insa-check-core 0.1.0

package/dist/code/checks/php.js

@@ -0,0 +1,433 @@
+import { locations, NO_PATTERN, outcomeFromFindings, snippetOf } from "../findings.js";
+import { isPhpDynamicString, isPhpLiteral, isPhpNode, phpArgs, phpDotted, phpIdentifiers, phpString, walkPhp, } from "../php/index.js";
+import { looksSecret, SECRET_ASSIGN, SECRET_DICT_KEY } from "./secrets.js";
+import { codeCheck, PASSWORD_IDENT, SECRET_IDENT, SECURITY_CONTEXT } from "./shared.js";
+/** Pattern rules for any PHP code, and configuration rules for Laravel. */
+const LANG = "PHP";
+function phpFinding(module, node, rule, confidence, why) {
+    const line = module.lineOf(node);
+    return { file: module.path, line, snippet: snippetOf(module.line(line)), why, confidence, method: "ast", rule };
+}
+function phpPatternCheck(key, find, what) {
+    return codeCheck(key, ["php"], async (ctx) => {
+        const index = await ctx.php();
+        return outcomeFromFindings(await find(index, ctx), NO_PATTERN(what, index.modules.length, LANG));
+    });
+}
+/** Same scale as the Python and JavaScript rules: direct request data = high, derived/built = medium, unknown = low. */
+function phpArgRisk(site, arg, opts = {}) {
+    if (!arg || isPhpLiteral(arg))
+        return undefined;
+    const scope = site.module.scope(site.fn);
+    if (site.module.isRequestDerived(arg))
+        return "high";
+    const derived = site.module.isRequestDerived(arg, scope);
+    if (opts.requestOnly && !derived)
+        return undefined;
+    if (isPhpDynamicString(arg))
+        return derived ? "high" : "medium";
+    if (derived)
+        return "medium";
+    if (arg.kind === "variable" && scope?.dynamicStrings.has(arg["name"]))
+        return "medium";
+    return opts.unknownIsLow === false ? undefined : "low";
+}
+function sinkFindings(sites, match, rule, why, opts = {}) {
+    const out = [];
+    for (const site of sites) {
+        const m = match(site);
+        if (!m)
+            continue;
+        const risks = (Array.isArray(m) ? m : [m]).map((a) => phpArgRisk(site, a, opts)).filter((r) => !!r);
+        if (risks.length === 0)
+            continue;
+        out.push(phpFinding(site.module, site.node, rule, risks.includes("high") ? "high" : risks.includes("medium") ? "medium" : "low", why));
+    }
+    return out;
+}
+const arg = (s, i = 0) => phpArgs(s.node)[i];
+const fnName = (s) => (s.name ?? "").toLowerCase();
+const allNodes = function* (index) {
+    for (const module of index.modules)
+        for (const node of walkPhp(module.tree))
+            yield { module, node };
+};
+const lineText = (s) => s.module.line(s.module.lineOf(s.node));
+// --- #6 Hard-coded secrets ------------------------------------------------------------
+const VALIDATION_RULE = /\||^(required|nullable|sometimes|string|confirmed|present|filled)\b|^(min|max|size|between|regex|same|different):/;
+const SECRET_WHY = "Credentials in source code leak through repositories, backups and builds; load them from the environment or a secret store.";
+export const phpHardcodedSecrets = phpPatternCheck("php-hardcoded-secrets", (index) => {
+    const out = [];
+    for (const { module, node } of allNodes(index)) {
+        if (node.kind === "assign") {
+            const name = (phpDotted(node["left"]) ?? "").split(/->|::|\$/).pop() ?? "";
+            if (SECRET_ASSIGN.test(name) && looksSecret(phpString(node["right"])))
+                out.push(phpFinding(module, node, "php-hardcoded-secret", "medium", SECRET_WHY));
+        }
+        else if (node.kind === "entry") {
+            const value = phpString(node["value"]);
+            // 'password' => 'required|min:12' is a validation rule, not a credential.
+            if (value && VALIDATION_RULE.test(value))
+                continue;
+            if (SECRET_DICT_KEY.test(phpString(node["key"]) ?? "") && looksSecret(value)) {
+                out.push(phpFinding(module, node, "php-hardcoded-secret", "medium", SECRET_WHY));
+            }
+        }
+    }
+    for (const s of index.calls()) {
+        // define('DB_PASSWORD', 'literal')
+        if (fnName(s) === "define" && SECRET_ASSIGN.test(phpString(arg(s)) ?? "") && looksSecret(phpString(arg(s, 1)))) {
+            out.push(phpFinding(s.module, s.node, "php-hardcoded-secret", "medium", SECRET_WHY));
+        }
+    }
+    return out;
+}, "hard-coded credentials");
+// --- #19 / #20 Cryptography --------------------------------------------------------------
+export const phpWeakCrypto = phpPatternCheck("php-weak-crypto", (index) => {
+    const out = [];
+    for (const s of index.calls()) {
+        const name = fnName(s);
+        const alg = (phpString(arg(s)) ?? "").toLowerCase();
+        if (name === "md5" || name === "sha1" || (name === "hash" && (alg === "md5" || alg === "sha1"))) {
+            const security = SECURITY_CONTEXT.test(lineText(s));
+            out.push(phpFinding(s.module, s.node, "php-weak-hash", security ? "high" : "low", security ? "MD5/SHA-1 are broken for security purposes (collisions, fast brute force)." : "MD5/SHA-1 in use; acceptable only for non-security checksums. Confirm how it is used."));
+        }
+        else if (/^mcrypt_/.test(name)) {
+            out.push(phpFinding(s.module, s.node, "php-mcrypt", "high", "The mcrypt extension is abandoned and removed from PHP; use openssl or sodium."));
+        }
+        else if (/^openssl_(en|de)crypt$/.test(name) && /(^|-)(des|des3|des-ede3?|rc4|rc2|bf)(-|$)/.test((phpString(arg(s, 1)) ?? "").toLowerCase())) {
+            out.push(phpFinding(s.module, s.node, "php-weak-cipher", "high", "DES/3DES/RC4/Blowfish-class ciphers are deprecated and breakable."));
+        }
+    }
+    return out;
+}, "use of weak hashes or ciphers");
+export const phpCryptoMisuse = phpPatternCheck("php-crypto-misuse", (index) => {
+    const out = [];
+    for (const s of index.calls()) {
+        const name = fnName(s);
+        if (/^(rand|mt_rand|uniqid|lcg_value|str_shuffle)$/.test(name) && SECURITY_CONTEXT.test(lineText(s))) {
+            out.push(phpFinding(s.module, s.node, "php-insecure-random", "medium", "rand/mt_rand/uniqid are predictable; use random_bytes() or random_int() for tokens, passwords and keys."));
+        }
+        else if (/^openssl_(en|de)crypt$/.test(name) && /-ecb$/i.test(phpString(arg(s, 1)) ?? "")) {
+            out.push(phpFinding(s.module, s.node, "php-ecb-mode", "high", "ECB mode leaks plaintext patterns; use an authenticated mode such as GCM."));
+        }
+        else if (/^(md5|sha1|hash|crc32)$/.test(name) && phpArgs(s.node).some((a) => phpIdentifiers(a).some((i) => PASSWORD_IDENT.test(i)) || /['"]pass(word|wd)?['"]/i.test(s.module.text(a)))) {
+            out.push(phpFinding(s.module, s.node, "php-fast-password-hash", "high", "Passwords hashed with a fast, unsalted hash can be brute-forced; use password_hash()."));
+        }
+        else if (name === "curl_setopt" && /CURLOPT_SSL_VERIFY(PEER|HOST)/.test(phpDotted(arg(s, 1)) ?? "")) {
+            const v = arg(s, 2);
+            if (v && ((v.kind === "boolean" && v["value"] === false) || (v.kind === "number" && Number(v["value"]) === 0))) {
+                out.push(phpFinding(s.module, s.node, "php-curl-verify-off", "high", "Disabling certificate verification allows man-in-the-middle attacks."));
+            }
+        }
+    }
+    for (const { module, node } of allNodes(index)) {
+        // Guzzle: ['verify' => false]
+        if (node.kind === "entry" && phpString(node["key"]) === "verify") {
+            const v = node["value"];
+            if (v?.kind === "boolean" && v["value"] === false)
+                out.push(phpFinding(module, node, "php-guzzle-verify-off", "high", "'verify' => false disables TLS certificate verification."));
+        }
+    }
+    return out;
+}, "cryptographic misuse (insecure randomness, ECB, fast password hashes, disabled TLS verification)");
+// --- #34 Plaintext passwords ---------------------------------------------------------------
+const HASHING = /password_hash|hash::make|bcrypt|hash\(|crypt\(|sodium_/i;
+export const phpPlaintextPasswords = phpPatternCheck("php-plaintext-passwords", (index) => {
+    const out = [];
+    for (const { module, node } of allNodes(index)) {
+        if (node.kind === "assign") {
+            const left = node["left"];
+            const right = node["right"];
+            if (!["propertylookup", "offsetlookup"].includes(left.kind) || isPhpLiteral(right))
+                continue;
+            const name = (phpDotted(left) ?? "").split(/->|\[/).pop()?.replace("]", "") ?? "";
+            if (!PASSWORD_IDENT.test(name) || /hash|digest|salt/i.test(name) || HASHING.test(module.text(right)))
+                continue;
+            out.push(phpFinding(module, node, "php-plaintext-password-assign", module.isRequestDerived(right) ? "high" : "medium", "Assigning a raw value to a password field stores it unhashed; use password_hash() / Hash::make()."));
+        }
+        else if (node.kind === "entry") {
+            const key = phpString(node["key"]) ?? "";
+            const value = node["value"];
+            if (PASSWORD_IDENT.test(key) && isPhpNode(value) && module.isRequestDerived(value) && !HASHING.test(module.text(value))) {
+                out.push(phpFinding(module, node, "php-plaintext-password-stored", "medium", "A request password is passed on unhashed; if this array is saved, the password is stored in plaintext."));
+            }
+        }
+        else if (node.kind === "bin" && ["==", "===", "!=", "!=="].includes(node["type"])) {
+            const last = (x) => (phpDotted(x) ?? "").split(/->|\[|\$/).pop()?.replace("]", "") ?? "";
+            const [l, r] = [node["left"], node["right"]];
+            if (isPhpLiteral(l) || isPhpLiteral(r))
+                continue;
+            if (PASSWORD_IDENT.test(last(l)) && PASSWORD_IDENT.test(last(r)) && !/hash|confirm|repeat/i.test(module.text(node))) {
+                out.push(phpFinding(module, node, "php-plaintext-password-compare", "medium", "Comparing passwords directly implies they are stored in plaintext; use password_verify()."));
+            }
+        }
+    }
+    return out;
+}, "plaintext password storage or comparison");
+// --- #41 SQL injection ---------------------------------------------------------------------
+const SQL_TEXT = /\b(select|insert|update|delete|where|from|values|drop|alter)\b/i;
+const SQL_FUNCTION = { mysql_query: 0, mysqli_query: 1, pg_query: 1, sqlite_query: 1, mysqli_multi_query: 1, mysqli_real_query: 1 };
+const SQL_RAW_METHOD = /^(whereRaw|orWhereRaw|selectRaw|orderByRaw|havingRaw|groupByRaw|fromRaw)$/;
+const DB_FACADE = /(^|\\)DB::(select|insert|update|delete|statement|unprepared|raw|scalar)$/;
+export const phpSqlInjection = phpPatternCheck("php-sql-injection", (index) => sinkFindings(index.calls(), (s) => {
+    const name = s.name ?? "";
+    const fnIndex = SQL_FUNCTION[fnName(s)];
+    if (fnIndex !== undefined)
+        return arg(s, fnIndex) ?? arg(s, 0);
+    if (DB_FACADE.test(name) || SQL_RAW_METHOD.test(s.method ?? ""))
+        return arg(s);
+    if (/->(query|exec|prepare|multi_query|real_query)$/.test(name)) {
+        const a = arg(s);
+        // Generic method names: a built string must look like SQL to count.
+        return a && (!isPhpDynamicString(a) || SQL_TEXT.test(s.module.text(a))) ? a : undefined;
+    }
+    return undefined;
+}, "php-sql-string-building", "SQL built from strings can be manipulated by user input; use prepared statements with bound parameters."), "SQL built by string concatenation or interpolation");
+// --- #44 OS command / #54 code injection ------------------------------------------------------
+export const phpCommandInjection = phpPatternCheck("php-command-injection", (index) => sinkFindings(index.calls(), (s) => (/^(exec|shell_exec|system|passthru|popen|proc_open|pcntl_exec)$/.test(fnName(s)) ? arg(s) : undefined), "php-shell-command", "Running a shell command built from variables allows command injection; avoid the shell or use escapeshellarg()."), "OS command execution with variable input");
+export const phpCodeInjection = phpPatternCheck("php-code-injection", (index) => {
+    const out = [
+        ...sinkFindings(index.calls(), (s) => (/^(assert|create_function)$/.test(fnName(s)) ? arg(s) : undefined), "php-dynamic-code", "Evaluating variable input as code runs arbitrary PHP."),
+        ...sinkFindings(index.calls(), (s) => (fnName(s) === "unserialize" ? arg(s) : undefined), "php-unserialize", "unserialize() on request data can instantiate arbitrary objects and run code; use JSON.", { requestOnly: true }),
+    ];
+    for (const { module, node } of allNodes(index)) {
+        if (node.kind === "eval" && !isPhpLiteral(node["source"])) {
+            out.push(phpFinding(module, node, "php-eval", module.isRequestDerived(node["source"]) ? "high" : "medium", "eval() of non-constant input runs arbitrary PHP."));
+        }
+        else if (node.kind === "include" && module.isRequestDerived(node["target"])) {
+            out.push(phpFinding(module, node, "php-dynamic-include", "high", "Including a file chosen by request data allows local/remote file inclusion and code execution."));
+        }
+    }
+    return out;
+}, "eval, dynamic includes or unsafe deserialisation of variable input");
+// --- #42 Path traversal -----------------------------------------------------------------------
+const FILE_FN = /^(fopen|file_get_contents|file_put_contents|readfile|unlink|file|copy|rename|mkdir|rmdir|opendir|scandir|move_uploaded_file|fpassthru|highlight_file|show_source)$/;
+export const phpPathTraversal = phpPatternCheck("php-path-traversal", (index) => sinkFindings(index.calls(), (s) => (FILE_FN.test(fnName(s)) || /(^|\\)Storage::(get|put|delete|download|path)$|->download$/.test(s.name ?? "") ? phpArgs(s.node) : undefined), "php-path-from-request", "File paths built from request data allow ../ traversal; use basename() and confine paths to an allowed directory.", { requestOnly: true }), "file paths built from request data");
+// --- #43 Cross-site scripting --------------------------------------------------------------------
+const ESCAPED = /htmlspecialchars|htmlentities|strip_tags|\be\(|intval|\(int\)|json_encode|urlencode/i;
+export const phpXss = phpPatternCheck("php-xss", async (index, ctx) => {
+    const out = [];
+    for (const { module, node } of allNodes(index)) {
+        if (node.kind !== "echo" && node.kind !== "print")
+            continue;
+        const exprs = node.kind === "echo" ? (node["expressions"] ?? []) : [node["expression"]];
+        for (const e of exprs.filter(isPhpNode)) {
+            if (!module.isRequestDerived(e) || ESCAPED.test(module.text(e)))
+                continue;
+            out.push(phpFinding(module, node, "php-echo-request", "high", "Echoing request data without htmlspecialchars() enables reflected XSS."));
+            break;
+        }
+    }
+    // Blade templates: {!! ... !!} outputs without escaping. Regex only (higher false-positive rate, flagged in output).
+    for (const f of ctx.files.filter((x) => x.path.endsWith(".blade.php"))) {
+        (await ctx.read(f.path)).split(/\r?\n/).forEach((line, i) => {
+            if (/\{!!.*!!\}/.test(line)) {
+                out.push({ file: f.path, line: i + 1, snippet: snippetOf(line), why: "{!! !!} outputs a value without HTML-escaping; safe only if it can never contain user input.", confidence: "low", method: "regex", rule: "blade-unescaped-output" });
+            }
+        });
+    }
+    return out;
+}, "unescaped output of request data");
+// --- #55 Regex / #56 mass assignment / #60, #97 open redirect / #77 logs -----------------------------
+export const phpRegexInjection = phpPatternCheck("php-regex-injection", (index) => sinkFindings(index.calls(), (s) => (/^preg_(match|match_all|replace|replace_callback|split|grep)$/.test(fnName(s)) ? arg(s) : undefined), "php-regex-from-request", "Regular expressions built from request data allow ReDoS and pattern manipulation; use preg_quote().", { requestOnly: true }), "regular expressions built from request data");
+export const phpMassAssignment = phpPatternCheck("php-mass-assignment", (index) => {
+    const out = [];
+    const wholeRequest = (a) => /^(\$request|request\(\))->(all|input|post)\(\)$/.test(phpDotted(a) ?? "") && phpArgs(a).length === 0 || ["$_POST", "$_REQUEST", "$_GET"].includes(phpDotted(a) ?? "");
+    for (const s of index.calls()) {
+        if ((s.isNew || /^(create|update|fill|forceFill|insert|firstOrCreate|updateOrCreate|forceCreate)$/.test(s.method ?? "")) && phpArgs(s.node).some(wholeRequest)) {
+            out.push(phpFinding(s.module, s.node, "php-request-to-model", "medium", "Passing all request input to a model lets clients set any fillable field; use $request->validated() or ->only([...])."));
+        }
+    }
+    for (const { module, node } of allNodes(index)) {
+        // protected $guarded = [];
+        if (node.kind === "property" && phpDotted(node["name"]) === "guarded" && isPhpNode(node["value"]) && node["value"].kind === "array" && (node["value"]["items"] ?? []).length === 0) {
+            out.push(phpFinding(module, node, "laravel-guarded-empty", "medium", "$guarded = [] makes every model attribute mass-assignable."));
+        }
+    }
+    return out;
+}, "mass-assignment patterns (all request input passed to a model, empty $guarded)");
+export const phpOpenRedirect = phpPatternCheck("php-open-redirect", (index) => {
+    const out = [];
+    for (const s of index.calls()) {
+        const name = s.name ?? "";
+        let target;
+        if (fnName(s) === "header" && /location\s*:/i.test(s.module.text(s.node)))
+            target = arg(s);
+        else if (name === "redirect" || /(->|::)(to|away)$/.test(name) && /redirect/i.test(name))
+            target = arg(s);
+        if (!target || !s.module.isRequestDerived(target, s.module.scope(s.fn)))
+            continue;
+        out.push(phpFinding(s.module, s.node, "php-open-redirect", s.module.isRequestDerived(target) ? "high" : "medium", "Redirecting to a URL taken from the request lets attackers send users to malicious sites; allow only relative paths or known hosts."));
+    }
+    return out;
+}, "redirects to request-controlled URLs");
+const LOG_CALL = /^(error_log|syslog|logger)$|(^|\\)Log::(debug|info|notice|warning|error|critical|alert|emergency)$|->(debug|info|notice|warning|error|critical)$/;
+export const phpSecretsInLogs = phpPatternCheck("php-secrets-in-logs", (index) => {
+    const out = [];
+    for (const s of index.calls()) {
+        if (!LOG_CALL.test(s.name ?? ""))
+            continue;
+        for (const a of phpArgs(s.node)) {
+            if (isPhpLiteral(a))
+                continue;
+            const secret = phpIdentifiers(a).find((i) => SECRET_IDENT.test(i));
+            const dump = [...walkPhp(a)].some((n) => /^(\$_POST|\$_REQUEST|\$_COOKIE|(\$request|request\(\))->all\(\))$/.test(phpDotted(n) ?? ""));
+            if (secret || dump) {
+                out.push(phpFinding(s.module, s.node, "php-secret-logged", "medium", dump ? "Logging raw request data can write passwords, tokens and session IDs to logs." : `Logs a value named "${secret}", which may be a credential or token.`));
+                break;
+            }
+        }
+    }
+    return out;
+}, "logging of passwords, tokens or raw request data");
+// --- #86 / #87 XML ------------------------------------------------------------------------------
+const xmlFlag = (index, flag, rule, why) => {
+    const out = [];
+    for (const s of index.calls()) {
+        if (phpArgs(s.node).some((a) => [...walkPhp(a)].some((n) => flag.test(phpDotted(n) ?? ""))))
+            out.push(phpFinding(s.module, s.node, rule, "high", why));
+    }
+    return out;
+};
+export const phpXxe = phpPatternCheck("php-xml-xxe", (index) => [
+    ...xmlFlag(index, /^LIBXML_NOENT$/, "php-libxml-noent", "LIBXML_NOENT makes libxml substitute external entities (XXE): file disclosure and SSRF."),
+    ...index.calls()
+        .filter((s) => fnName(s) === "libxml_disable_entity_loader" && arg(s)?.kind === "boolean" && arg(s)["value"] === false)
+        .map((s) => phpFinding(s.module, s.node, "php-entity-loader-enabled", "high", "libxml_disable_entity_loader(false) enables external entity loading.")),
+], "XML parser options that expand external entities");
+export const phpExternalDtd = phpPatternCheck("php-xml-dtd", (index) => xmlFlag(index, /^LIBXML_(DTDLOAD|DTDVALID|DTDATTR)$/, "php-libxml-dtd", "Loading DTDs lets documents pull external definitions."), "XML parser options that load external DTDs");
+// --- Laravel configuration -------------------------------------------------------------------------
+function laravelCheck(key, run) {
+    return codeCheck(key, ["laravel"], async (ctx) => run(await ctx.php(), ctx));
+}
+/** Value of a top-level key in a config file that returns an array, e.g. config/session.php 'secure'. */
+function configEntry(index, file, key) {
+    for (const module of index.modules.filter((m) => file.test(m.path))) {
+        for (const n of walkPhp(module.tree)) {
+            if (n.kind === "entry" && phpString(n["key"]) === key && isPhpNode(n["value"]))
+                return { module, node: n, value: n["value"] };
+        }
+    }
+    return undefined;
+}
+/** Literal true/false, or the literal default of env('NAME', default). */
+function boolOrEnvDefault(input) {
+    // (bool) env('X', false) -> look through the cast.
+    const value = input.kind === "cast" && isPhpNode(input["expr"]) ? input["expr"] : input;
+    if (value.kind === "boolean")
+        return { literal: value["value"] };
+    if (value.kind === "call" && phpDotted(value["what"]) === "env") {
+        const d = phpArgs(value)[1];
+        if (d?.kind === "boolean")
+            return { envDefault: d["value"] };
+    }
+    return {};
+}
+export const laravelDebug = laravelCheck("laravel-debug", (index) => {
+    const entry = configEntry(index, /(^|\/)config\/app\.php$/, "debug");
+    if (!entry)
+        return { status: "manual", detail: "config/app.php 'debug' was not found; confirm APP_DEBUG is false in production." };
+    const { literal, envDefault } = boolOrEnvDefault(entry.value);
+    const where = `${entry.module.path}:${entry.module.lineOf(entry.node)}`;
+    if (literal === true) {
+        return outcomeFromFindings([phpFinding(entry.module, entry.node, "laravel-debug-true", "high", "'debug' => true shows stack traces, queries and environment values to visitors.")], "");
+    }
+    if (envDefault === true) {
+        return outcomeFromFindings([phpFinding(entry.module, entry.node, "laravel-debug-default-true", "medium", "Debug mode defaults to on when APP_DEBUG is not set; default it to false.")], "");
+    }
+    if (literal === false)
+        return { status: "pass", detail: `Debug mode is off (${where}).` };
+    return { status: "manual", detail: `Debug mode is read from APP_DEBUG (${where}) and defaults to off; confirm it is false in the production environment.` };
+});
+function laravelSessionFlag(key, option, label, why) {
+    return laravelCheck(key, (index) => {
+        const entry = configEntry(index, /(^|\/)config\/session\.php$/, option);
+        if (!entry)
+            return { status: "manual", detail: `config/session.php '${option}' was not found; confirm ${label} is enabled for session cookies.` };
+        const { literal, envDefault } = boolOrEnvDefault(entry.value);
+        const where = `${entry.module.path}:${entry.module.lineOf(entry.node)}`;
+        if (literal === false || envDefault === false) {
+            return outcomeFromFindings([phpFinding(entry.module, entry.node, `${key}-off`, literal === false ? "high" : "medium", why)], "");
+        }
+        if (literal === true || envDefault === true)
+            return { status: "pass", detail: `Session cookies set ${label} (${where}).` };
+        return { status: "manual", detail: `${label} for session cookies is read from the environment (${where}); confirm the production value.` };
+    });
+}
+export const laravelSessionSecure = laravelSessionFlag("laravel-session-cookie-secure", "secure", "the Secure flag", "The session cookie can be sent over plain HTTP and intercepted.");
+export const laravelSessionHttpOnly = laravelSessionFlag("laravel-session-cookie-httponly", "http_only", "HttpOnly", "JavaScript (including injected scripts) can read the session cookie.");
+const MAX_SESSION_MINUTES = 24 * 60;
+export const laravelSessionExpiry = laravelCheck("laravel-session-expiry", (index) => {
+    const entry = configEntry(index, /(^|\/)config\/session\.php$/, "lifetime");
+    if (!entry)
+        return { status: "manual", detail: "config/session.php 'lifetime' was not found; confirm session timeouts." };
+    const v = entry.value;
+    const literal = v.kind === "number" ? Number(v["value"]) : v.kind === "call" && phpDotted(v["what"]) === "env" && phpArgs(v)[1]?.kind === "number" ? Number(phpArgs(v)[1]["value"]) : undefined;
+    if (literal === undefined)
+        return { status: "manual", detail: `Session lifetime is computed at runtime (${entry.module.path}:${entry.module.lineOf(entry.node)}); confirm the production value.` };
+    if (literal > MAX_SESSION_MINUTES) {
+        return outcomeFromFindings([phpFinding(entry.module, entry.node, "laravel-session-lifetime", "medium", `Sessions stay valid for ${Math.round(literal / 60)} hours; this tool expects at most 24h as INSA sets no figure.`)], "");
+    }
+    return { status: "pass", detail: `Sessions expire after ${literal} minutes of inactivity.` };
+});
+export const laravelCsrf = laravelCheck("laravel-csrf", (index) => {
+    const exempt = [];
+    for (const { module, node } of allNodes(index)) {
+        // protected $except = ['webhook/*'] in the CSRF middleware.
+        if (node.kind === "property" && phpDotted(node["name"]) === "except" && /csrf/i.test(module.path + module.lines.join("\n")) && isPhpNode(node["value"]) && node["value"].kind === "array" && (node["value"]["items"] ?? []).length > 0) {
+            exempt.push(phpFinding(module, node, "laravel-csrf-except", "low", "These routes are exempt from CSRF verification; confirm each uses another defence (e.g. signed webhooks)."));
+        }
+    }
+    if (exempt.length)
+        return { status: "manual", detail: `CSRF verification has ${exempt.length} exemption list(s): ${locations(exempt)}. Review each route.`, findings: exempt };
+    return { status: "pass", detail: "Laravel verifies CSRF tokens on web routes by default and no exemptions were found." };
+});
+export const laravelAuthRateLimit = laravelCheck("laravel-auth-rate-limit", (index) => {
+    if (index.mentions(/throttle:|RateLimiter::|ThrottleRequests|ThrottlesLogins/)) {
+        return { status: "pass", detail: "Rate limiting (throttle middleware / RateLimiter) is used. Confirm it covers login, password-reset and token routes." };
+    }
+    return { status: "manual", detail: "No throttle middleware or RateLimiter found. It may be enforced by a reverse proxy or WAF; verify there." };
+});
+export const laravelLoginRotation = laravelCheck("laravel-login-session-rotation", (index) => {
+    const attempts = index.calls().filter((s) => /(^|\\)Auth::attempt$|auth\(\)->attempt$|->attempt$/.test(s.name ?? ""));
+    if (attempts.length === 0)
+        return { status: "manual", detail: "No Auth::attempt() login found in the code; review how users are authenticated (starter kits regenerate the session)." };
+    if (index.mentions(/->regenerate\(\)/))
+        return { status: "pass", detail: "The session is regenerated on login ($request->session()->regenerate())." };
+    return outcomeFromFindings(attempts.map((s) => phpFinding(s.module, s.node, "laravel-login-no-regenerate", "medium", "Login does not regenerate the session ID (session fixation); call $request->session()->regenerate() after Auth::attempt().")), "");
+});
+const handlesUploads = (index) => index.mentions(/\$_FILES|->file\(|->hasFile\(|UploadedFile/);
+const NO_UPLOADS = (n) => ({ status: "pass", detail: `No file upload handling found in ${n} PHP file(s).` });
+export const phpUploadPath = codeCheck("php-upload-path", ["php"], async (ctx) => {
+    const index = await ctx.php();
+    if (!handlesUploads(index))
+        return NO_UPLOADS(index.modules.length);
+    const findings = [];
+    for (const s of index.calls()) {
+        const text = s.module.text(s.node);
+        const clientName = /getClientOriginalName\(\)|\$_FILES\[[^\]]+\]\[['"]name['"]\]/.test(text);
+        if (clientName && (/^(move_uploaded_file|copy|rename)$/.test(fnName(s)) || /->(storeAs|move|putFileAs)$/.test(s.name ?? ""))) {
+            findings.push(phpFinding(s.module, s.node, "php-upload-client-filename", "high", "Storing an upload under the client-supplied file name allows ../ to escape the upload directory and overwrites; generate the name (->store()) or use basename() plus an allow-list."));
+        }
+    }
+    return outcomeFromFindings(findings, "Uploads are not stored under client-supplied file names.");
+});
+export const phpUploadSize = codeCheck("php-upload-size", ["php"], async (ctx) => {
+    const index = await ctx.php();
+    if (!handlesUploads(index))
+        return NO_UPLOADS(index.modules.length);
+    if (index.mentions(/['"|]max:\d+|\[['"]size['"]\]\s*[<>]|getSize\(\)\s*[<>]/))
+        return { status: "pass", detail: "Upload size is validated in code (max: rule or size comparison)." };
+    return { status: "manual", detail: "The project handles uploads but no size validation was found in code. Confirm upload_max_filesize / post_max_size or add a max: rule." };
+});
+export const phpUploadType = codeCheck("php-upload-type", ["php"], async (ctx) => {
+    const index = await ctx.php();
+    if (!handlesUploads(index))
+        return NO_UPLOADS(index.modules.length);
+    if (index.mentions(/mimes:|mimetypes:|['"|]image['"|]|finfo_file|mime_content_type|getMimeType\(\)|exif_imagetype/)) {
+        return { status: "pass", detail: "Upload type is validated in code (mimes/mimetypes/image rule or a content-type check)." };
+    }
+    return { status: "manual", detail: "The project handles uploads but no type validation was found in code; confirm uploads are restricted by content, not only by extension." };
+});
+//# sourceMappingURL=php.js.map

package/dist/code/checks/php.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"php.js","sourceRoot":"","sources":["../../../src/code/checks/php.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,OAAO,EACP,SAAS,EACT,cAAc,EACd,SAAS,EACT,OAAO,GAKR,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAExF,2EAA2E;AAE3E,MAAM,IAAI,GAAG,KAAK,CAAC;AAEnB,SAAS,UAAU,CAAC,MAAiB,EAAE,IAAa,EAAE,IAAY,EAAE,UAAsB,EAAE,GAAW;IACrG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAClH,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,IAAmF,EAAE,IAAY;IACrI,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;QAC9B,OAAO,mBAAmB,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,wHAAwH;AACxH,SAAS,UAAU,CAAC,IAAiB,EAAE,GAAwB,EAAE,IAAI,GAAgB,EAAE;IACrF,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,IAAI,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC7B,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjG,OAAO,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CACnB,KAAoB,EACpB,KAA2E,EAC3E,IAAY,EACZ,GAAW,EACX,IAAI,GAAgB,EAAE;IAEtB,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACzI,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAc,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,MAAM,MAAM,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,KAAe;IACzC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACtG,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAE5E,yFAAyF;AACzF,MAAM,eAAe,GAAG,mHAAmH,CAAC;AAC5I,MAAM,UAAU,GAAG,6HAA6H,CAAC;AAEjJ,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAChD,uBAAuB,EACvB,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAC3E,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QAC1J,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACvC,0EAA0E;YAC1E,IAAI,KAAK,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS;YACnD,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,mCAAmC;QACnC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/G,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,wBAAwB,CACzB,CAAC;AAEF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAC1C,iBAAiB,EACjB,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC;YAChG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAC9E,QAAQ,CAAC,CAAC,CAAC,4EAA4E,CAAC,CAAC,CAAC,uFAAuF,CAAC,CAAC,CAAC;QACxL,CAAC;aAAM,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gFAAgF,CAAC,CAAC,CAAC;QACjJ,CAAC;aAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,2CAA2C,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/I,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,mEAAmE,CAAC,CAAC,CAAC;QACzI,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,+BAA+B,CAChC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAC5C,mBAAmB,EACnB,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,yGAAyG,CAAC,CAAC,CAAC;QACrL,CAAC;aAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,2EAA2E,CAAC,CAAC,CAAC;QAC9I,CAAC;aAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1L,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,uFAAuF,CAAC,CAAC,CAAC;QACpK,CAAC;aAAM,IAAI,IAAI,KAAK,aAAa,IAAI,+BAA+B,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACtG,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/G,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,sEAAsE,CAAC,CAAC,CAAC;YAChJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,8BAA8B;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAY,CAAC;YACnC,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,0DAA0D,CAAC,CAAC,CAAC;QACrL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,kGAAkG,CACnG,CAAC;AAEF,8FAA8F;AAC9F,MAAM,OAAO,GAAG,yDAAyD,CAAC;AAE1E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAClD,yBAAyB,EACzB,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAY,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAY,CAAC;YACvC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC7F,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YAClF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAE,SAAS;YAC/G,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EACnH,mGAAmG,CAAC,CAAC,CAAC;QAC1G,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAY,CAAC;YACvC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxH,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,QAAQ,EAAE,wGAAwG,CAAC,CAAC,CAAC;YAC1L,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAW,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YAClG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7C,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC;gBAAE,SAAS;YACjD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACpH,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,gCAAgC,EAAE,QAAQ,EAAE,2FAA2F,CAAC,CAAC,CAAC;YAC9K,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,0CAA0C,CAC3C,CAAC;AAEF,8FAA8F;AAC9F,MAAM,QAAQ,GAAG,iEAAiE,CAAC;AACnF,MAAM,YAAY,GAA2B,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AAC5J,MAAM,cAAc,GAAG,2EAA2E,CAAC;AACnG,MAAM,SAAS,GAAG,0EAA0E,CAAC;AAE7F,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAC5C,mBAAmB,EACnB,CAAC,KAAK,EAAE,EAAE,CACR,YAAY,CACV,KAAK,CAAC,KAAK,EAAE,EACb,CAAC,CAAC,EAAE,EAAE;IACJ,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,IAAI,gDAAgD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,oEAAoE;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,EACD,yBAAyB,EACzB,yGAAyG,CAC1G,EACH,oDAAoD,CACrD,CAAC;AAEF,iGAAiG;AACjG,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAChD,uBAAuB,EACvB,CAAC,KAAK,EAAE,EAAE,CACR,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gEAAgE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EACxI,mBAAmB,EAAE,iHAAiH,CAAC,EAC3I,0CAA0C,CAC3C,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAC7C,oBAAoB,EACpB,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAG;QACV,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,uDAAuD,CAAC;QACvL,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,yFAAyF,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;KAC/N,CAAC;IACF,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,kDAAkD,CAAC,CAAC,CAAC;QAClK,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,gGAAgG,CAAC,CAAC,CAAC;QACtK,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,oEAAoE,CACrE,CAAC;AAEF,iGAAiG;AACjG,MAAM,OAAO,GAAG,oKAAoK,CAAC;AAErL,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAC7C,oBAAoB,EACpB,CAAC,KAAK,EAAE,EAAE,CACR,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,4DAA4D,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAC3K,uBAAuB,EAAE,mHAAmH,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EACxK,oCAAoC,CACrC,CAAC;AAEF,oGAAoG;AACpG,MAAM,OAAO,GAAG,sFAAsF,CAAC;AAEvG,MAAM,CAAC,MAAM,MAAM,GAAG,eAAe,CACnC,SAAS,EACT,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IACnB,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,aAAa,CAAe,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAY,CAAC,CAAC;QAClH,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC1E,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,wEAAwE,CAAC,CAAC,CAAC;YACzI,MAAM;QACR,CAAC;IACH,CAAC;IACD,qHAAqH;IACrH,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,8FAA8F,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC7O,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,kCAAkC,CACnC,CAAC;AAEF,wGAAwG;AACxG,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAC9C,qBAAqB,EACrB,CAAC,KAAK,EAAE,EAAE,CACR,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,8DAA8D,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EACtI,wBAAwB,EAAE,qGAAqG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAC3J,6CAA6C,CAC9C,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAC9C,qBAAqB,EACrB,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,YAAY,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,iDAAiD,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5M,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,kFAAkF,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/J,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,uHAAuH,CAAC,CAAC,CAAC;QACpM,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,2BAA2B;QAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAe,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,4DAA4D,CAAC,CAAC,CAAC;QACtI,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,gFAAgF,CACjF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAC5C,mBAAmB,EACnB,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,MAA2B,CAAC;QAChC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;aACtF,IAAI,IAAI,KAAK,UAAU,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1G,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,SAAS;QAClF,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAC9G,qIAAqI,CAAC,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,sCAAsC,CACvC,CAAC;AAEF,MAAM,QAAQ,GAAG,kJAAkJ,CAAC;AAEpK,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAC7C,qBAAqB,EACrB,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,SAAS;QAC3C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,IAAI,YAAY,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mEAAmE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACvI,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EACjE,IAAI,CAAC,CAAC,CAAC,+EAA+E,CAAC,CAAC,CAAC,uBAAuB,MAAM,wCAAwC,CAAC,CAAC,CAAC;gBACnK,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,EACD,kDAAkD,CACnD,CAAC;AAEF,mGAAmG;AACnG,MAAM,OAAO,GAAG,CAAC,KAAe,EAAE,IAAY,EAAE,IAAY,EAAE,GAAW,EAAiB,EAAE;IAC1F,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACzJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAG,eAAe,CACnC,aAAa,EACb,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,GAAG,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,yFAAyF,CAAC;IAClJ,GAAG,KAAK,CAAC,KAAK,EAAE;SACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,8BAA8B,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC;SACvH,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,sEAAsE,CAAC,CAAC;CACzJ,EACD,kDAAkD,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAC3C,aAAa,EACb,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,qCAAqC,EAAE,gBAAgB,EAAE,wDAAwD,CAAC,EAC5I,4CAA4C,CAC7C,CAAC;AAEF,sGAAsG;AACtG,SAAS,YAAY,CAAC,GAAW,EAAE,GAAgF;IACjH,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,yGAAyG;AACzG,SAAS,WAAW,CAAC,KAAe,EAAE,IAAY,EAAE,GAAW;IAC7D,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAChI,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0EAA0E;AAC1E,SAAS,gBAAgB,CAAC,KAAc;IACtC,mDAAmD;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACxF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAY,EAAE,CAAC;IAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAY,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE;IAClE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iFAAiF,EAAE,CAAC;IACnI,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IACxE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,mBAAmB,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,iFAAiF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1L,CAAC;IACD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,mBAAmB,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,4BAA4B,EAAE,QAAQ,EAAE,2EAA2E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9L,CAAC;IACD,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,KAAK,IAAI,EAAE,CAAC;IAC1F,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,sCAAsC,KAAK,2EAA2E,EAAE,CAAC;AAC9J,CAAC,CAAC,CAAC;AAEH,SAAS,kBAAkB,CAAC,GAAW,EAAE,MAAc,EAAE,KAAa,EAAE,GAAW;IACjF,OAAO,YAAY,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,6BAA6B,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,MAAM,4BAA4B,KAAK,kCAAkC,EAAE,CAAC;QAClJ,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,IAAI,OAAO,KAAK,KAAK,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YAC9C,OAAO,mBAAmB,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,GAAG,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnI,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,KAAK,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3H,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,sDAAsD,KAAK,kCAAkC,EAAE,CAAC;IAC7I,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,+BAA+B,EAAE,QAAQ,EAAE,iBAAiB,EAAE,iEAAiE,CAAC,CAAC;AACxL,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,iCAAiC,EAAE,WAAW,EAAE,UAAU,EAAE,sEAAsE,CAAC,CAAC;AAE7L,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEpC,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE;IACnF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,6BAA6B,EAAE,UAAU,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,wEAAwE,EAAE,CAAC;IAC1H,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IACtB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjM,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,4CAA4C,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,kCAAkC,EAAE,CAAC;IACnM,IAAI,OAAO,GAAG,mBAAmB,EAAE,CAAC;QAClC,OAAO,mBAAmB,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EACnG,2BAA2B,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,+DAA+D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9H,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yBAAyB,OAAO,yBAAyB,EAAE,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE;IAChE,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,4DAA4D;QAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAe,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtP,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,2GAA2G,CAAC,CAAC,CAAC;QACnL,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,MAAM,CAAC,MAAM,uBAAuB,SAAS,CAAC,MAAM,CAAC,sBAAsB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC/K,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,qFAAqF,EAAE,CAAC;AAC3H,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC,yBAAyB,EAAE,CAAC,KAAK,EAAE,EAAE;IACpF,IAAI,KAAK,CAAC,QAAQ,CAAC,0DAA0D,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sHAAsH,EAAE,CAAC;IAC5J,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,0GAA0G,EAAE,CAAC;AAClJ,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC,gCAAgC,EAAE,CAAC,KAAK,EAAE,EAAE;IAC3F,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oDAAoD,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACtH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,uHAAuH,EAAE,CAAC;IACxL,IAAI,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0EAA0E,EAAE,CAAC;IACtJ,OAAO,mBAAmB,CACxB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,6BAA6B,EAAE,QAAQ,EAAE,4HAA4H,CAAC,CAAC,EACxN,EAAE,CACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,KAAe,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,4CAA4C,CAAC,CAAC;AACzG,MAAM,UAAU,GAAG,CAAC,CAAS,EAAgB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oCAAoC,CAAC,eAAe,EAAE,CAAC,CAAC;AAEnI,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAC/E,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;IAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,8DAA8D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7F,IAAI,UAAU,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7H,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAC7E,qLAAqL,CAAC,CAAC,CAAC;QAC5L,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAQ,EAAE,0DAA0D,CAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAC/E,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;IAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,QAAQ,CAAC,yDAAyD,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IACrL,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,uIAAuI,EAAE,CAAC;AAC/K,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAC/E,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;IAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,QAAQ,CAAC,+FAA+F,CAAC,EAAE,CAAC;QACpH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,wFAAwF,EAAE,CAAC;IAC9H,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,yIAAyI,EAAE,CAAC;AACjL,CAAC,CAAC,CAAC"}

package/dist/code/checks/secrets.d.ts

@@ -0,0 +1,10 @@
+export declare const SECRET_ASSIGN: RegExp;
+export declare const SECRET_DICT_KEY: RegExp;
+export declare const looksSecret: (value: string | undefined) => value is string;
+/** #6 Hard-coded secrets (Django SECRET_KEY, credentials in code). Snippets are redacted. */
+export declare const hardcodedSecrets: import("../types.js").CodeCheck;
+/** #34 Plaintext password storage or retrieval. */
+export declare const plaintextPasswords: import("../types.js").CodeCheck;
+/** #77 Secrets/tokens written to logs. */
+export declare const secretsInLogs: import("../types.js").CodeCheck;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/code/checks/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../src/code/checks/secrets.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,aAAa,QAA0F,CAAC;AACrH,eAAO,MAAM,eAAe,QAAuF,CAAC;AAMpH,eAAO,MAAM,WAAW,UAAW,MAAM,GAAG,SAAS,KAAG,KAAK,IAAI,MAC8B,CAAC;AAEhG,6FAA6F;AAC7F,eAAO,MAAM,gBAAgB,iCA2C5B,CAAC;AAKF,mDAAmD;AACnD,eAAO,MAAM,kBAAkB,iCA6C9B,CAAC;AAMF,0CAA0C;AAC1C,eAAO,MAAM,aAAa,iCA+BzB,CAAC"}