        pattern: /(sk_live_[0-9a-zA-Z]{24,}|pk_live_[0-9a-zA-Z]{24,}|rk_live_[0-9a-zA-Z]{24,})/,
-        description: 'Stripe Live API Key',
+        type: SecretType.STRIPE_KEY,
+        name: 'Stripe Live Secret/Public/Restricted Key',
+        pattern: /\b(sk_live|pk_live|rk_live)_[0-9A-Za-z]{24,}\b/,
+        valueGroup: 0,
+        risk: 'high',
+        description: 'Stripe live keys (sk_live / pk_live / rk_live)',
         examples: ['sk_live_1234567890abcdefghijklmn'],
     },
-    // JWT Tokens
+    // ---------- Slack ----------
     {
-        type: 'JWT_TOKEN',
+        type: SecretType.SLACK_TOKEN,
+        name: 'Slack Token',
+        pattern: /\b(xox[pboa]-\d{10,13}-\d{10,13}-\d{10,13}-[a-z0-9]{32})\b/,
+        valueGroup: 1,
+        risk: 'high',
+        description: 'Slack bot/user/app tokens (xoxb/xoxp/xoxa/xoxo)',
+        examples: ['xoxb-0000000000-0000000000-0000000000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'],
+    },
+    // ---------- JWT ----------
+    {
+        type: SecretType.JWT_TOKEN,
         name: 'JWT Token',
-        pattern: /(eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+)/,
+        pattern: /\b(eyJ[0-9A-Za-z_-]*\.[0-9A-Za-z_-]*\.[0-9A-Za-z_-]+)\b/,
+        valueGroup: 1,
         minEntropy: 4.0,
-        description: 'JSON Web Token (JWT)',
-        examples: ['eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U'],
+        risk: 'medium',
+        description: 'JSON Web Token (header.payload.signature)',
+        examples: [
+            'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U',
+        ],
     },
-    // Private Keys
+    // ---------- Private keys / certs ----------
     {
-        type: 'PRIVATE_KEY',
-        name: 'Private Key',
-        pattern: /(-----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----[\s\S]*?-----END (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----)/,
-        description: 'Private Key (RSA, EC, OpenSSH, DSA)',
+        type: SecretType.PRIVATE_KEY,
+        name: 'Private Key Block',
+        pattern: /(-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----)/,
+        valueGroup: 1,
+        risk: 'high',
+        description: 'PEM private key blocks (RSA/EC/OpenSSH/DSA)',
         examples: ['-----BEGIN PRIVATE KEY-----\\nMIIEvQIBADANBgk...\\n-----END PRIVATE KEY-----'],
     },
-    // Database URLs with credentials
+    // ---------- Database URLs (credentials embedded) ----------
     {
-        type: 'DATABASE_URL',
-        name: 'Database URL with Password',
-        pattern: /(postgres|mysql|mongodb|redis):\/\/[a-zA-Z0-9_-]+:([a-zA-Z0-9!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]+)@[a-zA-Z0-9.-]+:[0-9]+/,
-        minEntropy: 3.0,
-        description: 'Database connection string with embedded password',
+        type: SecretType.DATABASE_URL,
+        name: 'Database URL with Embedded Credentials',
+        pattern: /\b(postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis):\/\/([^:\s\/]+):([^@\s\/]+)@([A-Za-z0-9.-]+)(?::(\d{2,5}))?(\/[^\s'"]*)?/i,
+        valueGroup: 0,
+        risk: 'high',
+        description: 'Connection string contains username:password@host',
         examples: ['postgresql://user:password123@localhost:5432/dbname'],
+        redact: (_value, match) => {
+            const scheme = match[1] ?? 'db';
+            const host = match[4] ?? 'host';
+            const port = match[5] ? `:${match[5]}` : '';
+            return `${scheme}://***:***@${host}${port}/***`;
+        },
     },
-    // Slack Tokens
+    // ---------- Generic high-entropy API keys ----------
     {
-        type: 'SLACK_TOKEN',
-        name: 'Slack Token',
-        pattern: /(xox[pboa]-[0-9]{10,13}-[0-9]{10,13}-[0-9]{10,13}-[a-z0-9]{32})/,
-        description: 'Slack Bot/User/App Token',
-        examples: ['xoxb-0000000000-0000000000-0000000000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'],
-    },
-    // Generic API Keys (high entropy)
-    {
-        type: 'API_KEY_GENERIC',
-        name: 'Generic API Key',
-        pattern: /(?:api[_\s-]?key|apikey|access[_\s-]?token|auth[_\s-]?token|secret[_\s-]?key)[_\s]*[=:]\s*['"]?([a-zA-Z0-9_\-]{32,})['"]?/i,
+        type: SecretType.API_KEY_GENERIC,
+        name: 'Generic API Key / Token Assignment',
+        pattern: /\b(?:api[_\s-]?key|apikey|access[_\s-]?token|auth[_\s-]?token|secret[_\s-]?key)\b[_\s]*[=:]\s*['"]?([A-Za-z0-9_\-]{32,})['"]?/i,
+        valueGroup: 1,
         minEntropy: 4.0,
-        description: 'Generic API key or access token (high entropy)',
+        risk: 'medium',
+        description: 'Generic API key/token (assignment + long value)',
         examples: ['api_key = abcdef1234567890abcdef1234567890'],
     },
-    // Generic Passwords
+    // ---------- Generic password assignment ----------
     {
-        type: 'PASSWORD_GENERIC',
-        name: 'Generic Password',
-        pattern: /(?:password|passwd|pwd)[_\s]*[=:]\s*['"]([^'"]{8,})['"]|(?:password|passwd|pwd)[_\s]*[=:]\s*([^\s]{8,})/i,
-        minEntropy: 3.0,
-        description: 'Generic password in configuration',
+        type: SecretType.PASSWORD_GENERIC,
+        name: 'Generic Password Assignment',
+        pattern: /\b(?:password|passwd|pwd)\b\s*[=:]\s*['"]([^'"]{8,128})['"]/i,
+        valueGroup: 1,
+        minEntropy: 3.5,
+        risk: 'medium',
+        description: 'Password-like assignment (quoted, 8–128 chars)',
         examples: ['password = "MySecretP@ssw0rd"'],
     },
 ];
 /**
- * Test/example value patterns (to exclude false positives)
+ * Test/example value patterns (used for down-weighting confidence, optional exclusion).
  */
 exports.TEST_PATTERNS = [
     /test/i,
@@ -131,19 +165,43 @@ exports.TEST_PATTERNS = [
     /fake/i,
     /dummy/i,
     /placeholder/i,
-    /\*{3,}/,
-    /x{3,}/i,
-    /0{5,}/,
-    /1{5,}/,
-    /abc{3,}/i,
-    /qwerty/i,
-    /password123/i,
     /changeme/i,
     /your[_-]?key/i,
     /your[_-]?secret/i,
+    /password123/i,
+];
+/**
+ * Context patterns that are strongly associated with false positives (schemas/validators/etc).
+ * Scanner uses these to skip matches in certain code lines.
+ */
+exports.CONTEXT_EXCLUSION_PATTERNS = [
+    /\.min\s*\(/i,
+    /\.max\s*\(/i,
+    /\.length\b/i,
+    /\bschema\b/i,
+    /\bvalidation\b/i,
+    /\bvalidator\b/i,
+    /\.string\s*\(/i,
+    /\.required\b/i,
+    /\.optional\b/i,
+    /\bzod\./i,
+    /\byup\./i,
+    /\bjoi\./i,
+    /__tests__/i,
+    /__mocks__/i,
+    /\bmock\b/i,
+    /\bstub\b/i,
+    /\bfixture\b/i,
+    /\bprocess\.env\b/i,
+    /\benv\./i,
+    /\bconfig\./i,
+    /\bsettings\./i,
+    /\boptions\./i,
+    /\bparams\./i,
+    /\bprops\./i,
 ];
 /**
- * Common false positive values
+ * Common false positive literal values
  */
 exports.FALSE_POSITIVE_VALUES = new Set([
     'example',

package/dist/secrets/pre-commit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pre-commit.d.ts","sourceRoot":"","sources":["../../src/secrets/pre-commit.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB;;OAEG;IACH,kBAAkB,IAAI,MAAM;IAoB5B;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA+CpE;;OAEG;IACH,OAAO,CAAC,cAAc;IAqCtB;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAWnC;AAGD,eAAO,MAAM,aAAa,eAAsB,CAAC"}
+{"version":3,"file":"pre-commit.d.ts","sourceRoot":"","sources":["../../src/secrets/pre-commit.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB;;OAEG;IACH,kBAAkB,IAAI,MAAM;IAoB5B;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAgDpE;;OAEG;IACH,OAAO,CAAC,cAAc;IAqCtB;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAWnC;AAGD,eAAO,MAAM,aAAa,eAAsB,CAAC"}

package/dist/secrets/pre-commit.js

@@ -49,7 +49,7 @@ exit 0
             // Scan each staged file
             const allDetections = [];
             for (const file of stagedFiles) {
-                const detections = await guardian_1.secretsGuardian.scanContent(file.content, file.path, {
+                const detections = await guardian_1.secretsGuardian.scanContent(file.content, file.path, 'pre-commit', {
                     excludeTests: true,
                     minConfidence: 0.7,
                 });

package/dist/secrets/vault-integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-integration.d.ts","sourceRoot":"","sources":["../../src/secrets/vault-integration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI7C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,aAAa,CAAyC;IAE9D;;OAEG;IACH,OAAO,CAAC,WAAW;IAuBnB;;OAEG;IACG,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAY/F;;;OAGG;IACG,cAAc,CAClB,UAAU,EAAE,eAAe,EAAE,EAC7B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA2DlC;;OAEG;IACG,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKrF;;OAEG;IACG,WAAW,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAK9D;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKlF;;OAEG;IACH,kBAAkB,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM;IA4BtD;;OAEG;IACH,mBAAmB,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAyDzE;;OAEG;IACH,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM;IA0B/D;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKlF;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,eAAe,EAAE,EAC7B,WAAW,EAAE,WAAW,EACxB,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACvE,OAAO,CAAC,oBAAoB,EAAE,CAAC;CAoDnC;AAGD,eAAO,MAAM,gBAAgB,kBAAyB,CAAC"}
+{"version":3,"file":"vault-integration.d.ts","sourceRoot":"","sources":["../../src/secrets/vault-integration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI7C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,aAAa,CAAyC;IAE9D;;OAEG;IACH,OAAO,CAAC,WAAW;IAuBnB;;OAEG;IACG,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAY/F;;;OAGG;IACG,cAAc,CAClB,UAAU,EAAE,eAAe,EAAE,EAC7B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA2DlC;;OAEG;IACG,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKrF;;OAEG;IACG,WAAW,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAK9D;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKlF;;OAEG;IACH,kBAAkB,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM;IA6BtD;;OAEG;IACH,mBAAmB,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAyDzE;;OAEG;IACH,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM;IA0B/D;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKlF;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,eAAe,EAAE,EAC7B,WAAW,EAAE,WAAW,EACxB,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACvE,OAAO,CAAC,oBAAoB,EAAE,CAAC;CAoDnC;AAGD,eAAO,MAAM,gBAAgB,kBAAyB,CAAC"}

package/dist/secrets/vault-integration.js

@@ -147,6 +147,7 @@ class VaultIntegration {
             [patterns_1.SecretType.CERTIFICATE]: 'CERTIFICATE',
             [patterns_1.SecretType.JWT_SECRET]: 'JWT_SECRET',
             [patterns_1.SecretType.PASSWORD]: 'PASSWORD',
+            [patterns_1.SecretType.PASSWORD_GENERIC]: 'PASSWORD',
             [patterns_1.SecretType.OTHER]: 'SECRET'
         };
         const baseName = typeMap[detection.secretType] || 'SECRET';

package/dist/supply-chain/vulnerability-db.d.ts

@@ -1,16 +1,30 @@
 /**
  * Vulnerability Database Integration
  *
- * Integrates with multiple vulnerability databases:
- * - OSV (Open Source Vulnerabilities)
- * - GitHub Security Advisories
- * - NVD (National Vulnerability Database)
+ * Real-time OSV (Open Source Vulnerabilities) integration with:
+ * - Multi-ecosystem support (npm, PyPI, RubyGems, Go)
+ * - Persistent caching with 24h TTL
+ * - Batch request optimization
+ * - CVSS scoring and vectors
+ * - Remediation path analysis
+ * - Optional NVD enrichment for CVE details
+ * - Retry logic with exponential backoff
+ * - Configurable timeouts
  */
+export interface VulnerabilityDbOptions {
+    noCache?: boolean;
+    nvdEnrichment?: boolean;
+    timeout?: number;
+    retries?: number;
+    cacheDir?: string;
+}
+export type Ecosystem = 'npm' | 'PyPI' | 'RubyGems' | 'Go';
 export interface Vulnerability {
     id: string;
     source: 'osv' | 'github' | 'nvd' | 'npm';
     severity: 'low' | 'medium' | 'high' | 'critical';
     cvssScore?: number;
+    cvssVector?: string;
     title: string;
     description: string;
     affectedVersions: string[];
@@ -19,6 +33,7 @@ export interface Vulnerability {
     publishedAt: Date;
     updatedAt: Date;
     cwe?: string[];
+    aliases?: string[];
 }
 export interface VulnerabilityCheckResult {
     package: string;
@@ -27,6 +42,13 @@ export interface VulnerabilityCheckResult {
     isVulnerable: boolean;
     highestSeverity: 'none' | 'low' | 'medium' | 'high' | 'critical';
     recommendedVersion?: string;
+    isDirect: boolean;
+    remediationPath?: {
+        action: 'upgrade' | 'replace' | 'remove';
+        targetVersion?: string;
+        breakingChange: boolean;
+        description: string;
+    };
 }
 export interface VulnerabilityReport {
     projectPath: string;
@@ -40,37 +62,77 @@ export interface VulnerabilityReport {
         medium: number;
         low: number;
     };
+    ecosystem: Ecosystem;
+    directVulnerabilities: number;
+    transitiveVulnerabilities: number;
+    cacheHitRate?: number;
 }
 export declare class VulnerabilityDatabase {
     private osvApiUrl;
-    private npmAuditUrl;
+    private cacheDir;
+    private cachePath;
+    private memoryCache;
+    private cacheHits;
+    private cacheMisses;
+    private options;
+    constructor(cacheDirOrOptions?: string | VulnerabilityDbOptions);
+    /**
+     * Update options at runtime
+     */
+    setOptions(options: Partial<VulnerabilityDbOptions>): void;
+    /**
+     * Load cache from disk
+     */
+    private loadDiskCache;
+    /**
+     * Save cache to disk
+     */
+    private saveDiskCache;
     /**
      * Check a single package for vulnerabilities
      */
-    checkPackage(name: string, version: string): Promise<VulnerabilityCheckResult>;
+    checkPackage(name: string, version: string, ecosystem?: Ecosystem, isDirect?: boolean): Promise<VulnerabilityCheckResult>;
     /**
-     * Check multiple packages in bulk
+     * Check multiple packages in bulk with batching
      */
     checkPackages(packages: {
         name: string;
         version: string;
+        ecosystem?: Ecosystem;
+        isDirect?: boolean;
     }[]): Promise<VulnerabilityCheckResult[]>;
+    /**
+     * Query OSV with retry logic and exponential backoff
+     */
+    private queryOSVWithRetry;
     /**
      * Query OSV (Open Source Vulnerabilities) API
      */
     private queryOSV;
     /**
-     * Parse OSV API response
+     * Enrich vulnerabilities with NVD data (CVSS scores)
      */
-    private parseOSVResponse;
+    private enrichWithNVD;
     /**
-     * Query npm audit API
+     * Query NVD API for CVE details
      */
-    private queryNpmAudit;
+    private queryNVD;
     /**
-     * Parse npm audit response
+     * Map CVSS score to severity level
      */
-    private parseNpmAuditResponse;
+    private mapCVSSSeverity;
+    /**
+     * Delay helper for retry backoff
+     */
+    private delay;
+    /**
+     * Parse OSV API response
+     */
+    private parseOSVResponse;
+    /**
+     * Check if a version is affected by vulnerability ranges
+     */
+    private isVersionAffected;
     /**
      * Map OSV severity to standard levels
      */
@@ -84,9 +146,9 @@ export declare class VulnerabilityDatabase {
      */
     private extractPatchedVersions;
     /**
-     * Deduplicate vulnerabilities by ID
+     * Calculate remediation path for a vulnerability
      */
-    private deduplicateVulnerabilities;
+    private calculateRemediationPath;
     /**
      * Build result object
      */
@@ -97,17 +159,28 @@ export declare class VulnerabilityDatabase {
     generateReport(projectPath: string, packages: {
         name: string;
         version: string;
-    }[]): Promise<VulnerabilityReport>;
+        ecosystem?: Ecosystem;
+        isDirect?: boolean;
+    }[], ecosystem?: Ecosystem): Promise<VulnerabilityReport>;
     /**
      * Clear vulnerability cache
      */
     clearCache(): void;
+    /**
+     * Clear entire cache directory
+     */
+    static clearCacheDirectory(cacheDir?: string): {
+        success: boolean;
+        path: string;
+        error?: string;
+    };
     /**
      * Get cache statistics
      */
     getCacheStats(): {
         size: number;
         oldestEntry: Date | null;
+        hitRate: number;
     };
 }
 export declare const vulnerabilityDatabase: VulnerabilityDatabase;

package/dist/supply-chain/vulnerability-db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vulnerability-db.d.ts","sourceRoot":"","sources":["../../src/supply-chain/vulnerability-db.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,KAAK,GAAG,KAAK,CAAC;IACzC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH;AAKD,qBAAa,qBAAqB;IAChC,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,WAAW,CAAkE;IAIrF;;OAEG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAoCpF;;OAEG;IACG,aAAa,CAAC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,OAAO,CAAC,wBAAwB,EAAE,CAAC;IAevG;;OAEG;YACW,QAAQ;IA6BtB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAqBxB;;OAEG;YACW,aAAa;IAyB3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAmB7B;;OAEG;IACH,OAAO,CAAC,cAAc;IAYtB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA0B/B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAsB9B;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAWlC;;OAEG;IACH,OAAO,CAAC,WAAW;IAwBnB;;OAEG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA4BtH;;OAEG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;IACH,aAAa,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE;CAY5D;AAGD,eAAO,MAAM,qBAAqB,uBAA8B,CAAC"}
+{"version":3,"file":"vulnerability-db.d.ts","sourceRoot":"","sources":["../../src/supply-chain/vulnerability-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,KAAK,GAAG,KAAK,CAAC;IACzC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE;QAChB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;QACzC,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,OAAO,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,SAAS,EAAE,SAAS,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,yBAAyB,EAAE,MAAM,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAmBD,qBAAa,qBAAqB;IAChC,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,OAAO,CAAyB;gBAE5B,iBAAiB,CAAC,EAAE,MAAM,GAAG,sBAAsB;IAa/D;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI;IAO1D;;OAEG;IACH,OAAO,CAAC,aAAa;IAiBrB;;OAEG;IACH,OAAO,CAAC,aAAa;IAerB;;OAEG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,SAAiB,EAC5B,QAAQ,UAAO,GACd,OAAO,CAAC,wBAAwB,CAAC;IAoCpC;;OAEG;IACG,aAAa,CACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,GACvF,OAAO,CAAC,wBAAwB,EAAE,CAAC;IA+BtC;;OAEG;YACW,iBAAiB;IAuB/B;;OAEG;YACW,QAAQ;IAwCtB;;OAEG;YACW,aAAa;IA8B3B;;OAEG;YACW,QAAQ;IA4CtB;;OAEG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,OAAO,CAAC,KAAK;IAIb;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAgCxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAgCzB;;OAEG;IACH,OAAO,CAAC,cAAc;IAetB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA0B/B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAsB9B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA0ChC;;OAEG;IACH,OAAO,CAAC,WAAW;IAqCnB;;OAEG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,EACxF,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,mBAAmB,CAAC;IA2C/B;;OAEG;IACH,UAAU,IAAI,IAAI;IAalB;;OAEG;IACH,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAiBjG;;OAEG;IACH,aAAa,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CAiB7E;AAGD,eAAO,MAAM,qBAAqB,uBAA8B,CAAC"}