shield360 1.1.0 → 1.2.1

package/dist/rasp/__tests__/config-client.test.js

@@ -0,0 +1,283 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Signed config client: verified only against a pinned key; the response's
+ * own keys are never trusted unless allowUnpinnedConfig (trust on first use);
+ * JWKS rotation; expiry; ETag; cache re-verification; the kill switch.
+ */
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const config_client_1 = require("../config-client");
+const engine_1 = require("../engine");
+const index_1 = require("../index");
+function keyPair(kid) {
+    const { publicKey, privateKey } = (0, crypto_1.generateKeyPairSync)('ed25519');
+    const jwk = publicKey.export({ format: 'jwk' });
+    return { kid, x: jwk.x, priv: privateKey, pem: publicKey.export({ format: 'pem', type: 'spki' }).toString() };
+}
+const b64 = (o) => Buffer.from(JSON.stringify(o)).toString('base64url');
+const NOW = 1800000000;
+function claims(over = {}) {
+    return { v: 1, app: 'orders-api', iat: NOW, exp: NOW + 3600, version: 'abc123', killSwitch: false, snippets: false, mode: 'monitor', attacks: {}, allow: { commands: [], outboundHosts: [], fileRoots: [] }, rules: null, ...over };
+}
+function jws(key, c, header = {}) {
+    const head = b64({ alg: 'EdDSA', typ: config_client_1.JWS_TYPE, kid: key.kid, ...header });
+    const body = b64(c);
+    return `${head}.${body}.${(0, crypto_1.sign)(null, Buffer.from(`${head}.${body}`), key.priv).toString('base64url')}`;
+}
+const jwkOf = (k) => ({ kty: 'OKP', crv: 'Ed25519', x: k.x, kid: k.kid });
+function fakeFetch(serve) {
+    const calls = [];
+    const impl = (async (url, init) => {
+        calls.push({ url, headers: (init?.headers || {}) });
+        const s = serve();
+        const status = s.status ?? 200;
+        return new Response(status === 304 ? null : JSON.stringify({ config: s.config, keys: s.keys ?? [] }), {
+            status,
+            headers: s.etag ? { ETag: s.etag } : {},
+        });
+    });
+    return { impl, calls };
+}
+describe('verifyConfigJws', () => {
+    const k1 = keyPair('k1');
+    const k2 = keyPair('k2');
+    const pinned = (0, config_client_1.parsePublicKeys)(jwkOf(k1));
+    it('accepts a config signed by the pinned key', () => {
+        const r = (0, config_client_1.verifyConfigJws)(jws(k1, claims()), pinned, 'orders-api', NOW);
+        expect(r.ok && r.claims.version).toBe('abc123');
+    });
+    it('refuses another key, whatever kid it names', () => {
+        expect((0, config_client_1.verifyConfigJws)(jws(k2, claims()), pinned, 'orders-api', NOW)).toEqual({ ok: false, reason: 'signature' });
+        expect((0, config_client_1.verifyConfigJws)(jws({ ...k2, kid: 'k1' }, claims()), pinned, 'orders-api', NOW)).toEqual({ ok: false, reason: 'signature' });
+    });
+    it('refuses a wrong typ, alg, app, version, or an expired config (60 s skew)', () => {
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims(), { typ: 'JWT' }), pinned, 'orders-api', NOW)).toMatchObject({ reason: 'typ' });
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims(), { alg: 'none' }), pinned, 'orders-api', NOW)).toMatchObject({ reason: 'alg' });
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims({ app: 'other' })), pinned, 'orders-api', NOW)).toMatchObject({ reason: 'app' });
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims({ v: 2 })), pinned, 'orders-api', NOW)).toMatchObject({ reason: 'version' });
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims({ exp: NOW - 61 })), pinned, 'orders-api', NOW)).toMatchObject({ reason: 'expired' });
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims({ exp: NOW - 30 })), pinned, 'orders-api', NOW).ok).toBe(true);
+    });
+    it('refuses a tampered payload', () => {
+        const [h, , s] = jws(k1, claims()).split('.');
+        expect((0, config_client_1.verifyConfigJws)(`${h}.${b64(claims({ killSwitch: true }))}.${s}`, pinned, 'orders-api', NOW)).toMatchObject({ reason: 'signature' });
+    });
+    it('JWKS rotation: either pinned kid verifies; an unpinned kid does not', () => {
+        const k3 = keyPair('k3');
+        const jwks = (0, config_client_1.parsePublicKeys)(JSON.stringify({ keys: [jwkOf(k1), jwkOf(k2)] }));
+        expect(jwks).toHaveLength(2);
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims()), jwks, 'orders-api', NOW).ok).toBe(true);
+        expect((0, config_client_1.verifyConfigJws)(jws(k2, claims()), jwks, 'orders-api', NOW).ok).toBe(true);
+        expect((0, config_client_1.verifyConfigJws)(jws(k3, claims()), jwks, 'orders-api', NOW).ok).toBe(false);
+    });
+    it('parses the pinned key as a JWK, a JWKS, or the bare base64url x; refuses anything else', () => {
+        expect((0, config_client_1.parsePublicKeys)(k1.x)).toHaveLength(1);
+        expect((0, config_client_1.parsePublicKeys)(JSON.stringify(jwkOf(k1)))[0].kid).toBe('k1');
+        expect((0, config_client_1.parsePublicKeys)({ keys: [jwkOf(k1)] })[0].x).toBe(k1.x);
+        expect((0, config_client_1.parsePublicKeys)(k1.pem)).toEqual([]);
+        expect((0, config_client_1.parsePublicKeys)('not-a-key')).toEqual([]);
+        expect((0, config_client_1.parsePublicKeys)({ kty: 'RSA', crv: 'x', x: k1.x })).toEqual([]);
+        // A bare key (no kid) verifies whatever kid the header names; so does a JWKS when the header's kid is not listed.
+        expect((0, config_client_1.verifyConfigJws)(jws(k1, claims()), (0, config_client_1.parsePublicKeys)(k1.x), 'orders-api', NOW).ok).toBe(true);
+        expect((0, config_client_1.verifyConfigJws)(jws({ ...k1, kid: 'unlisted' }, claims()), (0, config_client_1.parsePublicKeys)({ keys: [jwkOf(k2), jwkOf(k1)] }), 'orders-api', NOW).ok).toBe(true);
+    });
+});
+describe('RaspConfigClient', () => {
+    const k1 = keyPair('k1');
+    const k2 = keyPair('k2');
+    let dir;
+    let applied;
+    let warnings;
+    let now;
+    beforeEach(() => {
+        dir = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'rasp-config-'));
+        applied = [];
+        warnings = [];
+        now = NOW * 1000;
+    });
+    afterEach(() => (0, fs_1.rmSync)(dir, { recursive: true, force: true }));
+    const client = (serve, over = {}) => {
+        const f = fakeFetch(serve);
+        const c = new config_client_1.RaspConfigClient({
+            url: 'https://shield.example.com/',
+            apiKey: 'test-api-key',
+            app: 'orders-api',
+            pinned: (0, config_client_1.parsePublicKeys)(jwkOf(k1)),
+            cacheDir: dir,
+            onConfig: (x) => applied.push(x),
+            onWarning: (w) => warnings.push(w),
+            fetchImpl: f.impl,
+            now: () => now,
+            ...over,
+        });
+        return { c, calls: f.calls };
+    };
+    it('pinned: fetches with the API key and applies a verified config', async () => {
+        const { c, calls } = client(() => ({ config: jws(k1, claims()), keys: [jwkOf(k1)], etag: '"e1"' }));
+        expect(await c.poll()).toBe('updated');
+        expect(calls[0].url).toBe('https://shield.example.com/api/rasp/config?app=orders-api');
+        expect(calls[0].headers.Authorization).toBe('Bearer test-api-key');
+        expect(applied[0]?.version).toBe('abc123');
+    });
+    it('a poll still in flight when the client stops applies and caches nothing', async () => {
+        let release;
+        const gate = new Promise((r) => (release = r));
+        const f = fakeFetch(() => ({ config: jws(k1, claims({ killSwitch: true })), keys: [jwkOf(k1)] }));
+        const { c } = client(() => ({}), {
+            fetchImpl: (async (url, init) => {
+                await gate;
+                return f.impl(url, init);
+            }),
+        });
+        const pending = c.poll();
+        // RASP re-initialized (another app or key) while the request was out.
+        c.stop();
+        release();
+        await pending;
+        expect(applied).toEqual([]);
+        expect((0, fs_1.readdirSync)(dir)).toEqual([]);
+    });
+    it("pinned: the response's own key is not trusted", async () => {
+        const { c } = client(() => ({ config: jws(k2, claims()), keys: [jwkOf(k2)] }));
+        expect(await c.poll()).toBe('rejected');
+        expect(applied).toEqual([]);
+        expect(warnings).toEqual(['signature']);
+    });
+    it('unpinned: refused without fetching; nothing applied', async () => {
+        const { c, calls } = client(() => ({ config: jws(k1, claims()), keys: [jwkOf(k1)] }), { pinned: [] });
+        expect(await c.poll()).toBe('rejected');
+        expect(calls).toHaveLength(0);
+        expect(applied).toEqual([]);
+        expect(warnings).toEqual(['unpinned']);
+    });
+    it('allowUnpinnedConfig: trusts the first key, then refuses a different one', async () => {
+        let key = k1;
+        const { c } = client(() => ({ config: jws(key, claims()), keys: [jwkOf(key)] }), { pinned: [], allowUnpinned: true });
+        expect(await c.poll()).toBe('updated');
+        expect(warnings).toContain('trust_on_first_use');
+        key = k2;
+        expect(await c.poll()).toBe('rejected');
+    });
+    it('ETag: sends If-None-Match and keeps the config on 304', async () => {
+        let status = 200;
+        const { c, calls } = client(() => ({ status, config: jws(k1, claims()), etag: '"e1"' }));
+        await c.poll();
+        status = 304;
+        expect(await c.poll()).toBe('unchanged');
+        expect(calls[1].headers['If-None-Match']).toBe('"e1"');
+        expect(c.current?.version).toBe('abc123');
+    });
+    it('expiry: an expired config is refused; the one in force is dropped once it expires', async () => {
+        const { c: stale } = client(() => ({ config: jws(k1, claims({ exp: NOW - 3600 })) }));
+        expect(await stale.poll()).toBe('rejected');
+        let up = true;
+        const { c } = client(() => (up ? { config: jws(k1, claims({ exp: NOW + 120 })) } : { status: 503 }));
+        await c.poll();
+        up = false;
+        now += 600000;
+        expect(await c.poll()).toBe('failed');
+        expect(applied[applied.length - 1]).toBeUndefined();
+        expect(c.current).toBeUndefined();
+    });
+    it('failures back off to 5 minutes; success polls about every minute', () => {
+        const { c } = client(() => ({}), { random: () => 1 });
+        expect(c.nextDelay('failed')).toBe(config_client_1.BACKOFF_MS);
+        expect(c.nextDelay('rejected')).toBe(config_client_1.BACKOFF_MS);
+        expect(c.nextDelay('updated')).toBe(70000);
+    });
+    it('cache: the last verified config is re-verified on load; a tampered cache is refused', async () => {
+        const { c } = client(() => ({ config: jws(k1, claims({ version: 'cached' })) }));
+        await c.poll();
+        const { c: fresh } = client(() => ({ status: 503 }));
+        expect(fresh.loadCache()).toBe(true);
+        expect(fresh.current?.version).toBe('cached');
+        (0, fs_1.writeFileSync)(fresh.cacheFile(), JSON.stringify({ config: jws(k2, claims({ version: 'forged' })), tofu: [jwkOf(k2)] }));
+        const { c: other } = client(() => ({ status: 503 }));
+        expect(other.loadCache()).toBe(false);
+        expect(other.current).toBeUndefined();
+    });
+    it('never throws on a network error or a malformed body', async () => {
+        const boom = new config_client_1.RaspConfigClient({
+            url: 'https://shield.example.com',
+            apiKey: 'k',
+            app: 'orders-api',
+            pinned: (0, config_client_1.parsePublicKeys)(jwkOf(k1)),
+            cacheDir: dir,
+            onConfig: () => undefined,
+            fetchImpl: (async () => {
+                throw new Error('offline');
+            }),
+        });
+        expect(await boom.poll()).toBe('failed');
+        const { c } = client(() => ({ config: 'not.a.jws' }));
+        expect(await c.poll()).toBe('rejected');
+    });
+});
+describe('initRasp and the signed config', () => {
+    const k1 = keyPair('k1');
+    let warn;
+    beforeEach(() => {
+        warn = jest.spyOn(console, 'warn').mockImplementation(() => undefined);
+    });
+    afterEach(async () => {
+        warn.mockRestore();
+        await (0, index_1.shutdownRasp)();
+        (0, engine_1.configureEngine)({ enabled: false, applicationName: 'default', env: {} });
+    });
+    it('without a pin: no config fetch, built-in defaults in monitor mode, one log line per process, no reported event', async () => {
+        (0, index_1.resetRaspWarnings)();
+        const urls = [];
+        const fetchImpl = (async (url) => {
+            urls.push(String(url));
+            return new Response('{}', { status: 200 });
+        });
+        const ctx = { applicationName: 'orders-api', url: 'https://shield.example.com', apiKey: 'k', env: {}, fetchImpl };
+        expect((0, index_1.initRasp)({ enabled: true, mode: 'block', attacks: { ssrf: 'off' }, components: false }, ctx)).toBe(true);
+        expect((0, engine_1.modeFor)('sql_injection')).toBe('monitor');
+        expect((0, engine_1.modeFor)('ssrf')).toBe('off');
+        (0, index_1.initRasp)({ enabled: true, components: false }, ctx);
+        await (0, index_1.shutdownRasp)();
+        expect(urls.filter((u) => u.includes('/api/rasp/config'))).toEqual([]);
+        expect(urls.filter((u) => u.includes('/api/guard/events'))).toEqual([]);
+        expect(warn).toHaveBeenCalledTimes(1);
+        expect(String(warn.mock.calls[0][0])).toContain('configPublicKey');
+    });
+    it('trust on first use: only with the opt-in, never in production', async () => {
+        expect((0, index_1.tofuAllowed)(true, {})).toBe(true);
+        expect((0, index_1.tofuAllowed)(undefined, { SHIELD360_CONFIG_TOFU: 'dev' })).toBe(true);
+        expect((0, index_1.tofuAllowed)(undefined, {})).toBe(false);
+        expect((0, index_1.tofuAllowed)(true, { NODE_ENV: 'production' })).toBe(false);
+        expect((0, index_1.tofuAllowed)(undefined, { SHIELD360_CONFIG_TOFU: 'dev', ENVIRONMENT: 'production' })).toBe(false);
+        (0, index_1.resetRaspWarnings)();
+        const fetchImpl = (async () => new Response('{}', { status: 503 }));
+        (0, index_1.initRasp)({ enabled: true, mode: 'block', allowUnpinnedConfig: true, components: false }, { applicationName: 'a', url: 'https://s.example.com', apiKey: 'k', env: { NODE_ENV: 'production' }, fetchImpl });
+        expect((0, engine_1.modeFor)('sql_injection')).toBe('monitor');
+        const dir = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'rasp-tofu-'));
+        (0, index_1.initRasp)({ enabled: true, mode: 'block', components: false, cacheDir: dir }, { applicationName: 'a', url: 'https://s.example.com', apiKey: 'k', env: { SHIELD360_CONFIG_TOFU: 'dev' }, fetchImpl });
+        expect((0, engine_1.modeFor)('sql_injection')).toBe('block');
+        (0, fs_1.rmSync)(dir, { recursive: true, force: true });
+    });
+    it('with a pin from SHIELD360_CONFIG_PUBLIC_KEY: the signed kill switch turns checks off', async () => {
+        const fetchImpl = (async (url) => String(url).includes('/api/rasp/config')
+            ? new Response(JSON.stringify({ config: jws(k1, claims({ exp: Math.floor(Date.now() / 1000) + 600, killSwitch: true })) }), { status: 200 })
+            : new Response('{}'));
+        const cacheDir = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'rasp-init-'));
+        (0, index_1.initRasp)({ enabled: true, components: false, cacheDir }, { applicationName: 'orders-api', url: 'https://shield.example.com', apiKey: 'k', env: { SHIELD360_CONFIG_PUBLIC_KEY: JSON.stringify({ keys: [jwkOf(k1)] }) }, fetchImpl });
+        expect((0, engine_1.isActive)()).toBe(true);
+        await new Promise((r) => setTimeout(r, 50));
+        expect((0, engine_1.isActive)()).toBe(false);
+        (0, fs_1.rmSync)(cacheDir, { recursive: true, force: true });
+    });
+    it('SHIELD360_RASP=off wins over enabled: true; no URL means local options only', () => {
+        expect((0, index_1.initRasp)({ enabled: true }, { applicationName: 'a', env: { SHIELD360_RASP: 'off' } })).toBe(false);
+        expect((0, index_1.initRasp)({ enabled: true, mode: 'block' }, { applicationName: 'a', env: {} })).toBe(true);
+        expect((0, engine_1.modeFor)('sql_injection')).toBe('block');
+        expect((0, index_1.initRasp)(undefined, { applicationName: 'a', env: { SHIELD360_RASP: 'monitor' } })).toBe(true);
+        expect((0, index_1.initRasp)(undefined, { applicationName: 'a', env: {} })).toBe(false);
+        (0, engine_1.setRemoteConfig)(undefined);
+    });
+});
+//# sourceMappingURL=config-client.test.js.map

package/dist/rasp/__tests__/config-client.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-client.test.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/config-client.test.ts"],"names":[],"mappings":";;AAAA;;;;GAIG;AACH,mCAAmE;AACnE,2BAAqE;AACrE,2BAA4B;AAC5B,+BAA4B;AAC5B,oDAA6H;AAC7H,sCAAgF;AAChF,oCAAkF;AAIlF,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAA,4BAAmB,EAAC,SAAS,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAkB,CAAC;IACjE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AAChH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjF,MAAM,GAAG,GAAG,UAAa,CAAC;AAE1B,SAAS,MAAM,CAAC,OAA4B,EAAE;IAC5C,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;AACtO,CAAC;AAED,SAAS,GAAG,CAAC,GAAS,EAAE,CAAa,EAAE,SAAkC,EAAE;IACzE,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,wBAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,GAAG,IAAI,IAAI,IAAI,IAAI,IAAA,aAAI,EAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACzG,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AAIhF,SAAS,SAAS,CAAC,KAAmB;IACpC,MAAM,KAAK,GAAuD,EAAE,CAAC;IACrE,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,GAAW,EAAE,IAAkB,EAAE,EAAE;QACtD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAA2B,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;QAC/B,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,EAAE;YACpG,MAAM;YACN,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;SACxC,CAAC,CAAC;IACL,CAAC,CAA4B,CAAC;IAC9B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,IAAA,+BAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAE1C,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAClH,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACtI,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvH,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACxH,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvH,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACnH,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5H,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,CAAC,EAAE,AAAD,EAAG,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9I,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,IAAA,+BAAe,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,MAAM,CAAC,IAAA,+BAAe,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAA,+BAAe,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,IAAA,+BAAe,EAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAA,+BAAe,EAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAA,+BAAe,EAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,IAAA,+BAAe,EAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvE,kHAAkH;QAClH,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAA,+BAAe,EAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnG,MAAM,CAAC,IAAA,+BAAe,EAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAA,+BAAe,EAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,GAAW,CAAC;IAChB,IAAI,OAAmC,CAAC;IACxC,IAAI,QAAkB,CAAC;IACvB,IAAI,GAAW,CAAC;IAEhB,UAAU,CAAC,GAAG,EAAE;QACd,GAAG,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QAClD,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,GAAG,EAAE,CAAC;QACd,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,GAAG,EAAE,CAAC,IAAA,WAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAE/D,MAAM,MAAM,GAAG,CAAC,KAAmB,EAAE,OAAmE,EAAE,EAAE,EAAE;QAC5G,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,IAAI,gCAAgB,CAAC;YAC7B,GAAG,EAAE,6BAA6B;YAClC,MAAM,EAAE,cAAc;YACtB,GAAG,EAAE,YAAY;YACjB,MAAM,EAAE,IAAA,+BAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClC,QAAQ,EAAE,GAAG;YACb,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAChC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,IAAI;YACjB,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG;YACd,GAAG,IAAI;SACR,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC,CAAC;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACpG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,IAAI,OAAoB,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClG,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE;YAC/B,SAAS,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,IAAkB,EAAE,EAAE;gBACpD,MAAM,IAAI,CAAC;gBACX,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3B,CAAC,CAA4B;SAC9B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,sEAAsE;QACtE,CAAC,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;QACV,MAAM,OAAO,CAAC;QACd,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAA,gBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACtG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACjD,GAAG,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,IAAI,MAAM,GAAG,GAAG,CAAC;QACjB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,EAAE,GAAG,IAAI,CAAC;QACd,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACrG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,EAAE,GAAG,KAAK,CAAC;QACX,GAAG,IAAI,MAAO,CAAC;QACf,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,0BAAU,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,0BAAU,CAAC,CAAC;QACjD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAA,kBAAa,EAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxH,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,IAAI,GAAG,IAAI,gCAAgB,CAAC;YAChC,GAAG,EAAE,4BAA4B;YACjC,MAAM,EAAE,GAAG;YACX,GAAG,EAAE,YAAY;YACjB,MAAM,EAAE,IAAA,+BAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClC,QAAQ,EAAE,GAAG;YACb,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS;YACzB,SAAS,EAAE,CAAC,KAAK,IAAI,EAAE;gBACrB,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC,CAA4B;SAC9B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,IAAsB,CAAC;IAC3B,UAAU,CAAC,GAAG,EAAE;QACd,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,IAAA,oBAAY,GAAE,CAAC;QACrB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gHAAgH,EAAE,KAAK,IAAI,EAAE;QAC9H,IAAA,yBAAiB,GAAE,CAAC;QACpB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC,CAA4B,CAAC;QAC9B,MAAM,GAAG,GAAG,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;QAClH,MAAM,CAAC,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChH,MAAM,CAAC,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,CAAC,IAAA,gBAAO,EAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,IAAA,oBAAY,GAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,CAAC,IAAA,mBAAW,EAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,IAAA,mBAAW,EAAC,SAAS,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,MAAM,CAAC,IAAA,mBAAW,EAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAA,mBAAW,EAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,IAAA,mBAAW,EAAC,SAAS,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAExG,IAAA,yBAAiB,GAAE,CAAC;QACpB,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAA4B,CAAC;QAC/F,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1M,MAAM,CAAC,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QACtD,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACpM,MAAM,CAAC,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAA,WAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE,CACvC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACtC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC5I,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAA4B,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3D,IAAA,gBAAQ,EACN,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAC9C,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,CAC1K,CAAC;QACF,MAAM,CAAC,IAAA,iBAAQ,GAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAA,iBAAQ,GAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAA,WAAM,EAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1G,MAAM,CAAC,IAAA,gBAAQ,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjG,MAAM,CAAC,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAA,gBAAQ,EAAC,SAAS,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrG,MAAM,CAAC,IAAA,gBAAQ,EAAC,SAAS,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAA,wBAAe,EAAC,SAAS,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/rasp/__tests__/corpus.d.ts

@@ -0,0 +1,13 @@
+import type { Finding, RaspInput } from '../types';
+import { type VirtualPatch, type VpRequest } from '../vpatch';
+export declare const RASP_DIR: string;
+export declare const loadJson: (rel: string) => any;
+export declare const SECTIONS: readonly ["sql", "nosql", "command", "path", "ssrf", "code", "template", "xml", "deser", "xss", "requests"];
+export type Section = (typeof SECTIONS)[number];
+export declare function normalise(raw: RaspInput[] | undefined): RaspInput[];
+/** Node versions the request cases run under: this one, and one inside each runtimeVersions range. */
+export declare function nodeVersions(): string[];
+/** Runs one case; returns the first finding (null = nothing fired). */
+export declare function runCase(section: Section, c: any): Finding | null;
+/** A request that satisfies a rule's clauses, built from the rule itself. */
+export declare function requestFor(rule: VirtualPatch): VpRequest;

package/dist/rasp/__tests__/corpus.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECTIONS = exports.loadJson = exports.RASP_DIR = void 0;
+exports.normalise = normalise;
+exports.nodeVersions = nodeVersions;
+exports.runCase = runCase;
+exports.requestFor = requestFor;
+/**
+ * Shared-corpus runner (sdk/rasp/testdata, README "Fixtures"): runs one case
+ * of a section through the detectors and returns what fired, if anything.
+ * `request` inputs go through the normaliser (percent-decoded forms added);
+ * `model_output` inputs through the model-output fragmenter.
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+const detect_1 = require("../detect");
+const normalize_1 = require("../normalize");
+const vpatch_1 = require("../vpatch");
+// sdk/rasp in the monorepo; rasp/ at the root of the public mirror (shield360-js).
+exports.RASP_DIR = [(0, path_1.join)(__dirname, '..', '..', '..', '..', 'rasp'), (0, path_1.join)(__dirname, '..', '..', '..', 'rasp')]
+    .find((dir) => (0, fs_1.existsSync)((0, path_1.join)(dir, 'testdata'))) ?? (0, path_1.join)(__dirname, '..', '..', '..', '..', 'rasp');
+const loadJson = (rel) => JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(exports.RASP_DIR, rel), 'utf8'));
+exports.loadJson = loadJson;
+exports.SECTIONS = ['sql', 'nosql', 'command', 'path', 'ssrf', 'code', 'template', 'xml', 'deser', 'xss', 'requests'];
+function normalise(raw) {
+    const out = [];
+    for (const i of raw || []) {
+        if (i.source === 'model_output')
+            (0, normalize_1.addModelOutput)(out, i.value, i.key);
+        else
+            (0, normalize_1.addInput)(out, i.value, i.key);
+    }
+    return out;
+}
+/** Node versions the request cases run under: this one, and one inside each runtimeVersions range. */
+function nodeVersions() {
+    const out = new Set([process.versions.node]);
+    for (const r of vpatch_1.BUILT_IN_RULES)
+        for (const [from] of r.runtimeVersions?.node ?? [])
+            out.add(from);
+    return [...out];
+}
+/** Runs one case; returns the first finding (null = nothing fired). */
+function runCase(section, c) {
+    const inputs = normalise(c.inputs);
+    switch (section) {
+        case 'sql':
+            return (0, detect_1.detectSql)(c.query, inputs, c.dialect);
+        case 'nosql': {
+            const ins = [];
+            (0, normalize_1.flatten)(ins, c.body, 'body');
+            (0, normalize_1.flatten)(ins, c.query, 'query');
+            const trees = [c.body, c.query];
+            return (0, detect_1.detectNoSql)(c.filter, trees, ins) ?? (c.update ? (0, detect_1.detectNoSql)(c.update, trees, ins) : null);
+        }
+        case 'command': {
+            if (typeof c.command === 'string') {
+                return (0, detect_1.detectCommand)(c.command, inputs) ?? (0, detect_1.detectShellSpawn)({ command: c.command, inRequest: true, allow: [] });
+            }
+            const argv = c.argv;
+            const script = (0, detect_1.shellScriptOf)(argv);
+            return (0, detect_1.detectArgv)(argv, inputs) ?? (script ? (0, detect_1.detectCommand)(script, inputs) : null) ?? (0, detect_1.detectShellSpawn)({ argv0: argv[0], inRequest: true, allow: [] });
+        }
+        case 'path':
+            return (0, detect_1.detectPath)(c.path, c.op, inputs, c.fileRoots || []);
+        case 'ssrf':
+            return (0, detect_1.detectSsrf)(c.url, inputs, c.resolved || []);
+        case 'template': // SHIELD: source only; data is never passed to the detector.
+            return (0, detect_1.detectTemplate)(c.template, inputs, c.engine);
+        case 'code':
+            return (0, detect_1.detectCode)(c.code, inputs);
+        case 'xml':
+            return (0, detect_1.detectXml)(c.xml, inputs, Boolean(c.resolvesExternal));
+        case 'deser': {
+            const data = c.dataEncoding === 'base64' ? Buffer.from(c.data, 'base64').toString('latin1') : c.data;
+            return (0, detect_1.detectDeserialization)(c.format, data, inputs);
+        }
+        case 'xss':
+            return (0, detect_1.detectXss)(c.contentType, c.body, inputs);
+        case 'requests': {
+            const req = { method: c.method, path: c.path, query: c.query, headers: c.headers, cookie: c.cookie, body: c.body };
+            for (const v of nodeVersions()) {
+                const f = (0, vpatch_1.matchVirtualPatches)(req, vpatch_1.BUILT_IN_RULES, 'all', 'node', v);
+                if (f)
+                    return f;
+            }
+            return null;
+        }
+    }
+}
+/** A request that satisfies a rule's clauses, built from the rule itself. */
+function requestFor(rule) {
+    const req = { method: 'GET', path: '/', query: '', headers: {}, cookie: '', body: '' };
+    for (const c of rule.match) {
+        const value = c.values?.[0] ?? c.value ?? 'x';
+        if (c.target === 'method')
+            req.method = value;
+        else if (c.target.startsWith('header:'))
+            req.headers[c.target.slice(7)] = c.op === 'present' ? 'x' : value;
+        else if (c.target === 'body' || c.target === 'request')
+            req.body += value;
+        else if (c.target === 'query')
+            req.query += value;
+        else if (c.target === 'cookie')
+            req.cookie += value;
+        else if (c.target === 'path')
+            req.path = value;
+    }
+    return req;
+}
+//# sourceMappingURL=corpus.js.map

package/dist/rasp/__tests__/corpus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"corpus.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/corpus.ts"],"names":[],"mappings":";;;AAuCA,8BAOC;AAGD,oCAIC;AAGD,0BA6CC;AAGD,gCAYC;AApHD;;;;;GAKG;AACH,2BAA8C;AAC9C,+BAA4B;AAC5B,sCAiBmB;AAEnB,4CAAiE;AAEjE,sCAAmG;AAEnG,mFAAmF;AACtE,QAAA,QAAQ,GAAG,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;KACjH,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,eAAU,EAAC,IAAA,WAAI,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAChG,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,gBAAQ,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAAvF,QAAA,QAAQ,YAA+E;AAEvF,QAAA,QAAQ,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAU,CAAC;AAGpI,SAAgB,SAAS,CAAC,GAA4B;IACpD,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc;YAAE,IAAA,0BAAc,EAAC,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;;YAChE,IAAA,oBAAQ,EAAC,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sGAAsG;AACtG,SAAgB,YAAY;IAC1B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,uBAAc;QAAE,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,IAAI,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,uEAAuE;AACvE,SAAgB,OAAO,CAAC,OAAgB,EAAE,CAAM;IAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,KAAK;YACR,OAAO,IAAA,kBAAS,EAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,OAAqB,CAAC,CAAC;QAC7D,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,GAAG,GAAgB,EAAE,CAAC;YAC5B,IAAA,mBAAO,EAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7B,IAAA,mBAAO,EAAC,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,IAAA,oBAAW,EAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpG,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAClC,OAAO,IAAA,sBAAa,EAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,IAAA,yBAAgB,EAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAClH,CAAC;YACD,MAAM,IAAI,GAAa,CAAC,CAAC,IAAI,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAA,sBAAa,EAAC,IAAI,CAAC,CAAC;YACnC,OAAO,IAAA,mBAAU,EAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,sBAAa,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAA,yBAAgB,EAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACzJ,CAAC;QACD,KAAK,MAAM;YACT,OAAO,IAAA,mBAAU,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAY,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACvE,KAAK,MAAM;YACT,OAAO,IAAA,mBAAU,EAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACrD,KAAK,UAAU,EAAE,6DAA6D;YAC5E,OAAO,IAAA,uBAAc,EAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAwB,CAAC,CAAC;QACxE,KAAK,MAAM;YACT,OAAO,IAAA,mBAAU,EAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,KAAK,KAAK;YACR,OAAO,IAAA,kBAAS,EAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC/D,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrG,OAAO,IAAA,8BAAqB,EAAC,CAAC,CAAC,MAAqB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACtE,CAAC;QACD,KAAK,KAAK;YACR,OAAO,IAAA,kBAAS,EAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,GAAG,GAAc,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9H,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,IAAA,4BAAmB,EAAC,GAAG,EAAE,uBAAc,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACrE,IAAI,CAAC;oBAAE,OAAO,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAgB,UAAU,CAAC,IAAkB;IAC3C,MAAM,GAAG,GAAc,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC;QAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC;aACzC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;aACtG,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC;aACrE,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;YAAE,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC;aAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;aAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/rasp/__tests__/custom-rules.test.d.ts

@@ -0,0 +1 @@
+export {};