insa-check-core 0.1.0

package/dist/code/findings.d.ts

@@ -0,0 +1,18 @@
+import type { CheckOutcome, CodeFinding, Confidence } from "../types.js";
+import type { JsModule, JsNode } from "./javascript/index.js";
+import type { PyModule, PyNode } from "./python/index.js";
+/** Masks string literals that follow secret-looking names, so reports never repeat a hard-coded credential. */
+export declare function redact(line: string): string;
+export declare function snippetOf(line: string): string;
+export declare function pyFinding(module: PyModule, node: PyNode, rule: string, confidence: Confidence, why: string): CodeFinding;
+export declare function jsFinding(module: JsModule, node: JsNode, rule: string, confidence: Confidence, why: string): CodeFinding;
+export declare function locations(findings: CodeFinding[], max?: number): string;
+/**
+ * Standard verdict for pattern rules:
+ *  - any high/medium finding  -> fail
+ *  - only low-confidence ones -> manual (needs review; never a definitive fail)
+ *  - none                      -> pass ("no risky pattern found"; static analysis cannot prove absence)
+ */
+export declare function outcomeFromFindings(raw: CodeFinding[], passDetail: string): CheckOutcome;
+export declare const NO_PATTERN: (what: string, files: number, language?: string) => string;
+//# sourceMappingURL=findings.d.ts.map

package/dist/code/findings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../../src/code/findings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAK1D,+GAA+G;AAC/G,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG9C;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE,QAAQ,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,MAAM,GACV,WAAW,CAEb;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAGxH;AAgBD,wBAAgB,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,GAAG,SAAI,GAAG,MAAM,CAGlE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,YAAY,CAoBxF;AAED,eAAO,MAAM,UAAU,SAAU,MAAM,SAAS,MAAM,8BACgE,CAAC"}

package/dist/code/findings.js

@@ -0,0 +1,63 @@
+const SECRET_NAME = String.raw `[\w.\-]*(?:password|passwd|pwd|secret|token|api[_-]?key|apikey|private[_-]?key|access[_-]?key|credential)[\w.\-]*`;
+const SECRET_LITERAL = new RegExp(String.raw `(${SECRET_NAME}["']?\s*(?:=>|[:=]|,)\s*[rbuf]*)(["'])((?:(?!\2).){1,})\2`, "gi");
+/** Masks string literals that follow secret-looking names, so reports never repeat a hard-coded credential. */
+export function redact(line) {
+    return line.replace(SECRET_LITERAL, (_m, prefix, q) => `${prefix}${q}****${q}`);
+}
+export function snippetOf(line) {
+    const trimmed = redact(line.trim());
+    return trimmed.length > 200 ? `${trimmed.slice(0, 197)}...` : trimmed;
+}
+export function pyFinding(module, node, rule, confidence, why) {
+    return { file: module.path, line: node._l ?? 1, snippet: snippetOf(module.line(node._l)), why, confidence, method: "ast", rule };
+}
+export function jsFinding(module, node, rule, confidence, why) {
+    const line = module.lineOf(node);
+    return { file: module.path, line, snippet: snippetOf(module.line(line)), why, confidence, method: "ast", rule };
+}
+const RANK = { high: 0, medium: 1, low: 2 };
+function dedupe(findings) {
+    const seen = new Set();
+    return findings
+        .filter((f) => {
+        const k = `${f.file}:${f.line}:${f.rule}`;
+        if (seen.has(k))
+            return false;
+        seen.add(k);
+        return true;
+    })
+        .sort((a, b) => RANK[a.confidence] - RANK[b.confidence] || a.file.localeCompare(b.file) || a.line - b.line);
+}
+export function locations(findings, max = 3) {
+    const locs = findings.slice(0, max).map((f) => `${f.file}:${f.line}`);
+    return findings.length > max ? `${locs.join(", ")} (+${findings.length - max} more)` : locs.join(", ");
+}
+/**
+ * Standard verdict for pattern rules:
+ *  - any high/medium finding  -> fail
+ *  - only low-confidence ones -> manual (needs review; never a definitive fail)
+ *  - none                      -> pass ("no risky pattern found"; static analysis cannot prove absence)
+ */
+export function outcomeFromFindings(raw, passDetail) {
+    const findings = dedupe(raw);
+    const decisive = findings.filter((f) => f.confidence !== "low");
+    const regexNote = findings.some((f) => f.method === "regex") ? " Includes text-pattern (regex) matches, which have a higher false-positive rate." : "";
+    if (decisive.length > 0) {
+        const low = findings.length - decisive.length;
+        return {
+            status: "fail",
+            detail: `${decisive.length} finding(s): ${locations(decisive)}.${low ? ` Plus ${low} low-confidence match(es) to review.` : ""}${regexNote}`,
+            findings,
+        };
+    }
+    if (findings.length > 0) {
+        return {
+            status: "manual",
+            detail: `${findings.length} low-confidence match(es) need review: ${locations(findings)}.${regexNote}`,
+            findings,
+        };
+    }
+    return { status: "pass", detail: passDetail };
+}
+export const NO_PATTERN = (what, files, language = "Python") => `No ${what} found in ${files} ${language} file(s). Static analysis cannot prove absence; review dynamic code paths.`;
+//# sourceMappingURL=findings.js.map

package/dist/code/findings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.js","sourceRoot":"","sources":["../../src/code/findings.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAA,mHAAmH,CAAC;AAClJ,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,IAAI,WAAW,2DAA2D,EAAE,IAAI,CAAC,CAAC;AAE9H,+GAA+G;AAC/G,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,MAAc,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,MAAgB,EAChB,IAAY,EACZ,IAAY,EACZ,UAAsB,EACtB,GAAW;IAEX,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACnI,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAgB,EAAE,IAAY,EAAE,IAAY,EAAE,UAAsB,EAAE,GAAW;IACzG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAClH,CAAC;AAED,MAAM,IAAI,GAA+B,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAExE,SAAS,MAAM,CAAC,QAAuB;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,QAAQ;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;AAChH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAuB,EAAE,GAAG,GAAG,CAAC;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,OAAO,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAkB,EAAE,UAAkB;IACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,kFAAkF,CAAC,CAAC,CAAC,EAAE,CAAC;IACvJ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,gBAAgB,SAAS,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,sCAAsC,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE;YAC5I,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,0CAA0C,SAAS,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE;YACtG,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,QAAQ,GAAG,QAAQ,EAAE,EAAE,CAC7E,MAAM,IAAI,aAAa,KAAK,IAAI,QAAQ,4EAA4E,CAAC"}

package/dist/code/javascript/ast.d.ts

@@ -0,0 +1,46 @@
+/**
+ * JavaScript / TypeScript syntax trees come from @babel/parser (handles JS, JSX, TS, TSX).
+ * Rules are written against the Babel AST, loosely typed like the Python bridge.
+ */
+export interface JsNode {
+    type: string;
+    loc?: {
+        start: {
+            line: number;
+            column: number;
+        };
+        end: {
+            line: number;
+            column: number;
+        };
+    } | null;
+    [field: string]: unknown;
+}
+export interface JsParseResult {
+    ast?: JsNode;
+    error?: string;
+}
+/** Parses one file. Syntax errors are returned, not thrown, so one bad file never stops a scan. */
+export declare function parseJs(source: string, filePath: string): JsParseResult;
+export declare function isJsNode(x: unknown): x is JsNode;
+export declare function childJsNodes(node: JsNode): JsNode[];
+/** Depth-first, source order. `skip` prunes a subtree (e.g. nested functions). */
+export declare function walkJs(root: JsNode, skip?: (n: JsNode) => boolean): Generator<JsNode>;
+export declare const isJsFunction: (n: JsNode) => boolean;
+/** Strips TypeScript wrappers and parentheses that don't change the value: `x as T`, `x!`, `<T>x`, `(x)`. */
+export declare function unwrap(node: unknown): JsNode | undefined;
+/** "a.b.c" for identifier / member chains; calls and computed access become "()" and "[]". */
+export declare function jsDotted(node: unknown): string | undefined;
+/** Value of a string literal or a template literal without placeholders. */
+export declare function jsString(node: unknown): string | undefined;
+export declare function isJsLiteral(node: unknown): boolean;
+/** Template literal with placeholders, or "+" concatenation involving a string. */
+export declare function isJsDynamicString(node: unknown): boolean;
+export declare function jsArgs(call: JsNode): JsNode[];
+/** Value of `key` in an object literal argument, e.g. { shell: true }. */
+export declare function objectProp(node: unknown, key: string): JsNode | undefined;
+export declare function isJsTrue(node: unknown): boolean;
+export declare function isJsFalse(node: unknown): boolean;
+/** Identifier and property names used in an expression (including string keys like obj["password"]). */
+export declare function jsIdentifiers(node: JsNode): string[];
+//# sourceMappingURL=ast.d.ts.map

package/dist/code/javascript/ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../../../src/code/javascript/ast.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE;QAAE,KAAK,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,GAAG,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAChG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mGAAmG;AACnG,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,CAkBvE;AAED,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAEhD;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQnD;AAED,kFAAkF;AAClF,wBAAiB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAQtF;AAKD,eAAO,MAAM,YAAY,MAAO,MAAM,YAA+B,CAAC;AAEtE,6GAA6G;AAC7G,wBAAgB,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMxD;AAED,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAyB1D;AAED,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAQ1D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAGlD;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAWxD;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAE7C;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUzE;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAG/C;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAGhD;AAED,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAUpD"}

package/dist/code/javascript/ast.js

@@ -0,0 +1,166 @@
+import { parse } from "@babel/parser";
+/** Parses one file. Syntax errors are returned, not thrown, so one bad file never stops a scan. */
+export function parseJs(source, filePath) {
+    const isTs = /\.(ts|tsx|mts|cts)$/.test(filePath);
+    // In .ts files `<T>x` is a type assertion, so JSX is only enabled for .tsx and non-TS files.
+    const plugins = isTs
+        ? ["typescript", "decorators-legacy", ...(filePath.endsWith(".tsx") ? ["jsx"] : [])]
+        : ["jsx"];
+    try {
+        const file = parse(source, {
+            sourceType: "unambiguous",
+            plugins,
+            errorRecovery: true,
+            allowReturnOutsideFunction: true,
+        });
+        return { ast: file.program };
+    }
+    catch (err) {
+        const e = err;
+        return { error: `${e.message ?? "parse error"}${e.loc ? ` (line ${e.loc.line})` : ""}` };
+    }
+}
+export function isJsNode(x) {
+    return typeof x === "object" && x !== null && typeof x.type === "string";
+}
+const SKIP_KEYS = new Set(["loc", "start", "end", "range", "extra", "leadingComments", "trailingComments", "innerComments", "tokens"]);
+export function childJsNodes(node) {
+    const out = [];
+    for (const [k, v] of Object.entries(node)) {
+        if (SKIP_KEYS.has(k))
+            continue;
+        if (isJsNode(v))
+            out.push(v);
+        else if (Array.isArray(v))
+            for (const x of v)
+                if (isJsNode(x))
+                    out.push(x);
+    }
+    return out;
+}
+/** Depth-first, source order. `skip` prunes a subtree (e.g. nested functions). */
+export function* walkJs(root, skip) {
+    const stack = [root];
+    while (stack.length) {
+        const node = stack.pop();
+        yield node;
+        const kids = childJsNodes(node);
+        for (let i = kids.length - 1; i >= 0; i--)
+            if (!skip?.(kids[i]))
+                stack.push(kids[i]);
+    }
+}
+const FUNCTION_TYPES = new Set([
+    "FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression", "ObjectMethod", "ClassMethod", "ClassPrivateMethod",
+]);
+export const isJsFunction = (n) => FUNCTION_TYPES.has(n.type);
+/** Strips TypeScript wrappers and parentheses that don't change the value: `x as T`, `x!`, `<T>x`, `(x)`. */
+export function unwrap(node) {
+    let n = node;
+    while (isJsNode(n) && ["TSAsExpression", "TSNonNullExpression", "TSTypeAssertion", "TSSatisfiesExpression", "ParenthesizedExpression", "AwaitExpression"].includes(n.type)) {
+        n = n["expression"] ?? n["argument"];
+    }
+    return isJsNode(n) ? n : undefined;
+}
+/** "a.b.c" for identifier / member chains; calls and computed access become "()" and "[]". */
+export function jsDotted(node) {
+    const n = unwrap(node);
+    if (!n)
+        return undefined;
+    switch (n.type) {
+        case "Identifier":
+            return n["name"];
+        case "ThisExpression":
+            return "this";
+        case "MemberExpression":
+        case "OptionalMemberExpression": {
+            const base = jsDotted(n["object"]);
+            if (base === undefined)
+                return undefined;
+            const prop = n["property"];
+            if (!n["computed"] && prop.type === "Identifier")
+                return `${base}.${prop["name"]}`;
+            const key = jsString(prop);
+            return key !== undefined ? `${base}.${key}` : `${base}[]`;
+        }
+        case "CallExpression":
+        case "OptionalCallExpression": {
+            const base = jsDotted(n["callee"]);
+            return base === undefined ? undefined : `${base}()`;
+        }
+        default:
+            return undefined;
+    }
+}
+/** Value of a string literal or a template literal without placeholders. */
+export function jsString(node) {
+    const n = unwrap(node);
+    if (!n)
+        return undefined;
+    if (n.type === "StringLiteral")
+        return n["value"];
+    if (n.type === "TemplateLiteral" && n["expressions"].length === 0) {
+        return n["quasis"][0]?.["value"]?.cooked ?? "";
+    }
+    return undefined;
+}
+export function isJsLiteral(node) {
+    const n = unwrap(node);
+    return !!n && (jsString(n) !== undefined || ["NumericLiteral", "BooleanLiteral", "NullLiteral", "RegExpLiteral", "BigIntLiteral"].includes(n.type));
+}
+/** Template literal with placeholders, or "+" concatenation involving a string. */
+export function isJsDynamicString(node) {
+    const n = unwrap(node);
+    if (!n)
+        return false;
+    if (n.type === "TemplateLiteral")
+        return n["expressions"].length > 0;
+    if (n.type === "BinaryExpression" && n["operator"] === "+") {
+        const stringy = (x) => jsString(x) !== undefined || isJsDynamicString(x);
+        const l = n["left"];
+        const r = n["right"];
+        return (stringy(l) || stringy(r)) && !(jsString(l) !== undefined && jsString(r) !== undefined);
+    }
+    return false;
+}
+export function jsArgs(call) {
+    return (call["arguments"] ?? []).filter(isJsNode);
+}
+/** Value of `key` in an object literal argument, e.g. { shell: true }. */
+export function objectProp(node, key) {
+    const n = unwrap(node);
+    if (n?.type !== "ObjectExpression")
+        return undefined;
+    for (const p of n["properties"]) {
+        if (p.type !== "ObjectProperty")
+            continue;
+        const k = p["key"];
+        const name = k.type === "Identifier" ? k["name"] : jsString(k);
+        if (name === key)
+            return p["value"];
+    }
+    return undefined;
+}
+export function isJsTrue(node) {
+    const n = unwrap(node);
+    return n?.type === "BooleanLiteral" && n["value"] === true;
+}
+export function isJsFalse(node) {
+    const n = unwrap(node);
+    return n?.type === "BooleanLiteral" && n["value"] === false;
+}
+/** Identifier and property names used in an expression (including string keys like obj["password"]). */
+export function jsIdentifiers(node) {
+    const out = [];
+    for (const n of walkJs(node)) {
+        if (n.type === "Identifier")
+            out.push(n["name"]);
+        else if ((n.type === "MemberExpression" || n.type === "OptionalMemberExpression") && n["computed"]) {
+            const key = jsString(n["property"]);
+            if (key)
+                out.push(key);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=ast.js.map

package/dist/code/javascript/ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.js","sourceRoot":"","sources":["../../../src/code/javascript/ast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAkBtC,mGAAmG;AACnG,MAAM,UAAU,OAAO,CAAC,MAAc,EAAE,QAAgB;IACtD,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,6FAA6F;IAC7F,MAAM,OAAO,GAAmD,IAAI;QAClE,CAAC,CAAC,CAAC,YAAY,EAAE,mBAAmB,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE;YACzB,UAAU,EAAE,aAAa;YACzB,OAAO;YACP,aAAa,EAAE,IAAI;YACnB,0BAA0B,EAAE,IAAI;SACjC,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,OAA4B,EAAE,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAmD,CAAC;QAC9D,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,IAAI,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,CAAU;IACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAQ,CAAY,CAAC,IAAI,KAAK,QAAQ,CAAC;AACvF,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEvI,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/B,IAAI,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACxB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC;gBAAE,IAAI,QAAQ,CAAC,CAAC,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kFAAkF;AAClF,MAAM,SAAS,CAAC,CAAC,MAAM,CAAC,IAAY,EAAE,IAA6B;IACjE,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QAC1B,MAAM,IAAI,CAAC;QACX,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,qBAAqB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,cAAc,EAAE,aAAa,EAAE,oBAAoB;CAC5H,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAEtE,6GAA6G;AAC7G,MAAM,UAAU,MAAM,CAAC,IAAa;IAClC,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3K,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrC,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,YAAY;YACf,OAAO,CAAC,CAAC,MAAM,CAAW,CAAC;QAC7B,KAAK,gBAAgB;YACnB,OAAO,MAAM,CAAC;QAChB,KAAK,kBAAkB,CAAC;QACxB,KAAK,0BAA0B,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACnC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAW,CAAC;YACrC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAW,EAAE,CAAC;YAC7F,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;QAC5D,CAAC;QACD,KAAK,gBAAgB,CAAC;QACtB,KAAK,wBAAwB,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACnC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;QACtD,CAAC;QACD;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,CAAC,CAAC,OAAO,CAAW,CAAC;IAC5D,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAK,CAAC,CAAC,aAAa,CAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjF,OAAS,CAAC,CAAC,QAAQ,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAyB,EAAE,MAAM,IAAI,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACtJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAQ,CAAC,CAAC,aAAa,CAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IACpF,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,CAAE,IAAI,CAAC,WAAW,CAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,IAAa,EAAE,GAAW;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE,IAAI,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAa,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAW,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC,OAAO,CAAW,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,CAAC,EAAE,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,CAAC,EAAE,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC;AAC9D,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAW,CAAC,CAAC;aACtD,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,IAAI,KAAK,0BAA0B,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;YACnG,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YACpC,IAAI,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/code/javascript/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./ast.js";
+export * from "./module.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/code/javascript/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/code/javascript/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC"}

package/dist/code/javascript/index.js

@@ -0,0 +1,3 @@
+export * from "./ast.js";
+export * from "./module.js";
+//# sourceMappingURL=index.js.map

package/dist/code/javascript/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/code/javascript/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC"}

package/dist/code/javascript/module.d.ts

@@ -0,0 +1,59 @@
+import { type JsNode } from "./ast.js";
+export interface JsFunctionScope {
+    /** Names holding client-controlled data (request data and values derived from it). */
+    tainted: Set<string>;
+    /** Names assigned a dynamically built string (template literal with placeholders, + concatenation). */
+    dynamicStrings: Set<string>;
+    /** Qualified names of every call made in the function. */
+    calls: Set<string>;
+}
+export interface JsCallSite {
+    module: JsModule;
+    node: JsNode;
+    /** Qualified dotted callee with imports resolved, e.g. "child_process.exec", "crypto.createHash". */
+    name: string | undefined;
+    /** Last segment: method or function name. */
+    method: string | undefined;
+    /** Innermost enclosing function, if any. */
+    fn: JsNode | undefined;
+    /** True for `new X(...)`. */
+    isNew: boolean;
+}
+export declare class JsModule {
+    readonly path: string;
+    readonly tree: JsNode;
+    readonly lines: string[];
+    /** Local name -> module or "module.export", from import statements and require() calls. */
+    readonly imports: Map<string, string>;
+    private readonly scopes;
+    constructor(path: string, tree: JsNode, source: string);
+    /** "m" for require("m"), "m.y" for require("m").y; undefined otherwise. */
+    private requiredModule;
+    /** Resolves the first segment of a dotted name through this file's imports. */
+    qualify(name: string | undefined): string | undefined;
+    line(n: number | undefined): string;
+    lineOf(node: JsNode): number;
+    /** Exact source text of a node. */
+    text(node: JsNode): string;
+    /** True when the expression contains client-controlled data, given the scope's tainted names. */
+    isRequestDerived(node: unknown, scope?: JsFunctionScope): boolean;
+    /** Lightweight intra-procedural taint: request data and names assigned from it. */
+    scope(fn: JsNode | undefined): JsFunctionScope | undefined;
+}
+export declare class JsIndex {
+    readonly modules: JsModule[];
+    readonly parseErrors: {
+        file: string;
+        error: string;
+    }[];
+    private callSites?;
+    constructor(modules: JsModule[], parseErrors: {
+        file: string;
+        error: string;
+    }[]);
+    /** Every call and `new` expression with its resolved name and enclosing function. Computed once. */
+    calls(): JsCallSite[];
+    /** Whether any module imports the given package (or a subpath of it). */
+    imports(pkg: string): boolean;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/code/javascript/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/code/javascript/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiF,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAMtH,MAAM,WAAW,eAAe;IAC9B,sFAAsF;IACtF,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,uGAAuG;IACvG,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,0DAA0D;IAC1D,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,QAAQ,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,qGAAqG;IACrG,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,4CAA4C;IAC5C,EAAE,EAAE,MAAM,GAAG,SAAS,CAAC;IACvB,6BAA6B;IAC7B,KAAK,EAAE,OAAO,CAAC;CAChB;AAgDD,qBAAa,QAAQ;IAOjB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAPvB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,sBAA6B;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAEjE,YACW,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EAmCf;IAED,2EAA2E;IAC3E,OAAO,CAAC,cAAc;IActB,+EAA+E;IAC/E,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAKpD;IAED,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAElC;IAED,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3B;IAED,mCAAmC;IACnC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASzB;IAED,iGAAiG;IACjG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAOhE;IAED,mFAAmF;IACnF,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,CA8BzD;CACF;AAED,qBAAa,OAAO;IAIhB,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE;IAC5B,QAAQ,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE;IAJzD,OAAO,CAAC,SAAS,CAAC,CAAe;IAEjC,YACW,OAAO,EAAE,QAAQ,EAAE,EACnB,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,EACrD;IAEJ,oGAAoG;IACpG,KAAK,IAAI,UAAU,EAAE,CA6BpB;IAED,yEAAyE;IACzE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE5B;CACF"}