shield360 1.0.1 → 1.2.0

package/dist/rasp/lexers.d.ts

@@ -0,0 +1,32 @@
+/**
+ * One-pass lexers used by the structural checks: SQL, shell and a generic
+ * C-like lexer for code. No regex backtracking; every loop advances.
+ */
+export type Token = {
+    s: number;
+    e: number;
+    kind: string;
+    text: string;
+};
+export type SqlDialect = 'mysql' | 'postgres' | 'sqlite' | 'mssql' | 'oracle' | 'db2' | 'generic';
+/** Every SQL dialect the lexer knows (README "SQL"). */
+export declare const SQL_DIALECTS: readonly SqlDialect[];
+/**
+ * SQL keywords that are not data: OpenRASP's anti-detect list (README
+ * "SQL", rule 1). sqli.userinput ignores them; passive IAST never takes one
+ * for an identifier from input.
+ */
+export declare const SQL_KEYWORDS: ReadonlySet<string>;
+/** Tokenises SQL per the contract's lexer. */
+export declare function sqlTokens(q: string, dialect?: SqlDialect): Token[];
+/** Shell tokens; `sq[i]` marks characters inside single quotes. */
+export declare function shellTokens(cmd: string): {
+    tokens: Token[];
+    inSingle: Uint8Array;
+};
+/** A generic C-like lexer: identifiers, numbers, quoted strings, comments, punctuation. */
+export declare function codeTokens(src: string): Token[];
+/** Tokens overlapping [idx, idx+len). */
+export declare function overlapping(tokens: Token[], idx: number, len: number): Token[];
+/** Start offsets of `needle` in `hay`, at most `max`. */
+export declare function occurrences(hay: string, needle: string, max?: number): number[];

package/dist/rasp/lexers.js

@@ -0,0 +1,444 @@
+"use strict";
+/**
+ * One-pass lexers used by the structural checks: SQL, shell and a generic
+ * C-like lexer for code. No regex backtracking; every loop advances.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SQL_KEYWORDS = exports.SQL_DIALECTS = void 0;
+exports.sqlTokens = sqlTokens;
+exports.shellTokens = shellTokens;
+exports.codeTokens = codeTokens;
+exports.overlapping = overlapping;
+exports.occurrences = occurrences;
+/** Every SQL dialect the lexer knows (README "SQL"). */
+exports.SQL_DIALECTS = ['mysql', 'postgres', 'sqlite', 'mssql', 'oracle', 'db2', 'generic'];
+const isSpace = (c) => c === ' ' || c === '\t' || c === '\n' || c === '\r' || c === '\f' || c === '\v';
+const isDigit = (c) => c >= '0' && c <= '9';
+const isIdStart = (c) => (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || c === '_';
+const isIdChar = (c) => isIdStart(c) || isDigit(c) || c === '$';
+const isHex = (c) => isDigit(c) || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F');
+/**
+ * SQL keywords that are not data: OpenRASP's anti-detect list (README
+ * "SQL", rule 1). sqli.userinput ignores them; passive IAST never takes one
+ * for an identifier from input.
+ */
+exports.SQL_KEYWORDS = new Set('add all alter analyze and any as asc avg begin between by case create count delete desc do dumpfile else elseif end exists false file float flush follows from group having identified if in insert interval into join last like limit loop not null on or order procedure regexp return rlike select then true union update values xor'.split(' '));
+const SQL_OPS = ['->>', '<=', '>=', '<>', '!=', '||', '&&', '::', ':=', '->', '<<', '>>'];
+/** Tokenises SQL per the contract's lexer. */
+function sqlTokens(q, dialect = 'generic') {
+    const out = [];
+    const n = q.length;
+    const hashComment = dialect === 'mysql' || dialect === 'generic';
+    const bracketIdent = dialect === 'mssql' || dialect === 'generic';
+    const dollarQuote = dialect === 'postgres' || dialect === 'generic';
+    const oracle = dialect === 'oracle';
+    const db2 = dialect === 'db2';
+    // E'' (backslash escapes) is not a prefix in Oracle or DB2.
+    const ePrefix = !oracle && !db2;
+    // Oracle and DB2 identifiers may contain '#' after the first character.
+    const idChar = oracle || db2 ? (c) => isIdChar(c) || c === '#' : isIdChar;
+    let i = 0;
+    const push = (s, e, kind) => out.push({ s, e, kind, text: q.slice(s, e) });
+    // Reads a quoted run starting at i (q[i] is the quote); returns the end index.
+    const quoted = (start, close, backslash) => {
+        let j = start + 1;
+        while (j < n) {
+            const c = q[j];
+            if (backslash && c === '\\') {
+                j += 2;
+                continue;
+            }
+            if (c === close) {
+                if (q[j + 1] === close) {
+                    j += 2;
+                    continue;
+                }
+                return j + 1;
+            }
+            j++;
+        }
+        return n;
+    };
+    // A name part: identifier or quoted identifier; returns end or -1.
+    const namePart = (j) => {
+        const c = q[j];
+        if (c !== undefined && isIdStart(c)) {
+            let k = j + 1;
+            while (k < n && idChar(q[k]))
+                k++;
+            return k;
+        }
+        if (c === '"' || c === '`')
+            return quoted(j, c, false);
+        if (c === '[' && bracketIdent)
+            return quoted(j, ']', false);
+        return -1;
+    };
+    // Oracle alternative quoting q'X…X' (also nq'…'), the quote at j; returns end or -1.
+    // The delimiter X is one character (a code point, so possibly multibyte) other than whitespace.
+    const altQuoted = (j) => {
+        const d = q[j + 1];
+        if (d === undefined || isSpace(d))
+            return -1;
+        const pair = d >= '\uD800' && d <= '\uDBFF' && (q[j + 2] ?? '') >= '\uDC00' && (q[j + 2] ?? '') <= '\uDFFF';
+        const open = pair ? q.slice(j + 1, j + 3) : d;
+        const close = open === '[' ? ']' : open === '{' ? '}' : open === '(' ? ')' : open === '<' ? '>' : open;
+        const k = q.indexOf(close + "'", j + 1 + open.length);
+        return k < 0 ? n : k + close.length + 1;
+    };
+    // A block comment starting at i; nests in db2, postgres and mssql.
+    const nestedComments = dialect === 'db2' || dialect === 'postgres' || dialect === 'mssql';
+    const blockComment = (i) => {
+        if (!nestedComments) {
+            const k = q.indexOf('*/', i + 2);
+            return k < 0 ? n : k + 2;
+        }
+        let depth = 1;
+        let k = i + 2;
+        while (k < n) {
+            if (q[k] === '/' && q[k + 1] === '*') {
+                depth++;
+                k += 2;
+            }
+            else if (q[k] === '*' && q[k + 1] === '/') {
+                k += 2;
+                if (--depth === 0)
+                    return k;
+            }
+            else
+                k++;
+        }
+        return n;
+    };
+    while (i < n) {
+        const c = q[i];
+        if (isSpace(c)) {
+            i++;
+            continue;
+        }
+        const start = i;
+        // comments
+        if (c === '-' && q[i + 1] === '-') {
+            const k = q.indexOf('\n', i);
+            i = k < 0 ? n : k;
+            push(start, i, 'comment');
+            continue;
+        }
+        if (c === '#' && hashComment) {
+            const k = q.indexOf('\n', i);
+            i = k < 0 ? n : k;
+            push(start, i, 'comment');
+            continue;
+        }
+        if (c === '/' && q[i + 1] === '*') {
+            i = blockComment(i);
+            push(start, i, q[start + 2] === '!' ? 'version_comment' : 'comment');
+            continue;
+        }
+        // strings, with E'' / N'' prefixes
+        if (c === "'") {
+            i = quoted(i, "'", dialect === 'mysql');
+            push(start, i, 'string');
+            continue;
+        }
+        if (oracle) {
+            // q'…' / nq'…' alternative quoting
+            const p = c === 'N' || c === 'n' ? i + 1 : i;
+            if ((q[p] === 'q' || q[p] === 'Q') && q[p + 1] === "'") {
+                const k = altQuoted(p + 1);
+                if (k > 0) {
+                    i = k;
+                    push(start, i, 'string');
+                    continue;
+                }
+            }
+        }
+        if (db2) {
+            // X'' hex, G'' graphic, GX'' / UX'' / BX'' hex strings
+            const x = (ch) => ch === 'X' || ch === 'x';
+            const g = c === 'G' || c === 'g';
+            const p = (g || c === 'U' || c === 'u' || c === 'B' || c === 'b') && x(q[i + 1]) ? i + 1 : i;
+            if ((p > i || g || x(c)) && q[p + 1] === "'") {
+                i = quoted(p + 1, "'", false);
+                push(start, i, 'string');
+                continue;
+            }
+        }
+        if ((((c === 'E' || c === 'e') && ePrefix) || c === 'N' || c === 'n') && q[i + 1] === "'") {
+            i = quoted(i + 1, "'", dialect === 'mysql' || c === 'E' || c === 'e');
+            push(start, i, 'string');
+            continue;
+        }
+        // dollar quotes and $n placeholders
+        if (c === '$') {
+            if (isDigit(q[i + 1] ?? '')) {
+                let k = i + 1;
+                while (k < n && isDigit(q[k]))
+                    k++;
+                i = k;
+                push(start, i, 'placeholder');
+                continue;
+            }
+            if (dollarQuote) {
+                let k = i + 1;
+                while (k < n && (isIdStart(q[k]) || isDigit(q[k])))
+                    k++;
+                if (q[k] === '$') {
+                    const tag = q.slice(i, k + 1);
+                    const end = q.indexOf(tag, k + 1);
+                    i = end < 0 ? n : end + tag.length;
+                    push(start, i, 'string');
+                    continue;
+                }
+            }
+        }
+        // placeholders
+        if (c === '?') {
+            i++;
+            push(start, i, 'placeholder');
+            continue;
+        }
+        if ((c === ':' || c === '@') && isIdStart(q[i + 1] ?? '') && !(c === ':' && q[i - 1] === ':')) {
+            let k = i + 1;
+            while (k < n && idChar(q[k]))
+                k++;
+            i = k;
+            push(start, i, 'placeholder');
+            continue;
+        }
+        if (oracle && c === ':' && isDigit(q[i + 1] ?? '') && q[i - 1] !== ':') {
+            // Oracle positional bind :1
+            let k = i + 1;
+            while (k < n && isDigit(q[k]))
+                k++;
+            i = k;
+            push(start, i, 'placeholder');
+            continue;
+        }
+        if (c === '@' && q[i + 1] === '@' && isIdStart(q[i + 2] ?? '')) {
+            let k = i + 2;
+            while (k < n && isIdChar(q[k]))
+                k++;
+            i = k;
+            push(start, i, 'word');
+            continue;
+        }
+        if (c === '%' && q[i + 1] === 's') {
+            i += 2;
+            push(start, i, 'placeholder');
+            continue;
+        }
+        if (c === '%' && q[i + 1] === '(') {
+            const k = q.indexOf(')', i + 2);
+            if (k > 0 && q[k + 1] === 's') {
+                i = k + 2;
+                push(start, i, 'placeholder');
+                continue;
+            }
+        }
+        // numbers
+        if (isDigit(c) || (c === '.' && isDigit(q[i + 1] ?? ''))) {
+            let k = i;
+            if (c === '0' && (q[i + 1] === 'x' || q[i + 1] === 'X')) {
+                k = i + 2;
+                while (k < n && isHex(q[k]))
+                    k++;
+            }
+            else {
+                while (k < n && isDigit(q[k]))
+                    k++;
+                if (q[k] === '.') {
+                    k++;
+                    while (k < n && isDigit(q[k]))
+                        k++;
+                }
+                if ((q[k] === 'e' || q[k] === 'E') && (isDigit(q[k + 1] ?? '') || ((q[k + 1] === '+' || q[k + 1] === '-') && isDigit(q[k + 2] ?? '')))) {
+                    k += 2;
+                    while (k < n && isDigit(q[k]))
+                        k++;
+                }
+            }
+            i = k;
+            push(start, i, 'number');
+            continue;
+        }
+        // identifiers and qualified names (one token)
+        const first = namePart(i);
+        if (first > 0) {
+            let k = first;
+            while (q[k] === '.') {
+                const next = namePart(k + 1);
+                if (next < 0)
+                    break;
+                k = next;
+            }
+            i = k;
+            push(start, i, isIdStart(c) && k === first ? 'word' : 'name');
+            continue;
+        }
+        // operators
+        const op = SQL_OPS.find((o) => q.startsWith(o, i));
+        i += op ? op.length : 1;
+        push(start, i, 'op');
+    }
+    return out;
+}
+const SHELL_OPS = ['&&', '||', '>>', '<<', '$(', ';', '&', '|', '>', '<', '(', ')', '`', '\n'];
+/** Shell tokens; `sq[i]` marks characters inside single quotes. */
+function shellTokens(cmd) {
+    const out = [];
+    const inSingle = new Uint8Array(cmd.length);
+    const n = cmd.length;
+    let i = 0;
+    let wordStart = -1;
+    let dq = false;
+    const endWord = (e) => {
+        if (wordStart >= 0 && e > wordStart)
+            out.push({ s: wordStart, e, kind: 'word', text: cmd.slice(wordStart, e) });
+        wordStart = -1;
+    };
+    while (i < n) {
+        const c = cmd[i];
+        if (!dq) {
+            if (c === ' ' || c === '\t') {
+                endWord(i);
+                i++;
+                continue;
+            }
+            const op = SHELL_OPS.find((o) => cmd.startsWith(o, i));
+            if (op) {
+                endWord(i);
+                out.push({ s: i, e: i + op.length, kind: 'op', text: op });
+                i += op.length;
+                continue;
+            }
+            if (wordStart < 0)
+                wordStart = i;
+            if (c === '\\') {
+                i += 2;
+                continue;
+            }
+            if (c === "'") {
+                const k = cmd.indexOf("'", i + 1);
+                const end = k < 0 ? n : k + 1;
+                inSingle.fill(1, i, end);
+                i = end;
+                continue;
+            }
+            if (c === '"') {
+                dq = true;
+                i++;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        // inside double quotes
+        if (c === '\\') {
+            if (wordStart < 0)
+                wordStart = i;
+            i += 2;
+            continue;
+        }
+        if (c === '"') {
+            if (wordStart < 0)
+                wordStart = i;
+            dq = false;
+            i++;
+            continue;
+        }
+        if (c === '`' || (c === '$' && cmd[i + 1] === '(')) {
+            endWord(i);
+            const len = c === '`' ? 1 : 2;
+            out.push({ s: i, e: i + len, kind: 'op', text: cmd.slice(i, i + len) });
+            i += len;
+            continue;
+        }
+        if (wordStart < 0)
+            wordStart = i;
+        i++;
+    }
+    endWord(n);
+    return { tokens: out, inSingle };
+}
+/** A generic C-like lexer: identifiers, numbers, quoted strings, comments, punctuation. */
+function codeTokens(src) {
+    const out = [];
+    const n = src.length;
+    let i = 0;
+    while (i < n) {
+        const c = src[i];
+        if (isSpace(c)) {
+            i++;
+            continue;
+        }
+        const s = i;
+        if (c === '/' && src[i + 1] === '/') {
+            const k = src.indexOf('\n', i);
+            i = k < 0 ? n : k;
+            out.push({ s, e: i, kind: 'comment', text: src.slice(s, i) });
+            continue;
+        }
+        if (c === '/' && src[i + 1] === '*') {
+            const k = src.indexOf('*/', i + 2);
+            i = k < 0 ? n : k + 2;
+            out.push({ s, e: i, kind: 'comment', text: src.slice(s, i) });
+            continue;
+        }
+        if (c === '"' || c === "'" || c === '`') {
+            let k = i + 1;
+            while (k < n && src[k] !== c)
+                k += src[k] === '\\' ? 2 : 1;
+            i = Math.min(n, k + 1);
+            out.push({ s, e: i, kind: 'string', text: src.slice(s, i) });
+            continue;
+        }
+        if (isDigit(c)) {
+            let k = i + 1;
+            while (k < n && (isIdChar(src[k]) || src[k] === '.'))
+                k++;
+            i = k;
+            out.push({ s, e: i, kind: 'number', text: src.slice(s, i) });
+            continue;
+        }
+        if (isIdStart(c) || c === '$' || c.charCodeAt(0) > 127) {
+            let k = i + 1;
+            while (k < n && (isIdChar(src[k]) || src.charCodeAt(k) > 127))
+                k++;
+            i = k;
+            out.push({ s, e: i, kind: 'word', text: src.slice(s, i) });
+            continue;
+        }
+        i++;
+        out.push({ s, e: i, kind: 'op', text: c });
+    }
+    return out;
+}
+/** Tokens overlapping [idx, idx+len). */
+function overlapping(tokens, idx, len) {
+    const end = idx + len;
+    const out = [];
+    for (const t of tokens) {
+        if (t.s >= end)
+            break;
+        if (t.e > idx)
+            out.push(t);
+    }
+    return out;
+}
+/** Start offsets of `needle` in `hay`, at most `max`. */
+function occurrences(hay, needle, max = 8) {
+    const out = [];
+    if (!needle)
+        return out;
+    let from = 0;
+    while (out.length < max) {
+        const i = hay.indexOf(needle, from);
+        if (i < 0)
+            break;
+        out.push(i);
+        from = i + 1;
+    }
+    return out;
+}
+//# sourceMappingURL=lexers.js.map

package/dist/rasp/lexers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lexers.js","sourceRoot":"","sources":["../../src/rasp/lexers.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AA4BH,8BAgPC;AAKD,kCAsEC;AAGD,gCAgDC;AAGD,kCAQC;AAGD,kCAWC;AA9ZD,wDAAwD;AAC3C,QAAA,YAAY,GAA0B,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAExH,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC;AAC/G,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC;AACpD,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC;AAC/F,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC;AACxE,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;AAE5F;;;;GAIG;AACU,QAAA,YAAY,GAAwB,IAAI,GAAG,CACtD,yUAAyU,CAAC,KAAK,CAC7U,GAAG,CACJ,CACF,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAE1F,8CAA8C;AAC9C,SAAgB,SAAS,CAAC,CAAS,EAAE,UAAsB,SAAS;IAClE,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,WAAW,GAAG,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,SAAS,CAAC;IACjE,MAAM,YAAY,GAAG,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,SAAS,CAAC;IAClE,MAAM,WAAW,GAAG,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,KAAK,QAAQ,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,CAAC;IAC9B,4DAA4D;IAC5D,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC;IAChC,wEAAwE;IACxE,MAAM,MAAM,GAAG,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAEnG,+EAA+E;IAC/E,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,SAAkB,EAAU,EAAE;QAC1E,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACf,IAAI,SAAS,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5B,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACvB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,CAAC;YACf,CAAC;YACD,CAAC,EAAE,CAAC;QACN,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,mEAAmE;IACnE,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE;QACrC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC,CAAC;IACF,qFAAqF;IACrF,gGAAgG;IAChG,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE;QACtC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,IAAI,QAAQ,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC;QAC5G,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACvG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,mEAAmE;IACnE,MAAM,cAAc,GAAG,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,OAAO,CAAC;IAC1F,MAAM,YAAY,GAAG,CAAC,CAAS,EAAU,EAAE;QACzC,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACrC,KAAK,EAAE,CAAC;gBACR,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5C,CAAC,IAAI,CAAC,CAAC;gBACP,IAAI,EAAE,KAAK,KAAK,CAAC;oBAAE,OAAO,CAAC,CAAC;YAC9B,CAAC;;gBAAM,CAAC,EAAE,CAAC;QACb,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,CAAC;QAChB,WAAW;QACX,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACrE,SAAS;QACX,CAAC;QACD,mCAAmC;QACnC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,mCAAmC;YACnC,MAAM,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACvD,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACV,CAAC,GAAG,CAAC,CAAC;oBACN,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;oBACzB,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,uDAAuD;YACvD,MAAM,CAAC,GAAG,CAAC,EAAsB,EAAE,EAAE,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,CAAC;YAC/D,MAAM,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7F,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC7C,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC1F,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;YACtE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,oCAAoC;QACpC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAAE,CAAC,EAAE,CAAC;gBACnC,CAAC,GAAG,CAAC,CAAC;gBACN,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAAE,CAAC,EAAE,CAAC;gBACxD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACjB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;oBAClC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;oBACnC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;oBACzB,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QACD,eAAe;QACf,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YAC9F,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YAClC,CAAC,GAAG,CAAC,CAAC;YACN,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACvE,4BAA4B;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACnC,CAAC,GAAG,CAAC,CAAC;YACN,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACpC,CAAC,GAAG,CAAC,CAAC;YACN,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC9B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACV,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;gBAC9B,SAAS;YACX,CAAC;QACH,CAAC;QACD,UAAU;QACV,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACxD,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAAE,CAAC,EAAE,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAAE,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACjB,CAAC,EAAE,CAAC;oBACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBAAE,CAAC,EAAE,CAAC;gBACrC,CAAC;gBACD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvI,CAAC,IAAI,CAAC,CAAC;oBACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBAAE,CAAC,EAAE,CAAC;gBACrC,CAAC;YACH,CAAC;YACD,CAAC,GAAG,CAAC,CAAC;YACN,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,8CAA8C;QAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,KAAK,CAAC;YACd,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7B,IAAI,IAAI,GAAG,CAAC;oBAAE,MAAM;gBACpB,CAAC,GAAG,IAAI,CAAC;YACX,CAAC;YACD,CAAC,GAAG,CAAC,CAAC;YACN,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,YAAY;QACZ,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAE/F,mEAAmE;AACnE,SAAgB,WAAW,CAAC,GAAW;IACrC,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE;QAC5B,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAChH,SAAS,GAAG,CAAC,CAAC,CAAC;IACjB,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5B,OAAO,CAAC,CAAC,CAAC,CAAC;gBACX,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACvD,IAAI,EAAE,EAAE,CAAC;gBACP,OAAO,CAAC,CAAC,CAAC,CAAC;gBACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC3D,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;gBACf,SAAS;YACX,CAAC;YACD,IAAI,SAAS,GAAG,CAAC;gBAAE,SAAS,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;gBACzB,CAAC,GAAG,GAAG,CAAC;gBACR,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,EAAE,GAAG,IAAI,CAAC;gBACV,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,uBAAuB;QACvB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,IAAI,SAAS,GAAG,CAAC;gBAAE,SAAS,GAAG,CAAC,CAAC;YACjC,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,SAAS,GAAG,CAAC;gBAAE,SAAS,GAAG,CAAC,CAAC;YACjC,EAAE,GAAG,KAAK,CAAC;YACX,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,CAAC,CAAC,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;YACxE,CAAC,IAAI,GAAG,CAAC;YACT,SAAS;QACX,CAAC;QACD,IAAI,SAAS,GAAG,CAAC;YAAE,SAAS,GAAG,CAAC,CAAC;QACjC,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED,2FAA2F;AAC3F,SAAgB,UAAU,CAAC,GAAW;IACpC,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,CAAC;QACZ,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACnC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC1D,CAAC,GAAG,CAAC,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;YACvD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACnE,CAAC,GAAG,CAAC,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;QACJ,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yCAAyC;AACzC,SAAgB,WAAW,CAAC,MAAe,EAAE,GAAW,EAAE,GAAW;IACnE,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACtB,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;YAAE,MAAM;QACtB,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yDAAyD;AACzD,SAAgB,WAAW,CAAC,GAAW,EAAE,MAAc,EAAE,GAAG,GAAG,CAAC;IAC9D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM;QACjB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/rasp/middleware.d.ts

@@ -0,0 +1,155 @@
+/**
+ * Framework middleware: Express, Fastify, Koa, raw `http` and Next.js route
+ * handlers. Each runs deception first (deception.ts), then records the request's inputs (query, params, body, cookies,
+ * the contract's input headers) in the request's AsyncLocalStorage context,
+ * runs the virtual patches, and maps the block error to the contract's 403.
+ *
+ * None of these needs the framework installed: they are typed structurally.
+ * While RASP is not active each passes the request straight through.
+ */
+import type { IncomingMessage, ServerResponse } from 'http';
+import { lowerHeaders } from './capture';
+import { RaspBlockedError } from './types';
+export declare function isRaspBlocked(e: unknown): e is RaspBlockedError;
+/** Writes the 403 on a Node response (no-op once the headers are out). */
+export declare function sendBlocked(res: ServerResponse, e: RaspBlockedError): void;
+/** The 403 as a fetch Response (Next.js and other fetch-style handlers). */
+export declare function blockedResponse(e: RaspBlockedError): Response;
+/**
+ * The 404 where a framework has no not-found of its own (raw `http`, the
+ * zero-code capture): `404 Not Found` as plain text.
+ */
+export declare function sendNotFound(res: ServerResponse): void;
+/**
+ * Whether a server's `request` listener is a framework app, which resolves the
+ * client address itself (`trust proxy`) and has its own not-found: an Express
+ * 4/5 app (the app function, with `handle`, `use`, `set` and `settings`), Koa's
+ * `callback()` (`handleRequest`) or Fastify's router entry (`preRouting`); the
+ * last two are bare closures, so only their names tell. A server an adapter
+ * already served (`raspFastify` notes its server when registered, the others
+ * on their first request) counts too, which covers a renamed or wrapped app.
+ */
+export declare function frameworkServes(server: unknown): boolean;
+type ExpressReq = IncomingMessage & {
+    originalUrl?: string;
+    query?: unknown;
+    params?: unknown;
+    body?: unknown;
+    route?: {
+        path?: unknown;
+    };
+    ip?: unknown;
+};
+type Next = (err?: unknown) => void;
+/**
+ * Express's own answer to an unknown path, byte for byte: finalhandler's 404
+ * (`Cannot GET /path` in its HTML page, with its security headers), which
+ * Express 4 and 5 send when no route matches. It is written here rather than
+ * reached with `next('router')`: that only leaves the router the middleware
+ * is mounted on, so mounted on a sub-router it would go on to the parent's
+ * handlers, and at the app level it skips the app's own 404 middleware just
+ * the same. An app with its own 404 page passes `raspExpress({ notFound })`.
+ */
+export declare function sendExpressNotFound(req: IncomingMessage & {
+    originalUrl?: string;
+}, res: ServerResponse): void;
+export type RaspExpressOptions = {
+    /**
+     * Answers a decoy path ("Deception") instead of Express's default 404, for
+     * an app with its own not-found page. Must send the response; the route
+     * handlers are never called either way.
+     */
+    notFound?: (req: IncomingMessage, res: ServerResponse) => void;
+};
+/**
+ * Express (4 and 5). Register it after the body parsers so the body is seen
+ * before the handler; registered earlier, the body is still captured when a
+ * sink first reads the inputs.
+ *
+ *   app.use(express.json());
+ *   app.use(raspExpress());
+ *   ...routes...
+ *   app.use(raspExpressErrorHandler());
+ */
+export declare function raspExpress(options?: RaspExpressOptions): (req: ExpressReq, res: ServerResponse, next: Next) => void;
+/** Maps the block error from a handler to the 403; passes every other error on. */
+export declare function raspExpressErrorHandler(): (err: unknown, _req: IncomingMessage, res: ServerResponse, next: Next) => void;
+type FastifyRequest = {
+    method: string;
+    url: string;
+    headers: Record<string, string | string[] | undefined>;
+    query?: unknown;
+    params?: unknown;
+    body?: unknown;
+    routeOptions?: {
+        url?: string;
+    };
+    routerPath?: string;
+    ip?: unknown;
+    /** True while Fastify serves the request with its not-found handler (no route matched). */
+    is404?: boolean;
+    [k: symbol]: unknown;
+};
+type FastifyReply = {
+    code(n: number): FastifyReply;
+    header(k: string, v: string): FastifyReply;
+    send(body: unknown): unknown;
+    callNotFound?(): unknown;
+};
+type FastifyLike = {
+    server?: unknown;
+    addHook(name: string, fn: (request: FastifyRequest, reply: FastifyReply, done: Next) => void): unknown;
+};
+/**
+ * Fastify plugin: `fastify.register(raspFastify)`. Applies to every route
+ * (it skips encapsulation, as fastify-plugin would). Inputs are captured in
+ * `onRequest`, the body in `preHandler`. A handler that lets the block error
+ * through gets a 403 from Fastify's default error handler (`statusCode`).
+ */
+export declare function raspFastify(fastify: FastifyLike, _opts: unknown, done: Next): void;
+type KoaContext = {
+    method: string;
+    url: string;
+    originalUrl?: string;
+    headers?: Record<string, string | string[] | undefined>;
+    query?: unknown;
+    params?: unknown;
+    _matchedRoute?: unknown;
+    ip?: unknown;
+    request?: {
+        body?: unknown;
+        headers?: Record<string, string | string[] | undefined>;
+    };
+    req?: {
+        httpVersionMajor?: number;
+    };
+    status?: number;
+    body?: unknown;
+    set?(k: string, v: string): void;
+};
+/** Koa middleware: `app.use(raspKoa())`, ideally after the body parser. */
+export declare function raspKoa(): (k: KoaContext, next: () => Promise<unknown>) => Promise<void>;
+type HttpHandler = (req: IncomingMessage, res: ServerResponse) => unknown;
+/**
+ * Wraps a raw `http` request handler: `http.createServer(raspHttp(handler))`.
+ * The body is the handler's to read; once it has, `recordRequestBody(body)`
+ * adds it (and runs the virtual patches that read the body). A `req.body`
+ * set by a parser is picked up when a sink first reads the inputs.
+ */
+export declare function raspHttp<H extends HttpHandler>(handler: H): H;
+/**
+ * Adds a body the app read itself to the current request's inputs and runs
+ * the virtual patches that read the body. Throws the block error when one
+ * blocks; otherwise never throws.
+ */
+export declare function recordRequestBody(body: unknown, contentType?: string): void;
+type RouteHandler<C> = (request: Request, context: C) => Response | Promise<Response>;
+/**
+ * Wraps a Next.js App Router route handler (Node.js runtime):
+ *
+ *   export const POST = withRasp(async (request) => { ... });
+ *
+ * The body is read from a clone (up to 1 MiB), so the handler can still read it.
+ */
+export declare function withRasp<C = unknown>(handler: RouteHandler<C>): RouteHandler<C>;
+export { lowerHeaders };