kirograph 0.17.0 → 0.20.0

package/dist/security/attack-surface.js

@@ -0,0 +1,206 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var attack_surface_exports = {};
+__export(attack_surface_exports, {
+  AttackSurfaceAnalyzer: () => AttackSurfaceAnalyzer
+});
+module.exports = __toCommonJS(attack_surface_exports);
+const AUTH_PATTERNS = [
+  "auth",
+  "authenticate",
+  "middleware",
+  "guard",
+  "protect",
+  "requirelogin",
+  "isloggedin",
+  "verifytoken",
+  "checkauth",
+  "ensureauth"
+];
+const PUBLIC_ROUTE_PATTERNS = ["/api/", "/v1/", "/v2/", "/v3/", "/graphql", "/rest/"];
+const INTERNAL_ROUTE_PATTERNS = ["/internal/", "/admin/"];
+class AttackSurfaceAnalyzer {
+  constructor(db) {
+    this.db = db;
+  }
+  async analyze() {
+    const rawDb = this.db.getRawDb();
+    const routeRows = rawDb.all(
+      `SELECT id, name, file_path FROM nodes WHERE kind = 'route'`
+    );
+    if (routeRows.length === 0) {
+      return {
+        totalRoutes: 0,
+        publicRoutes: 0,
+        authenticatedRoutes: 0,
+        routesWithVulns: 0,
+        criticalPaths: [],
+        allRoutes: []
+      };
+    }
+    const entries = [];
+    for (const route of routeRows) {
+      const reachableDeps = rawDb.all(
+        `WITH RECURSIVE reachable(node_id, depth) AS (
+           SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')
+           UNION
+           SELECT e.target, r.depth + 1
+           FROM edges e
+           JOIN reachable r ON e.source = r.node_id
+           WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')
+         )
+         SELECT d.node_id, d.package_name, MIN(r.depth) as hop_count
+         FROM reachable r
+         JOIN sec_dependencies d ON d.node_id = r.node_id
+         GROUP BY d.node_id, d.package_name`,
+        [route.id]
+      );
+      const vulnerableDeps = [];
+      for (const dep of reachableDeps) {
+        const vulnRows = rawDb.all(
+          `SELECT v.cve_id, d.package_name, v.severity_score, v.epss_score, v.risk_score, r.verdict
+           FROM sec_vulnerabilities v
+           JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'
+           JOIN sec_dependencies d ON d.node_id = e.source
+           LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id
+           WHERE d.node_id = ?
+             AND (r.verdict IN ('affected', 'under_investigation') OR r.verdict IS NULL)`,
+          [dep.node_id]
+        );
+        for (const vuln of vulnRows) {
+          vulnerableDeps.push({
+            cveId: vuln.cve_id,
+            packageName: vuln.package_name ?? dep.package_name,
+            severity: vuln.severity_score,
+            epssScore: vuln.epss_score,
+            riskScore: vuln.risk_score,
+            verdict: vuln.verdict,
+            hopCount: dep.hop_count
+          });
+        }
+      }
+      const routeNodeId = route.id;
+      let patternRows = [];
+      try {
+        patternRows = rawDb.all(
+          `WITH RECURSIVE reachable(node_id, depth) AS (
+             SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')
+             UNION
+             SELECT e.target, r.depth + 1
+             FROM edges e
+             JOIN reachable r ON e.source = r.node_id
+             WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')
+           )
+           SELECT DISTINCT pm.symbol_node_id, n.name as symbol_name, pm.pattern_id, pm.severity, pm.line
+           FROM reachable r
+           JOIN pattern_matches pm ON pm.symbol_node_id = r.node_id
+           JOIN nodes n ON n.id = pm.symbol_node_id
+           WHERE pm.symbol_node_id IS NOT NULL
+           ORDER BY CASE pm.severity WHEN 'critical' THEN 4 WHEN 'high' THEN 3 WHEN 'medium' THEN 2 ELSE 1 END DESC
+           LIMIT 10`,
+          [routeNodeId]
+        );
+      } catch {
+        patternRows = [];
+      }
+      const patternMatches = patternRows.map((r) => ({
+        patternId: r.pattern_id,
+        severity: r.severity,
+        line: r.line,
+        symbolNodeId: r.symbol_node_id,
+        symbolName: r.symbol_name
+      }));
+      const patternRiskLevel = patternMatches.length === 0 ? "none" : patternMatches[0].severity;
+      const pathNodeNames = rawDb.all(
+        `WITH RECURSIVE reachable(node_id, depth) AS (
+           SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')
+           UNION
+           SELECT e.target, r.depth + 1
+           FROM edges e
+           JOIN reachable r ON e.source = r.node_id
+           WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')
+         )
+         SELECT DISTINCT n.name
+         FROM reachable r
+         JOIN nodes n ON n.id = r.node_id
+         WHERE n.name IS NOT NULL`,
+        [route.id]
+      );
+      const isAuthenticated = pathNodeNames.some((row) => {
+        const lowerName = (row.name ?? "").toLowerCase();
+        return AUTH_PATTERNS.some((pattern) => lowerName.includes(pattern));
+      });
+      const routeName = (route.name ?? "").toLowerCase();
+      let exposureLevel;
+      if (INTERNAL_ROUTE_PATTERNS.some((p) => routeName.includes(p))) {
+        exposureLevel = "internal";
+      } else if (isAuthenticated) {
+        exposureLevel = "authenticated";
+      } else if (PUBLIC_ROUTE_PATTERNS.some((p) => routeName.includes(p))) {
+        exposureLevel = "public";
+      } else {
+        exposureLevel = "unknown";
+      }
+      const affectedVulns = vulnerableDeps.filter((v) => v.verdict === "affected" || v.verdict === "under_investigation");
+      const baseRiskScore = affectedVulns.reduce((max, v) => {
+        if (v.riskScore != null && v.riskScore > max) return v.riskScore;
+        return max;
+      }, 0);
+      const patternBonus = {
+        none: 0,
+        low: 0.3,
+        medium: 0.6,
+        high: 0.8,
+        critical: 1
+      };
+      const riskScore = Math.min(10, baseRiskScore + (patternBonus[patternRiskLevel] ?? 0));
+      entries.push({
+        route: route.name ?? route.id,
+        nodeId: route.id,
+        filePath: route.file_path ?? "",
+        isAuthenticated,
+        exposureLevel,
+        vulnerableDeps,
+        patternMatches,
+        patternRiskLevel,
+        riskScore
+      });
+    }
+    const publicRoutes = entries.filter((e) => e.exposureLevel === "public").length;
+    const authenticatedRoutes = entries.filter(
+      (e) => e.exposureLevel === "authenticated" || e.exposureLevel === "internal"
+    ).length;
+    const routesWithVulns = entries.filter((e) => e.vulnerableDeps.length > 0).length;
+    const criticalPaths = entries.filter((e) => e.vulnerableDeps.length > 0).sort((a, b) => b.riskScore - a.riskScore);
+    const allRoutes = entries.sort((a, b) => b.riskScore - a.riskScore);
+    return {
+      totalRoutes: entries.length,
+      publicRoutes,
+      authenticatedRoutes,
+      routesWithVulns,
+      criticalPaths,
+      allRoutes
+    };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AttackSurfaceAnalyzer
+});
+//# sourceMappingURL=attack-surface.js.map

package/dist/security/attack-surface.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/attack-surface.ts"],
+  "sourcesContent": ["/**\n * KiroGraph-Sec Attack Surface Analyzer\n *\n * Maps all route nodes in the knowledge graph to their reachable vulnerable\n * dependencies, computing exposure levels and risk scores per route.\n */\n\nimport type { GraphDatabase } from '../db/database';\n\n/** Auth-related name patterns for heuristic isAuthenticated detection. */\nconst AUTH_PATTERNS = [\n  'auth',\n  'authenticate',\n  'middleware',\n  'guard',\n  'protect',\n  'requirelogin',\n  'isloggedin',\n  'verifytoken',\n  'checkauth',\n  'ensureauth',\n] as const;\n\n/** Route path patterns that indicate a public-facing API. */\nconst PUBLIC_ROUTE_PATTERNS = ['/api/', '/v1/', '/v2/', '/v3/', '/graphql', '/rest/'];\n\n/** Route path patterns that indicate an internal/admin route. */\nconst INTERNAL_ROUTE_PATTERNS = ['/internal/', '/admin/'];\n\nexport interface AttackSurfaceEntry {\n  route: string;\n  nodeId: string;\n  filePath: string;\n  isAuthenticated: boolean;\n  exposureLevel: 'public' | 'authenticated' | 'internal' | 'unknown';\n  vulnerableDeps: Array<{\n    cveId: string;\n    packageName: string;\n    severity: number | null;\n    epssScore: number | null;\n    riskScore: number | null;\n    verdict: string | null;\n    hopCount: number;\n  }>;\n  patternMatches: Array<{\n    patternId: string;\n    severity: string;\n    line: number;\n    symbolNodeId: string;\n    symbolName: string;\n  }>;\n  patternRiskLevel: 'none' | 'low' | 'medium' | 'high' | 'critical';\n  riskScore: number;\n}\n\nexport interface AttackSurfaceResult {\n  totalRoutes: number;\n  publicRoutes: number;\n  authenticatedRoutes: number;\n  routesWithVulns: number;\n  criticalPaths: AttackSurfaceEntry[];\n  allRoutes: AttackSurfaceEntry[];\n}\n\nexport class AttackSurfaceAnalyzer {\n  constructor(private readonly db: GraphDatabase) {}\n\n  async analyze(): Promise<AttackSurfaceResult> {\n    const rawDb = this.db.getRawDb();\n\n    // Step 1: Query all route nodes\n    const routeRows: Array<{ id: string; name: string; file_path: string }> = rawDb.all(\n      `SELECT id, name, file_path FROM nodes WHERE kind = 'route'`,\n    );\n\n    if (routeRows.length === 0) {\n      return {\n        totalRoutes: 0,\n        publicRoutes: 0,\n        authenticatedRoutes: 0,\n        routesWithVulns: 0,\n        criticalPaths: [],\n        allRoutes: [],\n      };\n    }\n\n    const entries: AttackSurfaceEntry[] = [];\n\n    for (const route of routeRows) {\n      // Step 2: BFS via SQL to find reachable dependency nodes (max 5 hops)\n      const reachableDeps: Array<{\n        node_id: string;\n        package_name: string;\n        hop_count: number;\n      }> = rawDb.all(\n        `WITH RECURSIVE reachable(node_id, depth) AS (\n           SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')\n           UNION\n           SELECT e.target, r.depth + 1\n           FROM edges e\n           JOIN reachable r ON e.source = r.node_id\n           WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')\n         )\n         SELECT d.node_id, d.package_name, MIN(r.depth) as hop_count\n         FROM reachable r\n         JOIN sec_dependencies d ON d.node_id = r.node_id\n         GROUP BY d.node_id, d.package_name`,\n        [route.id],\n      );\n\n      // Step 3: For each reachable dep, find affected/under_investigation vulns\n      const vulnerableDeps: AttackSurfaceEntry['vulnerableDeps'] = [];\n\n      for (const dep of reachableDeps) {\n        const vulnRows: Array<{\n          cve_id: string;\n          package_name: string;\n          severity_score: number | null;\n          epss_score: number | null;\n          risk_score: number | null;\n          verdict: string | null;\n        }> = rawDb.all(\n          `SELECT v.cve_id, d.package_name, v.severity_score, v.epss_score, v.risk_score, r.verdict\n           FROM sec_vulnerabilities v\n           JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n           JOIN sec_dependencies d ON d.node_id = e.source\n           LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id\n           WHERE d.node_id = ?\n             AND (r.verdict IN ('affected', 'under_investigation') OR r.verdict IS NULL)`,\n          [dep.node_id],\n        );\n\n        for (const vuln of vulnRows) {\n          vulnerableDeps.push({\n            cveId: vuln.cve_id,\n            packageName: vuln.package_name ?? dep.package_name,\n            severity: vuln.severity_score,\n            epssScore: vuln.epss_score,\n            riskScore: vuln.risk_score,\n            verdict: vuln.verdict,\n            hopCount: dep.hop_count,\n          });\n        }\n      }\n\n      // Step 3b: Find pattern matches on the call path (table may not exist)\n      const routeNodeId = route.id;\n      let patternRows: Array<{\n        symbol_node_id: string;\n        symbol_name: string;\n        pattern_id: string;\n        severity: string;\n        line: number;\n      }> = [];\n      try {\n        patternRows = rawDb.all(\n          `WITH RECURSIVE reachable(node_id, depth) AS (\n             SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')\n             UNION\n             SELECT e.target, r.depth + 1\n             FROM edges e\n             JOIN reachable r ON e.source = r.node_id\n             WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')\n           )\n           SELECT DISTINCT pm.symbol_node_id, n.name as symbol_name, pm.pattern_id, pm.severity, pm.line\n           FROM reachable r\n           JOIN pattern_matches pm ON pm.symbol_node_id = r.node_id\n           JOIN nodes n ON n.id = pm.symbol_node_id\n           WHERE pm.symbol_node_id IS NOT NULL\n           ORDER BY CASE pm.severity WHEN 'critical' THEN 4 WHEN 'high' THEN 3 WHEN 'medium' THEN 2 ELSE 1 END DESC\n           LIMIT 10`,\n          [routeNodeId],\n        );\n      } catch {\n        // pattern_matches table does not exist yet \u2014 degrade silently\n        patternRows = [];\n      }\n\n      const patternMatches: AttackSurfaceEntry['patternMatches'] = patternRows.map(r => ({\n        patternId: r.pattern_id,\n        severity: r.severity,\n        line: r.line,\n        symbolNodeId: r.symbol_node_id,\n        symbolName: r.symbol_name,\n      }));\n\n      const patternRiskLevel: AttackSurfaceEntry['patternRiskLevel'] =\n        patternMatches.length === 0\n          ? 'none'\n          : (patternMatches[0].severity as AttackSurfaceEntry['patternRiskLevel']);\n\n      // Step 4: Heuristic \u2014 isAuthenticated via path node names\n      const pathNodeNames: Array<{ name: string }> = rawDb.all(\n        `WITH RECURSIVE reachable(node_id, depth) AS (\n           SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')\n           UNION\n           SELECT e.target, r.depth + 1\n           FROM edges e\n           JOIN reachable r ON e.source = r.node_id\n           WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')\n         )\n         SELECT DISTINCT n.name\n         FROM reachable r\n         JOIN nodes n ON n.id = r.node_id\n         WHERE n.name IS NOT NULL`,\n        [route.id],\n      );\n\n      const isAuthenticated = pathNodeNames.some(row => {\n        const lowerName = (row.name ?? '').toLowerCase();\n        return AUTH_PATTERNS.some(pattern => lowerName.includes(pattern));\n      });\n\n      // Step 5: Determine exposure level\n      const routeName = (route.name ?? '').toLowerCase();\n      let exposureLevel: AttackSurfaceEntry['exposureLevel'];\n\n      if (INTERNAL_ROUTE_PATTERNS.some(p => routeName.includes(p))) {\n        exposureLevel = 'internal';\n      } else if (isAuthenticated) {\n        exposureLevel = 'authenticated';\n      } else if (PUBLIC_ROUTE_PATTERNS.some(p => routeName.includes(p))) {\n        exposureLevel = 'public';\n      } else {\n        exposureLevel = 'unknown';\n      }\n\n      // Step 6: riskScore = max risk_score of reachable affected vulns, plus pattern bonus\n      const affectedVulns = vulnerableDeps.filter(v => v.verdict === 'affected' || v.verdict === 'under_investigation');\n      const baseRiskScore = affectedVulns.reduce((max, v) => {\n        if (v.riskScore != null && v.riskScore > max) return v.riskScore;\n        return max;\n      }, 0);\n\n      const patternBonus: Record<AttackSurfaceEntry['patternRiskLevel'], number> = {\n        none: 0, low: 0.3, medium: 0.6, high: 0.8, critical: 1.0,\n      };\n      const riskScore = Math.min(10, baseRiskScore + (patternBonus[patternRiskLevel] ?? 0));\n\n      entries.push({\n        route: route.name ?? route.id,\n        nodeId: route.id,\n        filePath: route.file_path ?? '',\n        isAuthenticated,\n        exposureLevel,\n        vulnerableDeps,\n        patternMatches,\n        patternRiskLevel,\n        riskScore,\n      });\n    }\n\n    // Compute summary stats\n    const publicRoutes = entries.filter(e => e.exposureLevel === 'public').length;\n    const authenticatedRoutes = entries.filter(\n      e => e.exposureLevel === 'authenticated' || e.exposureLevel === 'internal',\n    ).length;\n    const routesWithVulns = entries.filter(e => e.vulnerableDeps.length > 0).length;\n\n    // Critical paths: routes with affected/under_investigation vulns, sorted by riskScore desc\n    const criticalPaths = entries\n      .filter(e => e.vulnerableDeps.length > 0)\n      .sort((a, b) => b.riskScore - a.riskScore);\n\n    const allRoutes = entries.sort((a, b) => b.riskScore - a.riskScore);\n\n    return {\n      totalRoutes: entries.length,\n      publicRoutes,\n      authenticatedRoutes,\n      routesWithVulns,\n      criticalPaths,\n      allRoutes,\n    };\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,MAAM,gBAAgB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,MAAM,wBAAwB,CAAC,SAAS,QAAQ,QAAQ,QAAQ,YAAY,QAAQ;AAGpF,MAAM,0BAA0B,CAAC,cAAc,SAAS;AAqCjD,MAAM,sBAAsB;AAAA,EACjC,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,UAAwC;AAC5C,UAAM,QAAQ,KAAK,GAAG,SAAS;AAG/B,UAAM,YAAoE,MAAM;AAAA,MAC9E;AAAA,IACF;AAEA,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO;AAAA,QACL,aAAa;AAAA,QACb,cAAc;AAAA,QACd,qBAAqB;AAAA,QACrB,iBAAiB;AAAA,QACjB,eAAe,CAAC;AAAA,QAChB,WAAW,CAAC;AAAA,MACd;AAAA,IACF;AAEA,UAAM,UAAgC,CAAC;AAEvC,eAAW,SAAS,WAAW;AAE7B,YAAM,gBAID,MAAM;AAAA,QACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYA,CAAC,MAAM,EAAE;AAAA,MACX;AAGA,YAAM,iBAAuD,CAAC;AAE9D,iBAAW,OAAO,eAAe;AAC/B,cAAM,WAOD,MAAM;AAAA,UACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAOA,CAAC,IAAI,OAAO;AAAA,QACd;AAEA,mBAAW,QAAQ,UAAU;AAC3B,yBAAe,KAAK;AAAA,YAClB,OAAO,KAAK;AAAA,YACZ,aAAa,KAAK,gBAAgB,IAAI;AAAA,YACtC,UAAU,KAAK;AAAA,YACf,WAAW,KAAK;AAAA,YAChB,WAAW,KAAK;AAAA,YAChB,SAAS,KAAK;AAAA,YACd,UAAU,IAAI;AAAA,UAChB,CAAC;AAAA,QACH;AAAA,MACF;AAGA,YAAM,cAAc,MAAM;AAC1B,UAAI,cAMC,CAAC;AACN,UAAI;AACF,sBAAc,MAAM;AAAA,UAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAeA,CAAC,WAAW;AAAA,QACd;AAAA,MACF,QAAQ;AAEN,sBAAc,CAAC;AAAA,MACjB;AAEA,YAAM,iBAAuD,YAAY,IAAI,QAAM;AAAA,QACjF,WAAW,EAAE;AAAA,QACb,UAAU,EAAE;AAAA,QACZ,MAAM,EAAE;AAAA,QACR,cAAc,EAAE;AAAA,QAChB,YAAY,EAAE;AAAA,MAChB,EAAE;AAEF,YAAM,mBACJ,eAAe,WAAW,IACtB,SACC,eAAe,CAAC,EAAE;AAGzB,YAAM,gBAAyC,MAAM;AAAA,QACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYA,CAAC,MAAM,EAAE;AAAA,MACX;AAEA,YAAM,kBAAkB,cAAc,KAAK,SAAO;AAChD,cAAM,aAAa,IAAI,QAAQ,IAAI,YAAY;AAC/C,eAAO,cAAc,KAAK,aAAW,UAAU,SAAS,OAAO,CAAC;AAAA,MAClE,CAAC;AAGD,YAAM,aAAa,MAAM,QAAQ,IAAI,YAAY;AACjD,UAAI;AAEJ,UAAI,wBAAwB,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC5D,wBAAgB;AAAA,MAClB,WAAW,iBAAiB;AAC1B,wBAAgB;AAAA,MAClB,WAAW,sBAAsB,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AACjE,wBAAgB;AAAA,MAClB,OAAO;AACL,wBAAgB;AAAA,MAClB;AAGA,YAAM,gBAAgB,eAAe,OAAO,OAAK,EAAE,YAAY,cAAc,EAAE,YAAY,qBAAqB;AAChH,YAAM,gBAAgB,cAAc,OAAO,CAAC,KAAK,MAAM;AACrD,YAAI,EAAE,aAAa,QAAQ,EAAE,YAAY,IAAK,QAAO,EAAE;AACvD,eAAO;AAAA,MACT,GAAG,CAAC;AAEJ,YAAM,eAAuE;AAAA,QAC3E,MAAM;AAAA,QAAG,KAAK;AAAA,QAAK,QAAQ;AAAA,QAAK,MAAM;AAAA,QAAK,UAAU;AAAA,MACvD;AACA,YAAM,YAAY,KAAK,IAAI,IAAI,iBAAiB,aAAa,gBAAgB,KAAK,EAAE;AAEpF,cAAQ,KAAK;AAAA,QACX,OAAO,MAAM,QAAQ,MAAM;AAAA,QAC3B,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM,aAAa;AAAA,QAC7B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAGA,UAAM,eAAe,QAAQ,OAAO,OAAK,EAAE,kBAAkB,QAAQ,EAAE;AACvE,UAAM,sBAAsB,QAAQ;AAAA,MAClC,OAAK,EAAE,kBAAkB,mBAAmB,EAAE,kBAAkB;AAAA,IAClE,EAAE;AACF,UAAM,kBAAkB,QAAQ,OAAO,OAAK,EAAE,eAAe,SAAS,CAAC,EAAE;AAGzE,UAAM,gBAAgB,QACnB,OAAO,OAAK,EAAE,eAAe,SAAS,CAAC,EACvC,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;AAE3C,UAAM,YAAY,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;AAElE,WAAO;AAAA,MACL,aAAa,QAAQ;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/security/context-warnings.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Security Context Warnings
+ *
+ * Queries pre-computed reachability data to find vulnerabilities
+ * reachable from symbols included in a context response.
+ * Used by kirograph_context to append security warnings.
+ */
+export interface SecurityWarning {
+    cveId: string;
+    severityScore: number | null;
+    epssScore: number | null;
+    epssPercentile: number | null;
+    packageName: string;
+    ecosystem: string;
+    fixedVersion: string | null;
+    entryPoints: string[];
+}
+/**
+ * Query the pre-computed reachability data to find vulnerabilities
+ * reachable from the given node IDs.
+ *
+ * This is a lightweight query joining sec_reachability + sec_vulnerabilities + sec_dependencies
+ * where the reachability paths include any of the context nodes. No graph traversal needed
+ * since reachability is pre-computed by the SecurityPipeline.
+ *
+ * @param rawDb - The raw SQLite database handle
+ * @param nodeIds - Node IDs from the context response (entry points + related symbols)
+ * @returns Array of SecurityWarning objects for affected vulnerabilities
+ */
+export declare function getSecurityWarningsForNodes(rawDb: any, nodeIds: string[]): SecurityWarning[];
+/**
+ * Format security warnings into a text section for the context output.
+ * Shows max 3 vulnerabilities with a note about remaining ones.
+ *
+ * @param warnings - Array of SecurityWarning objects
+ * @param nodeNames - Map of node IDs to human-readable names (for entry point display)
+ * @returns Formatted string section, or empty string if no warnings
+ */
+export declare function formatSecurityWarnings(warnings: SecurityWarning[], nodeNames: Map<string, string>): string;
+//# sourceMappingURL=context-warnings.d.ts.map

package/dist/security/context-warnings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-warnings.d.ts","sourceRoot":"","sources":["../../src/security/context-warnings.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,eAAe,EAAE,CA6F5F;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAmC1G"}

package/dist/security/context-warnings.js

@@ -0,0 +1,123 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var context_warnings_exports = {};
+__export(context_warnings_exports, {
+  formatSecurityWarnings: () => formatSecurityWarnings,
+  getSecurityWarningsForNodes: () => getSecurityWarningsForNodes
+});
+module.exports = __toCommonJS(context_warnings_exports);
+var import_fix_suggestions = require("./export/fix-suggestions");
+function getSecurityWarningsForNodes(rawDb, nodeIds) {
+  if (nodeIds.length === 0) return [];
+  try {
+    const rows = rawDb.all(`
+      SELECT DISTINCT
+        v.cve_id,
+        v.severity_score,
+        v.epss_score,
+        v.epss_percentile,
+        v.fixed_version,
+        d.package_name,
+        d.ecosystem,
+        r.paths
+      FROM sec_reachability r
+      JOIN sec_vulnerabilities v ON v.node_id = r.vulnerability_node_id
+      JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'
+      JOIN sec_dependencies d ON d.node_id = e.source
+      WHERE r.verdict = 'affected'
+      ORDER BY v.epss_score DESC NULLS LAST, v.severity_score DESC NULLS LAST
+    `);
+    if (!rows || rows.length === 0) return [];
+    const nodeIdSet = new Set(nodeIds);
+    const warnings = [];
+    for (const row of rows) {
+      let paths = [];
+      try {
+        if (row.paths) {
+          paths = JSON.parse(row.paths);
+        }
+      } catch {
+        continue;
+      }
+      const matchingEntryPoints = [];
+      for (const p of paths) {
+        if (nodeIdSet.has(p.entryPoint)) {
+          matchingEntryPoints.push(p.entryPoint);
+          continue;
+        }
+        if (p.path && p.path.some((nodeId) => nodeIdSet.has(nodeId))) {
+          matchingEntryPoints.push(p.entryPoint);
+        }
+      }
+      if (matchingEntryPoints.length > 0) {
+        warnings.push({
+          cveId: row.cve_id,
+          severityScore: row.severity_score,
+          epssScore: row.epss_score,
+          epssPercentile: row.epss_percentile,
+          packageName: row.package_name,
+          ecosystem: row.ecosystem,
+          fixedVersion: row.fixed_version,
+          entryPoints: [...new Set(matchingEntryPoints)]
+        });
+      }
+    }
+    warnings.sort((a, b) => {
+      const epssA = a.epssScore ?? 0;
+      const epssB = b.epssScore ?? 0;
+      if (epssA !== epssB) return epssB - epssA;
+      return (b.severityScore ?? 0) - (a.severityScore ?? 0);
+    });
+    return warnings;
+  } catch {
+    return [];
+  }
+}
+function formatSecurityWarnings(warnings, nodeNames) {
+  if (warnings.length === 0) return "";
+  const MAX_SHOWN = 3;
+  const lines = ["", "## \u26A0 Security"];
+  const shown = warnings.slice(0, MAX_SHOWN);
+  for (const w of shown) {
+    const scoreParts = [];
+    if (w.severityScore !== null) scoreParts.push(`CVSS ${w.severityScore.toFixed(1)}`);
+    if (w.epssScore !== null) {
+      const pct = w.epssPercentile !== null ? ` / ${Math.round(w.epssPercentile * 100)}th%` : "";
+      scoreParts.push(`EPSS ${w.epssScore.toFixed(2)}${pct}`);
+    }
+    const scores = scoreParts.length > 0 ? ` (${scoreParts.join(", ")})` : "";
+    const entryPointNames = w.entryPoints.map((id) => nodeNames.get(id) ?? id).slice(0, 3);
+    const entryPointStr = entryPointNames.length > 0 ? ` \u2014 reaches via: ${entryPointNames.join(", ")}` : "";
+    lines.push(`- **${w.cveId}**${scores}: ${w.packageName} (${w.ecosystem})${entryPointStr}`);
+    const fix = (0, import_fix_suggestions.formatFixSuggestion)(w.ecosystem, w.packageName, w.fixedVersion);
+    if (fix) lines.push(`  ${fix}`);
+  }
+  if (warnings.length > MAX_SHOWN) {
+    const remaining = warnings.length - MAX_SHOWN;
+    lines.push(`
+${remaining} more \u2014 use kirograph_vulns for full list`);
+  }
+  return lines.join("\n");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  formatSecurityWarnings,
+  getSecurityWarningsForNodes
+});
+//# sourceMappingURL=context-warnings.js.map

package/dist/security/context-warnings.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/context-warnings.ts"],
+  "sourcesContent": ["/**\n * Security Context Warnings\n *\n * Queries pre-computed reachability data to find vulnerabilities\n * reachable from symbols included in a context response.\n * Used by kirograph_context to append security warnings.\n */\n\nimport { formatFixSuggestion } from './export/fix-suggestions';\n\nexport interface SecurityWarning {\n  cveId: string;\n  severityScore: number | null;\n  epssScore: number | null;      // exploitation probability 0.0\u20131.0\n  epssPercentile: number | null; // percentile rank among all CVEs\n  packageName: string;\n  ecosystem: string;\n  fixedVersion: string | null;\n  entryPoints: string[]; // node IDs of entry points that reach this vulnerability\n}\n\n/**\n * Query the pre-computed reachability data to find vulnerabilities\n * reachable from the given node IDs.\n *\n * This is a lightweight query joining sec_reachability + sec_vulnerabilities + sec_dependencies\n * where the reachability paths include any of the context nodes. No graph traversal needed\n * since reachability is pre-computed by the SecurityPipeline.\n *\n * @param rawDb - The raw SQLite database handle\n * @param nodeIds - Node IDs from the context response (entry points + related symbols)\n * @returns Array of SecurityWarning objects for affected vulnerabilities\n */\nexport function getSecurityWarningsForNodes(rawDb: any, nodeIds: string[]): SecurityWarning[] {\n  if (nodeIds.length === 0) return [];\n\n  try {\n    // Query: find vulnerabilities with verdict 'affected' whose reachability paths\n    // include any of the context node IDs.\n    // The sec_reachability.paths field is a JSON array of ReachabilityPath objects,\n    // each with an entryPoint and path array. We check if any entry point or path node\n    // matches our context nodes.\n    const rows = rawDb.all(`\n      SELECT DISTINCT\n        v.cve_id,\n        v.severity_score,\n        v.epss_score,\n        v.epss_percentile,\n        v.fixed_version,\n        d.package_name,\n        d.ecosystem,\n        r.paths\n      FROM sec_reachability r\n      JOIN sec_vulnerabilities v ON v.node_id = r.vulnerability_node_id\n      JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n      JOIN sec_dependencies d ON d.node_id = e.source\n      WHERE r.verdict = 'affected'\n      ORDER BY v.epss_score DESC NULLS LAST, v.severity_score DESC NULLS LAST\n    `) as Array<{\n      cve_id: string;\n      severity_score: number | null;\n      epss_score: number | null;\n      epss_percentile: number | null;\n      fixed_version: string | null;\n      package_name: string;\n      ecosystem: string;\n      paths: string | null;\n    }>;\n\n    if (!rows || rows.length === 0) return [];\n\n    const nodeIdSet = new Set(nodeIds);\n    const warnings: SecurityWarning[] = [];\n\n    for (const row of rows) {\n      // Parse the paths JSON to check if any context node is on a reachable path\n      let paths: Array<{ entryPoint: string; path: string[] }> = [];\n      try {\n        if (row.paths) {\n          paths = JSON.parse(row.paths);\n        }\n      } catch {\n        continue;\n      }\n\n      // Find entry points from our context that reach this vulnerability\n      const matchingEntryPoints: string[] = [];\n      for (const p of paths) {\n        // Check if the entry point is in our context nodes\n        if (nodeIdSet.has(p.entryPoint)) {\n          matchingEntryPoints.push(p.entryPoint);\n          continue;\n        }\n        // Check if any node on the path is in our context nodes\n        if (p.path && p.path.some(nodeId => nodeIdSet.has(nodeId))) {\n          matchingEntryPoints.push(p.entryPoint);\n        }\n      }\n\n      if (matchingEntryPoints.length > 0) {\n        warnings.push({\n          cveId: row.cve_id,\n          severityScore: row.severity_score,\n          epssScore: row.epss_score,\n          epssPercentile: row.epss_percentile,\n          packageName: row.package_name,\n          ecosystem: row.ecosystem,\n          fixedVersion: row.fixed_version,\n          entryPoints: [...new Set(matchingEntryPoints)],\n        });\n      }\n    }\n\n    // Sort by risk: EPSS first (actual exploitation probability), then CVSS severity\n    warnings.sort((a, b) => {\n      const epssA = a.epssScore ?? 0;\n      const epssB = b.epssScore ?? 0;\n      if (epssA !== epssB) return epssB - epssA;\n      return (b.severityScore ?? 0) - (a.severityScore ?? 0);\n    });\n\n    return warnings;\n  } catch {\n    // Security warnings are non-critical \u2014 don't fail context on query errors\n    return [];\n  }\n}\n\n/**\n * Format security warnings into a text section for the context output.\n * Shows max 3 vulnerabilities with a note about remaining ones.\n *\n * @param warnings - Array of SecurityWarning objects\n * @param nodeNames - Map of node IDs to human-readable names (for entry point display)\n * @returns Formatted string section, or empty string if no warnings\n */\nexport function formatSecurityWarnings(warnings: SecurityWarning[], nodeNames: Map<string, string>): string {\n  if (warnings.length === 0) return '';\n\n  const MAX_SHOWN = 3;\n  const lines: string[] = ['', '## \u26A0 Security'];\n\n  const shown = warnings.slice(0, MAX_SHOWN);\n  for (const w of shown) {\n    const scoreParts: string[] = [];\n    if (w.severityScore !== null) scoreParts.push(`CVSS ${w.severityScore.toFixed(1)}`);\n    if (w.epssScore !== null) {\n      const pct = w.epssPercentile !== null ? ` / ${Math.round(w.epssPercentile * 100)}th%` : '';\n      scoreParts.push(`EPSS ${w.epssScore.toFixed(2)}${pct}`);\n    }\n    const scores = scoreParts.length > 0 ? ` (${scoreParts.join(', ')})` : '';\n\n    const entryPointNames = w.entryPoints\n      .map(id => nodeNames.get(id) ?? id)\n      .slice(0, 3);\n    const entryPointStr = entryPointNames.length > 0\n      ? ` \u2014 reaches via: ${entryPointNames.join(', ')}`\n      : '';\n\n    lines.push(`- **${w.cveId}**${scores}: ${w.packageName} (${w.ecosystem})${entryPointStr}`);\n\n    const fix = formatFixSuggestion(w.ecosystem, w.packageName, w.fixedVersion);\n    if (fix) lines.push(`  ${fix}`);\n  }\n\n  if (warnings.length > MAX_SHOWN) {\n    const remaining = warnings.length - MAX_SHOWN;\n    lines.push(`\\n${remaining} more \u2014 use kirograph_vulns for full list`);\n  }\n\n  return lines.join('\\n');\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,6BAAoC;AAyB7B,SAAS,4BAA4B,OAAY,SAAsC;AAC5F,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAElC,MAAI;AAMF,UAAM,OAAO,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAgBtB;AAWD,QAAI,CAAC,QAAQ,KAAK,WAAW,EAAG,QAAO,CAAC;AAExC,UAAM,YAAY,IAAI,IAAI,OAAO;AACjC,UAAM,WAA8B,CAAC;AAErC,eAAW,OAAO,MAAM;AAEtB,UAAI,QAAuD,CAAC;AAC5D,UAAI;AACF,YAAI,IAAI,OAAO;AACb,kBAAQ,KAAK,MAAM,IAAI,KAAK;AAAA,QAC9B;AAAA,MACF,QAAQ;AACN;AAAA,MACF;AAGA,YAAM,sBAAgC,CAAC;AACvC,iBAAW,KAAK,OAAO;AAErB,YAAI,UAAU,IAAI,EAAE,UAAU,GAAG;AAC/B,8BAAoB,KAAK,EAAE,UAAU;AACrC;AAAA,QACF;AAEA,YAAI,EAAE,QAAQ,EAAE,KAAK,KAAK,YAAU,UAAU,IAAI,MAAM,CAAC,GAAG;AAC1D,8BAAoB,KAAK,EAAE,UAAU;AAAA,QACvC;AAAA,MACF;AAEA,UAAI,oBAAoB,SAAS,GAAG;AAClC,iBAAS,KAAK;AAAA,UACZ,OAAO,IAAI;AAAA,UACX,eAAe,IAAI;AAAA,UACnB,WAAW,IAAI;AAAA,UACf,gBAAgB,IAAI;AAAA,UACpB,aAAa,IAAI;AAAA,UACjB,WAAW,IAAI;AAAA,UACf,cAAc,IAAI;AAAA,UAClB,aAAa,CAAC,GAAG,IAAI,IAAI,mBAAmB,CAAC;AAAA,QAC/C,CAAC;AAAA,MACH;AAAA,IACF;AAGA,aAAS,KAAK,CAAC,GAAG,MAAM;AACtB,YAAM,QAAQ,EAAE,aAAa;AAC7B,YAAM,QAAQ,EAAE,aAAa;AAC7B,UAAI,UAAU,MAAO,QAAO,QAAQ;AACpC,cAAQ,EAAE,iBAAiB,MAAM,EAAE,iBAAiB;AAAA,IACtD,CAAC;AAED,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO,CAAC;AAAA,EACV;AACF;AAUO,SAAS,uBAAuB,UAA6B,WAAwC;AAC1G,MAAI,SAAS,WAAW,EAAG,QAAO;AAElC,QAAM,YAAY;AAClB,QAAM,QAAkB,CAAC,IAAI,oBAAe;AAE5C,QAAM,QAAQ,SAAS,MAAM,GAAG,SAAS;AACzC,aAAW,KAAK,OAAO;AACrB,UAAM,aAAuB,CAAC;AAC9B,QAAI,EAAE,kBAAkB,KAAM,YAAW,KAAK,QAAQ,EAAE,cAAc,QAAQ,CAAC,CAAC,EAAE;AAClF,QAAI,EAAE,cAAc,MAAM;AACxB,YAAM,MAAM,EAAE,mBAAmB,OAAO,MAAM,KAAK,MAAM,EAAE,iBAAiB,GAAG,CAAC,QAAQ;AACxF,iBAAW,KAAK,QAAQ,EAAE,UAAU,QAAQ,CAAC,CAAC,GAAG,GAAG,EAAE;AAAA,IACxD;AACA,UAAM,SAAS,WAAW,SAAS,IAAI,KAAK,WAAW,KAAK,IAAI,CAAC,MAAM;AAEvE,UAAM,kBAAkB,EAAE,YACvB,IAAI,QAAM,UAAU,IAAI,EAAE,KAAK,EAAE,EACjC,MAAM,GAAG,CAAC;AACb,UAAM,gBAAgB,gBAAgB,SAAS,IAC3C,wBAAmB,gBAAgB,KAAK,IAAI,CAAC,KAC7C;AAEJ,UAAM,KAAK,OAAO,EAAE,KAAK,KAAK,MAAM,KAAK,EAAE,WAAW,KAAK,EAAE,SAAS,IAAI,aAAa,EAAE;AAEzF,UAAM,UAAM,4CAAoB,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY;AAC1E,QAAI,IAAK,OAAM,KAAK,KAAK,GAAG,EAAE;AAAA,EAChC;AAEA,MAAI,SAAS,SAAS,WAAW;AAC/B,UAAM,YAAY,SAAS,SAAS;AACpC,UAAM,KAAK;AAAA,EAAK,SAAS,gDAA2C;AAAA,EACtE;AAEA,SAAO,MAAM,KAAK,IAAI;AACxB;",
+  "names": []
+}

package/dist/security/data-flows.d.ts

@@ -0,0 +1,33 @@
+/**
+ * KiroGraph SAST-lite: Dangerous Data Flow Detection
+ *
+ * Detects dangerous patterns by analysing call edges in the graph database.
+ * Uses symbol names and callee chains rather than full AST traversal.
+ */
+import type { GraphDatabase } from '../db/database';
+import type { OwaspCategory } from './owasp';
+export interface DataFlowFinding {
+    type: 'sql-injection' | 'path-traversal' | 'xss' | 'dangerous-eval' | 'unsafe-deserialize' | 'hardcoded-crypto';
+    severity: 'critical' | 'high' | 'medium';
+    owaspCategory: OwaspCategory;
+    filePath: string;
+    line: number;
+    symbol: string;
+    description: string;
+    recommendation: string;
+}
+export declare class DataFlowAnalyzer {
+    private readonly db;
+    constructor(db: GraphDatabase);
+    analyze(): Promise<DataFlowFinding[]>;
+    private analyzeFromPatternMatches;
+    private _patternIdToType;
+    private _findEnclosingSymbol;
+    private _getRecommendation;
+    private _detectDangerousEval;
+    private _detectUnsafeDeserialize;
+    private _detectHardcodedCrypto;
+    private _detectSqlInjection;
+    private _detectPathTraversal;
+}
+//# sourceMappingURL=data-flows.d.ts.map

package/dist/security/data-flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-flows.d.ts","sourceRoot":"","sources":["../../src/security/data-flows.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAI7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,eAAe,GAAG,gBAAgB,GAAG,KAAK,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;IAChH,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAyBD,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAExC,OAAO,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAwB3C,OAAO,CAAC,yBAAyB;IA8BjC,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,oBAAoB;IAyB5B,OAAO,CAAC,wBAAwB;IA8BhC,OAAO,CAAC,sBAAsB;IA0C9B,OAAO,CAAC,mBAAmB;IAoE3B,OAAO,CAAC,oBAAoB;CA8C7B"}