hivemind-pipeline 0.1.0

package/dist/src/core/sandbox.js

@@ -0,0 +1,277 @@
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { join, resolve, normalize } from 'node:path';
+import { homedir } from 'node:os';
+const HOME = homedir();
+/** Sensitive paths that are always blocked in moderate/strict modes */
+const DEFAULT_BLOCKED_PATHS = [
+    join(HOME, '.ssh'),
+    join(HOME, '.aws'),
+    join(HOME, '.config', 'gcloud'),
+    join(HOME, '.npmrc'),
+    join(HOME, '.netrc'),
+    '/etc/passwd',
+    '/etc/shadow',
+    '/etc/hosts',
+];
+/** Package registry hosts allowed in moderate mode */
+const DEFAULT_ALLOWED_HOSTS = [
+    'registry.npmjs.org',
+    'pypi.org',
+    'proxy.golang.org',
+    'crates.io',
+    'github.com',
+];
+/** Dangerous command patterns that are always blocked */
+const DEFAULT_BLOCKED_COMMAND_PATTERNS = [
+    { pattern: /rm\s+(-\w*r\w*\s+-\w*f\w*|-\w*f\w*\s+-\w*r\w*|-\w*rf\w*)\s+\/\s*$/, description: 'rm -rf /' },
+    { pattern: /rm\s+(-\w*r\w*\s+-\w*f\w*|-\w*f\w*\s+-\w*r\w*|-\w*rf\w*)\s+~\s*$/, description: 'rm -rf ~' },
+    { pattern: /rm\s+(-\w*r\w*\s+-\w*f\w*|-\w*f\w*\s+-\w*r\w*|-\w*rf\w*)\s+\$HOME\s*$/, description: 'rm -rf $HOME' },
+    { pattern: /chmod\s+(-R\s+)?777/, description: 'chmod 777' },
+    { pattern: /\bsudo\b/, description: 'sudo' },
+    { pattern: /\bsu\s+-/, description: 'su -' },
+    { pattern: /curl\s.*\|\s*(ba)?sh/, description: 'curl | bash' },
+    { pattern: /wget\s.*\|\s*(ba)?sh/, description: 'wget | sh' },
+    { pattern: /eval\s+"\$\(curl/, description: 'eval "$(curl' },
+    { pattern: /\bcrontab\b/, description: 'crontab' },
+    { pattern: /\bat\b\s+/, description: 'at command' },
+];
+export class Sandbox {
+    projectDir;
+    config;
+    violations = [];
+    auditFilePath;
+    constructor(projectDir, config = { mode: 'moderate' }) {
+        this.projectDir = projectDir;
+        this.config = config;
+        const swarmDir = join(projectDir, '.swarm');
+        if (!existsSync(swarmDir)) {
+            mkdirSync(swarmDir, { recursive: true });
+        }
+        this.auditFilePath = join(swarmDir, 'security-audit.jsonl');
+    }
+    /** Get the current sandbox mode */
+    getMode() {
+        return this.config.mode;
+    }
+    /** Get the current config */
+    getConfig() {
+        return { ...this.config };
+    }
+    /** Validate a filesystem operation */
+    checkFilesystem(path, operation) {
+        if (this.config.mode === 'off')
+            return true;
+        const resolved = resolve(path);
+        const normalizedProject = resolve(this.projectDir);
+        // Check for path traversal escaping project dir
+        const normalized = normalize(resolved);
+        if (normalized !== resolved) {
+            // Path contains suspicious components
+            const violation = {
+                type: 'filesystem',
+                detail: `Suspicious path normalization: ${path} -> ${normalized} (operation: ${operation})`,
+                severity: 'blocked',
+                timestamp: Date.now(),
+            };
+            this.logViolation(violation);
+            return false;
+        }
+        // Always allow access within project directory
+        if (resolved.startsWith(normalizedProject + '/') || resolved === normalizedProject) {
+            return true;
+        }
+        // Check explicitly allowed paths
+        const allowedPaths = this.config.allowedPaths || [];
+        for (const allowed of allowedPaths) {
+            const resolvedAllowed = resolve(allowed);
+            if (resolved.startsWith(resolvedAllowed + '/') || resolved === resolvedAllowed) {
+                return true;
+            }
+        }
+        // Check blocked paths (default + custom)
+        const blockedPaths = [...DEFAULT_BLOCKED_PATHS, ...(this.config.blockedPaths || [])];
+        for (const blocked of blockedPaths) {
+            const resolvedBlocked = resolve(blocked);
+            if (resolved.startsWith(resolvedBlocked) || resolved === resolvedBlocked) {
+                const violation = {
+                    type: 'filesystem',
+                    detail: `Access to sensitive path blocked: ${path} (operation: ${operation})`,
+                    severity: 'blocked',
+                    timestamp: Date.now(),
+                };
+                this.logViolation(violation);
+                return false;
+            }
+        }
+        // In strict mode, block everything outside project dir
+        if (this.config.mode === 'strict') {
+            const violation = {
+                type: 'filesystem',
+                detail: `Strict mode: access outside project dir blocked: ${path} (operation: ${operation})`,
+                severity: 'blocked',
+                timestamp: Date.now(),
+            };
+            this.logViolation(violation);
+            return false;
+        }
+        // Moderate mode: warn about access outside project dir (except sensitive paths already blocked)
+        const violation = {
+            type: 'filesystem',
+            detail: `Access outside project dir: ${path} (operation: ${operation})`,
+            severity: 'warning',
+            timestamp: Date.now(),
+        };
+        this.logViolation(violation);
+        return true;
+    }
+    /** Validate a network request */
+    checkNetwork(host) {
+        if (this.config.mode === 'off')
+            return true;
+        const normalizedHost = host.toLowerCase().replace(/:\d+$/, '');
+        // Check explicitly allowed hosts (from config)
+        const allowedHosts = this.config.allowedHosts || [];
+        if (allowedHosts.some(h => normalizedHost === h.toLowerCase() || normalizedHost.endsWith('.' + h.toLowerCase()))) {
+            return true;
+        }
+        // In moderate mode, allow default package registries
+        if (this.config.mode === 'moderate') {
+            if (DEFAULT_ALLOWED_HOSTS.some(h => normalizedHost === h || normalizedHost.endsWith('.' + h))) {
+                return true;
+            }
+            // Warn about other hosts but allow
+            const violation = {
+                type: 'network',
+                detail: `Network access to non-registry host: ${host}`,
+                severity: 'warning',
+                timestamp: Date.now(),
+            };
+            this.logViolation(violation);
+            return true;
+        }
+        // In strict mode, block all except explicitly allowed and default registries
+        if (DEFAULT_ALLOWED_HOSTS.some(h => normalizedHost === h || normalizedHost.endsWith('.' + h))) {
+            return true;
+        }
+        const violation = {
+            type: 'network',
+            detail: `Strict mode: network access blocked to ${host}`,
+            severity: 'blocked',
+            timestamp: Date.now(),
+        };
+        this.logViolation(violation);
+        return false;
+    }
+    /** Validate a command execution */
+    checkCommand(cmd) {
+        if (this.config.mode === 'off')
+            return true;
+        const trimmedCmd = cmd.trim();
+        // Check default blocked patterns
+        for (const { pattern, description } of DEFAULT_BLOCKED_COMMAND_PATTERNS) {
+            if (pattern.test(trimmedCmd)) {
+                const violation = {
+                    type: 'command',
+                    detail: `Dangerous command blocked (${description}): ${trimmedCmd.slice(0, 100)}`,
+                    severity: 'blocked',
+                    timestamp: Date.now(),
+                };
+                this.logViolation(violation);
+                return false;
+            }
+        }
+        // Check custom blocked commands
+        const blockedCommands = this.config.blockedCommands || [];
+        for (const blocked of blockedCommands) {
+            if (trimmedCmd.includes(blocked)) {
+                const violation = {
+                    type: 'command',
+                    detail: `Custom blocked command matched (${blocked}): ${trimmedCmd.slice(0, 100)}`,
+                    severity: 'blocked',
+                    timestamp: Date.now(),
+                };
+                this.logViolation(violation);
+                return false;
+            }
+        }
+        // In strict mode, warn about kill/pkill
+        if (this.config.mode === 'strict') {
+            if (/\b(kill|pkill|killall)\b/.test(trimmedCmd)) {
+                const violation = {
+                    type: 'process',
+                    detail: `Process control command in strict mode: ${trimmedCmd.slice(0, 100)}`,
+                    severity: 'warning',
+                    timestamp: Date.now(),
+                };
+                this.logViolation(violation);
+                // Allow but warn — agent manager needs kill for managed agents
+            }
+        }
+        return true;
+    }
+    /** Get violation log */
+    getViolations() {
+        return [...this.violations];
+    }
+    /** Get violations from the persisted security audit log */
+    getPersistedViolations(limit = 100) {
+        if (!existsSync(this.auditFilePath))
+            return [];
+        try {
+            const raw = readFileSync(this.auditFilePath, 'utf-8');
+            const entries = raw
+                .split('\n')
+                .filter(Boolean)
+                .map(line => {
+                try {
+                    return JSON.parse(line);
+                }
+                catch {
+                    return null;
+                }
+            })
+                .filter(Boolean);
+            // Return newest first
+            entries.sort((a, b) => b.timestamp - a.timestamp);
+            return entries.slice(0, limit);
+        }
+        catch {
+            return [];
+        }
+    }
+    /** Build --disallowed-tools and --append-system-prompt for sandbox mode */
+    getAgentConstraints() {
+        if (this.config.mode === 'off') {
+            return {};
+        }
+        const disallowedTools = [];
+        const promptParts = [];
+        if (this.config.mode === 'strict') {
+            promptParts.push('SANDBOX ENFORCEMENT (STRICT MODE):', '- Do NOT access files outside the project directory.', '- Do NOT make network requests to hosts other than: ' + DEFAULT_ALLOWED_HOSTS.join(', ') + (this.config.allowedHosts?.length ? ', ' + this.config.allowedHosts.join(', ') : '') + '.', '- Do NOT run destructive commands (rm -rf, chmod 777, sudo, etc.).', '- Do NOT access sensitive files (~/.ssh, ~/.aws, ~/.npmrc, /etc/passwd, etc.).', '- Do NOT pipe curl/wget output to shell execution.', '- Do NOT use crontab or at for scheduling.');
+        }
+        else {
+            // moderate
+            promptParts.push('SANDBOX ENFORCEMENT (MODERATE MODE):', '- Avoid accessing files outside the project directory unless necessary.', '- Do NOT access sensitive files (~/.ssh, ~/.aws, ~/.npmrc, /etc/passwd, etc.).', '- Do NOT run destructive commands (rm -rf /, chmod 777, sudo, etc.).', '- Do NOT pipe curl/wget output to shell execution.');
+        }
+        // Add blocked paths info
+        const blockedPaths = [...DEFAULT_BLOCKED_PATHS, ...(this.config.blockedPaths || [])];
+        if (blockedPaths.length > 0) {
+            promptParts.push('- Blocked paths: ' + blockedPaths.slice(0, 5).join(', ') + (blockedPaths.length > 5 ? '...' : ''));
+        }
+        return {
+            disallowedTools: disallowedTools.length > 0 ? disallowedTools : undefined,
+            appendSystemPrompt: promptParts.length > 0 ? promptParts.join('\n') : undefined,
+        };
+    }
+    /** Log violation to .swarm/security-audit.jsonl */
+    logViolation(v) {
+        this.violations.push(v);
+        try {
+            appendFileSync(this.auditFilePath, JSON.stringify(v) + '\n');
+        }
+        catch {
+            // Non-critical — don't crash if audit logging fails
+        }
+    }
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/src/core/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../src/core/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAuBlC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;AAEvB,uEAAuE;AACvE,MAAM,qBAAqB,GAAG;IAC5B,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;IACpB,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;IACpB,aAAa;IACb,aAAa;IACb,YAAY;CACb,CAAC;AAEF,sDAAsD;AACtD,MAAM,qBAAqB,GAAG;IAC5B,oBAAoB;IACpB,UAAU;IACV,kBAAkB;IAClB,WAAW;IACX,YAAY;CACb,CAAC;AAEF,yDAAyD;AACzD,MAAM,gCAAgC,GAAoD;IACxF,EAAE,OAAO,EAAE,mEAAmE,EAAE,WAAW,EAAE,UAAU,EAAE;IACzG,EAAE,OAAO,EAAE,kEAAkE,EAAE,WAAW,EAAE,UAAU,EAAE;IACxG,EAAE,OAAO,EAAE,uEAAuE,EAAE,WAAW,EAAE,cAAc,EAAE;IACjH,EAAE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,WAAW,EAAE;IAC5D,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE;IAC5C,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE;IAC5C,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,aAAa,EAAE;IAC/D,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,WAAW,EAAE;IAC7D,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE;IAC5D,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE;IAClD,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE;CACpD,CAAC;AAEF,MAAM,OAAO,OAAO;IAKR;IACA;IALF,UAAU,GAAuB,EAAE,CAAC;IACpC,aAAa,CAAS;IAE9B,YACU,UAAkB,EAClB,SAAwB,EAAE,IAAI,EAAE,UAAU,EAAE;QAD5C,eAAU,GAAV,UAAU,CAAQ;QAClB,WAAM,GAAN,MAAM,CAAsC;QAEpD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC9D,CAAC;IAED,mCAAmC;IACnC,OAAO;QACL,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED,6BAA6B;IAC7B,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,sCAAsC;IACtC,eAAe,CAAC,IAAY,EAAE,SAAsC;QAClE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAE5C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEnD,gDAAgD;QAChD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5B,sCAAsC;YACtC,MAAM,SAAS,GAAqB;gBAClC,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,kCAAkC,IAAI,OAAO,UAAU,gBAAgB,SAAS,GAAG;gBAC3F,QAAQ,EAAE,SAAS;gBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,+CAA+C;QAC/C,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iCAAiC;QACjC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QACpD,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,UAAU,CAAC,eAAe,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;gBAC/E,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,MAAM,YAAY,GAAG,CAAC,GAAG,qBAAqB,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QACrF,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;gBACzE,MAAM,SAAS,GAAqB;oBAClC,IAAI,EAAE,YAAY;oBAClB,MAAM,EAAE,qCAAqC,IAAI,gBAAgB,SAAS,GAAG;oBAC7E,QAAQ,EAAE,SAAS;oBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACtB,CAAC;gBACF,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBAC7B,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,SAAS,GAAqB;gBAClC,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,oDAAoD,IAAI,gBAAgB,SAAS,GAAG;gBAC5F,QAAQ,EAAE,SAAS;gBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,gGAAgG;QAChG,MAAM,SAAS,GAAqB;YAClC,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,+BAA+B,IAAI,gBAAgB,SAAS,GAAG;YACvE,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iCAAiC;IACjC,YAAY,CAAC,IAAY;QACvB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAE5C,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAE/D,+CAA+C;QAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QACpD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,KAAK,CAAC,CAAC,WAAW,EAAE,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;YACjH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qDAAqD;QACrD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACpC,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,KAAK,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9F,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mCAAmC;YACnC,MAAM,SAAS,GAAqB;gBAClC,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,wCAAwC,IAAI,EAAE;gBACtD,QAAQ,EAAE,SAAS;gBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,6EAA6E;QAC7E,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,KAAK,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAqB;YAClC,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,0CAA0C,IAAI,EAAE;YACxD,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mCAAmC;IACnC,YAAY,CAAC,GAAW;QACtB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAE5C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAE9B,iCAAiC;QACjC,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,gCAAgC,EAAE,CAAC;YACxE,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,MAAM,SAAS,GAAqB;oBAClC,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,8BAA8B,WAAW,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBACjF,QAAQ,EAAE,SAAS;oBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACtB,CAAC;gBACF,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBAC7B,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;QAC1D,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAqB;oBAClC,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,mCAAmC,OAAO,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBAClF,QAAQ,EAAE,SAAS;oBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACtB,CAAC;gBACF,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBAC7B,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChD,MAAM,SAAS,GAAqB;oBAClC,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,2CAA2C,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBAC7E,QAAQ,EAAE,SAAS;oBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACtB,CAAC;gBACF,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBAC7B,+DAA+D;YACjE,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wBAAwB;IACxB,aAAa;QACX,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED,2DAA2D;IAC3D,sBAAsB,CAAC,KAAK,GAAG,GAAG;QAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,GAAG;iBAChB,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,IAAI,CAAC,EAAE;gBACV,IAAI,CAAC;oBAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,IAAI,CAAC;gBAAC,CAAC;YAC7E,CAAC,CAAC;iBACD,MAAM,CAAC,OAAO,CAAuB,CAAC;YACzC,sBAAsB;YACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;YAClD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,mBAAmB;QACjB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,MAAM,WAAW,GAAa,EAAE,CAAC;QAEjC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,WAAW,CAAC,IAAI,CACd,oCAAoC,EACpC,sDAAsD,EACtD,sDAAsD,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,EACtL,oEAAoE,EACpE,gFAAgF,EAChF,oDAAoD,EACpD,4CAA4C,CAC7C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,WAAW;YACX,WAAW,CAAC,IAAI,CACd,sCAAsC,EACtC,yEAAyE,EACzE,gFAAgF,EAChF,sEAAsE,EACtE,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,MAAM,YAAY,GAAG,CAAC,GAAG,qBAAqB,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QACrF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,WAAW,CAAC,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvH,CAAC;QAED,OAAO;YACL,eAAe,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACzE,kBAAkB,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAChF,CAAC;IACJ,CAAC;IAED,mDAAmD;IAC3C,YAAY,CAAC,CAAmB;QACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC;YACH,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;IACH,CAAC;CACF"}

package/dist/src/core/secret-detector.d.ts

@@ -0,0 +1,25 @@
+export interface SecretFinding {
+    type: string;
+    file: string;
+    line: number;
+    match: string;
+    severity: 'critical' | 'high' | 'medium';
+    message: string;
+}
+export declare class SecretDetector {
+    private cwd;
+    constructor(cwd: string);
+    /** Recursively collect files to scan */
+    private collectFiles;
+    /** Scan files for hardcoded secrets */
+    scan(opts?: {
+        files?: string[];
+        includeTests?: boolean;
+    }): SecretFinding[];
+    /** Check if .gitignore covers common secret files */
+    checkGitignore(): {
+        covered: string[];
+        missing: string[];
+    };
+}
+//# sourceMappingURL=secret-detector.d.ts.map

package/dist/src/core/secret-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-detector.d.ts","sourceRoot":"","sources":["../../../src/core/secret-detector.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,OAAO,EAAE,MAAM,CAAC;CACjB;AA+JD,qBAAa,cAAc;IACb,OAAO,CAAC,GAAG;gBAAH,GAAG,EAAE,MAAM;IAE/B,wCAAwC;IACxC,OAAO,CAAC,YAAY;IAgCpB,uCAAuC;IACvC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,aAAa,EAAE;IA4D1E,qDAAqD;IACrD,cAAc,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE;CAkE3D"}

package/dist/src/core/secret-detector.js

@@ -0,0 +1,307 @@
+import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { join, relative, extname, basename } from 'node:path';
+const SECRET_PATTERNS = [
+    {
+        type: 'aws-key',
+        regex: /AKIA[0-9A-Z]{16}/,
+        severity: 'critical',
+        message: 'AWS Access Key ID detected',
+    },
+    {
+        type: 'aws-secret',
+        regex: /aws_secret[_a-zA-Z]*\s*[:=]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/i,
+        severity: 'critical',
+        message: 'AWS Secret Access Key detected',
+    },
+    {
+        type: 'github-token',
+        regex: /ghp_[A-Za-z0-9]{36}/,
+        severity: 'critical',
+        message: 'GitHub Personal Access Token detected',
+    },
+    {
+        type: 'github-token',
+        regex: /github_pat_[A-Za-z0-9_]{82}/,
+        severity: 'critical',
+        message: 'GitHub Fine-grained Personal Access Token detected',
+    },
+    {
+        type: 'github-token',
+        regex: /gh[ors]_[A-Za-z0-9]{36}/,
+        severity: 'critical',
+        message: 'GitHub OAuth/App token detected',
+    },
+    {
+        type: 'stripe-key',
+        regex: /sk_live_[A-Za-z0-9]{24,}/,
+        severity: 'critical',
+        message: 'Stripe Secret Key detected',
+    },
+    {
+        type: 'stripe-key',
+        regex: /pk_live_[A-Za-z0-9]{24,}/,
+        severity: 'high',
+        message: 'Stripe Publishable Key (live) detected',
+    },
+    {
+        type: 'google-api-key',
+        regex: /AIza[A-Za-z0-9_-]{35}/,
+        severity: 'high',
+        message: 'Google API Key detected',
+    },
+    {
+        type: 'private-key',
+        regex: /-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----/,
+        severity: 'critical',
+        message: 'Private key detected',
+    },
+    {
+        type: 'jwt',
+        regex: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/,
+        severity: 'high',
+        message: 'JSON Web Token detected',
+    },
+    {
+        type: 'database-url',
+        regex: /(postgres|mysql|mongodb):\/\/[^:]+:[^@]+@/,
+        severity: 'critical',
+        message: 'Database connection string with credentials detected',
+    },
+    {
+        type: 'generic-api-key',
+        regex: /(api[_-]?key|apikey|secret[_-]?key|access[_-]?token)\s*[:=]\s*['"][A-Za-z0-9]{16,}['"]/i,
+        severity: 'high',
+        message: 'Hardcoded API key or secret detected',
+    },
+    {
+        type: 'slack-token',
+        regex: /xox[bpsa]-[A-Za-z0-9-]+/,
+        severity: 'high',
+        message: 'Slack token detected',
+    },
+    {
+        type: 'sendgrid',
+        regex: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/,
+        severity: 'high',
+        message: 'SendGrid API key detected',
+    },
+    {
+        type: 'twilio',
+        regex: /SK[a-f0-9]{32}/,
+        severity: 'high',
+        message: 'Twilio API key detected',
+    },
+    {
+        type: 'generic-secret',
+        regex: /(password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/i,
+        severity: 'medium',
+        message: 'Hardcoded password detected',
+    },
+];
+/** Files that should be covered by .gitignore */
+const GITIGNORE_EXPECTED = [
+    '.env',
+    '.env.*',
+    '*.pem',
+    '*.key',
+    'credentials.json',
+    'service-account.json',
+];
+/** Directories to always skip */
+const SKIP_DIRS = new Set(['node_modules', 'dist', '.git', '.swarm', 'coverage', '.next', '__pycache__']);
+/** File extensions to scan (text-based files) */
+const SCANNABLE_EXTENSIONS = new Set([
+    '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
+    '.py', '.go', '.rs', '.swift', '.java', '.kt',
+    '.json', '.yaml', '.yml', '.toml', '.xml',
+    '.env', '.cfg', '.conf', '.ini', '.properties',
+    '.sh', '.bash', '.zsh', '.fish',
+    '.sql', '.graphql', '.gql',
+    '.tf', '.tfvars',
+    '.dockerfile', '',
+    '.md', '.txt',
+]);
+function isTestFile(filePath) {
+    const name = basename(filePath);
+    if (/\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs)$/.test(name))
+        return true;
+    if (filePath.includes('__tests__/') || filePath.includes('__mocks__/'))
+        return true;
+    return false;
+}
+function isExampleFile(filePath) {
+    const name = basename(filePath);
+    return /\.(example|sample)$/.test(name);
+}
+function isCommentWithPlaceholder(line) {
+    const lower = line.toLowerCase();
+    // Check if line has a comment marker and placeholder-like words
+    const hasComment = /\/\/|\/\*|#|<!--/.test(line);
+    const hasPlaceholder = /(example|placeholder|dummy|test|fake|mock|sample|xxx|todo|fixme)/.test(lower);
+    return hasComment && hasPlaceholder;
+}
+function redact(match) {
+    if (match.length <= 8)
+        return '****';
+    return match.slice(0, 4) + '...' + match.slice(-4);
+}
+export class SecretDetector {
+    cwd;
+    constructor(cwd) {
+        this.cwd = cwd;
+    }
+    /** Recursively collect files to scan */
+    collectFiles(dir, files) {
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (SKIP_DIRS.has(entry))
+                continue;
+            const fullPath = join(dir, entry);
+            let stat;
+            try {
+                stat = statSync(fullPath);
+            }
+            catch {
+                continue;
+            }
+            if (stat.isDirectory()) {
+                this.collectFiles(fullPath, files);
+            }
+            else if (stat.isFile()) {
+                const ext = extname(entry).toLowerCase();
+                const name = basename(entry).toLowerCase();
+                // Include files with scannable extensions, or dotfiles like .env
+                if (SCANNABLE_EXTENSIONS.has(ext) || name.startsWith('.env') || name === 'dockerfile') {
+                    files.push(fullPath);
+                }
+            }
+        }
+    }
+    /** Scan files for hardcoded secrets */
+    scan(opts) {
+        const includeTests = opts?.includeTests ?? false;
+        let files;
+        if (opts?.files && opts.files.length > 0) {
+            files = opts.files.map(f => (f.startsWith('/') ? f : join(this.cwd, f)));
+        }
+        else {
+            files = [];
+            this.collectFiles(this.cwd, files);
+        }
+        const findings = [];
+        for (const filePath of files) {
+            const relPath = relative(this.cwd, filePath);
+            // Skip test/example files unless opted in
+            if (!includeTests && isTestFile(relPath))
+                continue;
+            if (isExampleFile(relPath))
+                continue;
+            let content;
+            try {
+                content = readFileSync(filePath, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            // Skip binary-looking files
+            if (content.includes('\0'))
+                continue;
+            const lines = content.split('\n');
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                // Skip lines with placeholder-like comments
+                if (isCommentWithPlaceholder(line))
+                    continue;
+                for (const pattern of SECRET_PATTERNS) {
+                    // Skip generic password pattern for test files even if includeTests is true
+                    if (pattern.type === 'generic-secret' && isTestFile(relPath))
+                        continue;
+                    const match = line.match(pattern.regex);
+                    if (match) {
+                        findings.push({
+                            type: pattern.type,
+                            file: relPath,
+                            line: i + 1,
+                            match: redact(match[0]),
+                            severity: pattern.severity,
+                            message: pattern.message,
+                        });
+                    }
+                }
+            }
+        }
+        return findings;
+    }
+    /** Check if .gitignore covers common secret files */
+    checkGitignore() {
+        const gitignorePath = join(this.cwd, '.gitignore');
+        let gitignoreContent = '';
+        if (existsSync(gitignorePath)) {
+            try {
+                gitignoreContent = readFileSync(gitignorePath, 'utf-8');
+            }
+            catch {
+                // If we can't read it, treat as empty
+            }
+        }
+        const lines = gitignoreContent
+            .split('\n')
+            .map(l => l.trim())
+            .filter(l => l && !l.startsWith('#'));
+        const covered = [];
+        const missing = [];
+        for (const expected of GITIGNORE_EXPECTED) {
+            // Check if any gitignore line would cover this pattern
+            const isCovered = lines.some(line => {
+                // Exact match
+                if (line === expected)
+                    return true;
+                // Wildcard pattern match (simple check)
+                if (expected.includes('*')) {
+                    // e.g., .env.* should be covered by .env* or .env.* or .env.local etc.
+                    const prefix = expected.replace('*', '');
+                    return lines.some(l => l.startsWith(prefix) || l === expected);
+                }
+                // Check if a broader pattern covers it (e.g., *.pem covers all .pem)
+                if (expected.startsWith('*.')) {
+                    const ext = expected.slice(1); // e.g., ".pem"
+                    return line === expected || line === `*${ext}`;
+                }
+                return false;
+            });
+            if (isCovered) {
+                covered.push(expected);
+            }
+            else {
+                missing.push(expected);
+            }
+        }
+        // Special check: .npmrc with authToken
+        const npmrcPath = join(this.cwd, '.npmrc');
+        if (existsSync(npmrcPath)) {
+            try {
+                const npmrcContent = readFileSync(npmrcPath, 'utf-8');
+                if (npmrcContent.includes('authToken') || npmrcContent.includes('_auth')) {
+                    const npmrcCovered = lines.some(l => l === '.npmrc');
+                    if (npmrcCovered) {
+                        covered.push('.npmrc');
+                    }
+                    else {
+                        missing.push('.npmrc (contains authToken)');
+                    }
+                }
+            }
+            catch {
+                // ignore
+            }
+        }
+        return { covered, missing };
+    }
+}
+//# sourceMappingURL=secret-detector.js.map

package/dist/src/core/secret-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-detector.js","sourceRoot":"","sources":["../../../src/core/secret-detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAkB9D,MAAM,eAAe,GAAoB;IACvC;QACE,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,kBAAkB;QACzB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,4BAA4B;KACtC;IACD;QACE,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,6DAA6D;QACpE,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,gCAAgC;KAC1C;IACD;QACE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,uCAAuC;KACjD;IACD;QACE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,6BAA6B;QACpC,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,oDAAoD;KAC9D;IACD;QACE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,iCAAiC;KAC3C;IACD;QACE,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,4BAA4B;KACtC;IACD;QACE,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,wCAAwC;KAClD;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,yBAAyB;KACnC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,6CAA6C;QACpD,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,sBAAsB;KAChC;IACD;QACE,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,kEAAkE;QACzE,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,yBAAyB;KACnC;IACD;QACE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,2CAA2C;QAClD,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,sDAAsD;KAChE;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,yFAAyF;QAChG,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,sCAAsC;KAChD;IACD;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,sBAAsB;KAChC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,0CAA0C;QACjD,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,2BAA2B;KACrC;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,yBAAyB;KACnC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,mDAAmD;QAC1D,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,6BAA6B;KACvC;CACF,CAAC;AAEF,iDAAiD;AACjD,MAAM,kBAAkB,GAAG;IACzB,MAAM;IACN,QAAQ;IACR,OAAO;IACP,OAAO;IACP,kBAAkB;IAClB,sBAAsB;CACvB,CAAC;AAEF,iCAAiC;AACjC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;AAE1G,iDAAiD;AACjD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC5C,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK;IAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACzC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa;IAC9C,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;IAC/B,MAAM,EAAE,UAAU,EAAE,MAAM;IAC1B,KAAK,EAAE,SAAS;IAChB,aAAa,EAAE,EAAE;IACjB,KAAK,EAAE,MAAM;CACd,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,kDAAkD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,gEAAgE;IAChE,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,kEAAkE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtG,OAAO,UAAU,IAAI,cAAc,CAAC;AACtC,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,OAAO,cAAc;IACL;IAApB,YAAoB,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAEnC,wCAAwC;IAChC,YAAY,CAAC,GAAW,EAAE,KAAe;QAC/C,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACrC,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC3C,iEAAiE;gBACjE,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;oBACtF,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,IAAmD;QACtD,MAAM,YAAY,GAAG,IAAI,EAAE,YAAY,IAAI,KAAK,CAAC;QACjD,IAAI,KAAe,CAAC;QAEpB,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GAAoB,EAAE,CAAC;QAErC,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAE7C,0CAA0C;YAC1C,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAS;YACnD,IAAI,aAAa,CAAC,OAAO,CAAC;gBAAE,SAAS;YAErC,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,4BAA4B;YAC5B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAErC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAEtB,4CAA4C;gBAC5C,IAAI,wBAAwB,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAE7C,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;oBACtC,4EAA4E;oBAC5E,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,IAAI,UAAU,CAAC,OAAO,CAAC;wBAAE,SAAS;oBAEvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBACxC,IAAI,KAAK,EAAE,CAAC;wBACV,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,IAAI,EAAE,OAAO;4BACb,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;4BACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;yBACzB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,qDAAqD;IACrD,cAAc;QACZ,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,gBAAgB,GAAG,EAAE,CAAC;QAE1B,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,gBAAgB,GAAG,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,sCAAsC;YACxC,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,gBAAgB;aAC3B,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aAClB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAExC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YAC1C,uDAAuD;YACvD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAClC,cAAc;gBACd,IAAI,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBACnC,wCAAwC;gBACxC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3B,uEAAuE;oBACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACzC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;gBACjE,CAAC;gBACD,qEAAqE;gBACrE,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe;oBAC9C,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;gBACjD,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;YAEH,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,uCAAuC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACtD,IAAI,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBACzE,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;oBACrD,IAAI,YAAY,EAAE,CAAC;wBACjB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACzB,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;CACF"}