vaspera 2.5.0

package/dist/scanners/semgrep.js

@@ -0,0 +1,350 @@
+/**
+ * Semgrep Scanner
+ *
+ * Runs Semgrep with OWASP, JavaScript/TypeScript, and custom rules.
+ * Outputs SARIF format which we parse into DeterministicFindings.
+ *
+ * If Semgrep is not available, returns empty results with instruction
+ * to install: `pip install semgrep` or `brew install semgrep`
+ *
+ * @module scanners/semgrep
+ */
+import { spawn } from "child_process";
+import { access, mkdir, writeFile } from "fs/promises";
+import { join, relative } from "path";
+import { logger } from "../logger.js";
+/**
+ * Default Semgrep rule configs to use
+ */
+const DEFAULT_CONFIGS = [
+    "p/owasp-top-ten",
+    "p/javascript",
+    "p/typescript",
+    "p/react",
+    "p/nodejs",
+];
+/**
+ * Optional configs that may not be available
+ */
+const OPTIONAL_CONFIGS = [
+    "p/supabase",
+    "p/nextjs",
+];
+/**
+ * Run Semgrep analysis and return findings
+ */
+export async function runSemgrep(projectPath, options) {
+    const startTime = Date.now();
+    const findings = [];
+    // Check if Semgrep is available
+    const semgrepAvailable = await checkSemgrepAvailable();
+    if (!semgrepAvailable.available) {
+        logger.warn("scanners.semgrep_not_available", {
+            error: semgrepAvailable.error,
+            install: "pip install semgrep",
+        });
+        return {
+            scanner: "semgrep",
+            findings: [],
+            duration: Date.now() - startTime,
+            success: false,
+            error: `Semgrep not available: ${semgrepAvailable.error}. Install with: pip install semgrep`,
+        };
+    }
+    logger.info("scanners.semgrep_starting", {
+        version: semgrepAvailable.version,
+        configs: options?.configs || DEFAULT_CONFIGS,
+    });
+    try {
+        // Build config arguments
+        const configs = options?.configs || DEFAULT_CONFIGS;
+        const configArgs = [];
+        for (const config of configs) {
+            configArgs.push("--config", config);
+        }
+        // Add custom rules directory if provided
+        if (options?.customRulesDir) {
+            try {
+                await access(options.customRulesDir);
+                configArgs.push("--config", options.customRulesDir);
+            }
+            catch {
+                // Custom rules dir doesn't exist, skip
+            }
+        }
+        // Check for project-local rules
+        const localRulesDir = join(projectPath, ".vaspera", "semgrep-rules");
+        try {
+            await access(localRulesDir);
+            configArgs.push("--config", localRulesDir);
+        }
+        catch {
+            // No local rules
+        }
+        // Run Semgrep
+        const result = await runSemgrepCli(projectPath, configArgs, options?.timeout);
+        if (result.error && !result.output) {
+            return {
+                scanner: "semgrep",
+                findings: [],
+                duration: Date.now() - startTime,
+                success: false,
+                error: result.error,
+                exitCode: result.exitCode,
+            };
+        }
+        if (result.output) {
+            const sarif = JSON.parse(result.output);
+            const parsed = parseSarifOutput(sarif, projectPath);
+            findings.push(...parsed);
+        }
+        logger.info("scanners.semgrep_complete", {
+            findingsCount: findings.length,
+            duration: Date.now() - startTime,
+        });
+        return {
+            scanner: "semgrep",
+            findings,
+            duration: Date.now() - startTime,
+            success: true,
+            version: semgrepAvailable.version,
+            rulesUsed: configs,
+        };
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        logger.error("scanners.semgrep_failed", { error: errorMessage });
+        return {
+            scanner: "semgrep",
+            findings: [],
+            duration: Date.now() - startTime,
+            success: false,
+            error: errorMessage,
+        };
+    }
+}
+/**
+ * Execute Semgrep CLI
+ */
+async function runSemgrepCli(projectPath, configArgs, timeout) {
+    return new Promise((resolve) => {
+        const args = [
+            ...configArgs,
+            "--sarif",
+            "--quiet",
+            "--no-git-ignore", // Respect .gitignore but don't require git
+            projectPath,
+        ];
+        const child = spawn("semgrep", args, {
+            cwd: projectPath,
+            timeout: timeout || 300000, // 5 minute default timeout
+            env: {
+                ...process.env,
+                SEMGREP_SEND_METRICS: "off", // Don't send telemetry
+            },
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (data) => {
+            stdout += data.toString();
+        });
+        child.stderr.on("data", (data) => {
+            stderr += data.toString();
+        });
+        child.on("close", (code) => {
+            // Semgrep returns 1 if findings, 0 if clean
+            if (stdout) {
+                resolve({ output: stdout, exitCode: code ?? undefined });
+            }
+            else if (code !== 0 && stderr) {
+                resolve({ error: stderr, exitCode: code ?? undefined });
+            }
+            else {
+                // No output, no errors - return empty SARIF
+                resolve({
+                    output: JSON.stringify({ $schema: "", version: "2.1.0", runs: [] }),
+                    exitCode: code ?? undefined,
+                });
+            }
+        });
+        child.on("error", (err) => {
+            resolve({ error: err.message });
+        });
+    });
+}
+/**
+ * Parse SARIF output into DeterministicFindings
+ */
+function parseSarifOutput(sarif, projectPath) {
+    const findings = [];
+    for (const run of sarif.runs) {
+        const ruleMap = new Map();
+        for (const rule of run.tool.driver.rules) {
+            ruleMap.set(rule.id, rule);
+        }
+        for (const result of run.results) {
+            const rule = ruleMap.get(result.ruleId);
+            const location = result.locations?.[0]?.physicalLocation;
+            if (!location)
+                continue;
+            const filePath = location.artifactLocation.uri;
+            const relativePath = filePath.startsWith("file://")
+                ? relative(projectPath, filePath.slice(7))
+                : relative(projectPath, filePath);
+            // Map Semgrep severity to vaspera severity
+            const severity = mapSemgrepSeverity(result.level, rule);
+            // Extract CWE IDs
+            const cweIds = rule?.properties?.cwe || [];
+            findings.push({
+                scanner: "semgrep",
+                ruleId: `semgrep:${result.ruleId}`,
+                file: relativePath,
+                line: location.region.startLine,
+                column: location.region.startColumn,
+                endLine: location.region.endLine,
+                endColumn: location.region.endColumn,
+                message: result.message.text,
+                severity,
+                confidence: 100,
+                cweIds: cweIds.length > 0 ? cweIds : undefined,
+                evidence: location.region.snippet?.text,
+                metadata: {
+                    ruleName: rule?.name,
+                    help: rule?.help?.text,
+                    tags: rule?.properties?.tags,
+                    precision: rule?.properties?.precision,
+                },
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Map Semgrep/SARIF severity levels to vaspera severity
+ */
+function mapSemgrepSeverity(level, rule) {
+    // Check for security-severity score
+    const securitySeverity = rule?.properties?.["security-severity"];
+    if (securitySeverity) {
+        const score = parseFloat(securitySeverity);
+        if (score >= 9.0)
+            return "critical";
+        if (score >= 7.0)
+            return "high";
+        if (score >= 4.0)
+            return "medium";
+        if (score >= 0.1)
+            return "low";
+        return "info";
+    }
+    // Map SARIF levels
+    switch (level) {
+        case "error":
+            return "high";
+        case "warning":
+            return "medium";
+        case "note":
+            return "low";
+        case "none":
+        default:
+            return "info";
+    }
+}
+/**
+ * Check if Semgrep is available
+ */
+export async function checkSemgrepAvailable() {
+    return new Promise((resolve) => {
+        const child = spawn("semgrep", ["--version"], {
+            timeout: 10000,
+        });
+        let version = "";
+        let stderr = "";
+        child.stdout.on("data", (data) => {
+            version += data.toString().trim();
+        });
+        child.stderr.on("data", (data) => {
+            stderr += data.toString().trim();
+        });
+        child.on("close", (code) => {
+            if (code === 0 && version) {
+                resolve({ available: true, version });
+            }
+            else {
+                resolve({
+                    available: false,
+                    error: stderr || "semgrep not found",
+                });
+            }
+        });
+        child.on("error", () => {
+            resolve({
+                available: false,
+                error: "semgrep not found - install with: pip install semgrep",
+            });
+        });
+    });
+}
+/**
+ * Generate a sample Semgrep rules file for Supabase RLS
+ */
+export async function generateSupabaseRules(outputDir) {
+    const rulesYaml = `# Supabase RLS Rules for Vaspera Hardening
+# Place this file in .vaspera/semgrep-rules/
+
+rules:
+  - id: supabase-rls-missing
+    patterns:
+      - pattern: |
+          createTable($TABLE, ...)
+      - pattern-not-inside: |
+          enableRls(...)
+    message: "Table created without Row Level Security enabled"
+    languages: [typescript, javascript]
+    severity: ERROR
+    metadata:
+      cwe:
+        - "CWE-284"
+      category: security
+      technology:
+        - supabase
+
+  - id: supabase-service-role-key
+    pattern-either:
+      - pattern: |
+          createClient($URL, process.env.SUPABASE_SERVICE_ROLE_KEY, ...)
+      - pattern: |
+          createClient($URL, $SERVICE_KEY, ...)
+    message: "Using service role key bypasses RLS - ensure this is intentional"
+    languages: [typescript, javascript]
+    severity: WARNING
+    metadata:
+      category: security
+      technology:
+        - supabase
+
+  - id: supabase-no-auth-check
+    patterns:
+      - pattern: |
+          supabase.from($TABLE).select(...)
+      - pattern-not-inside: |
+          if ($AUTH) { ... }
+      - pattern-not-inside: |
+          $AUTH && ...
+    message: "Database query without authentication check"
+    languages: [typescript, javascript]
+    severity: WARNING
+    metadata:
+      cwe:
+        - "CWE-862"
+      category: security
+      technology:
+        - supabase
+`;
+    const rulesDir = join(outputDir, ".vaspera", "semgrep-rules");
+    await mkdir(rulesDir, { recursive: true });
+    const rulesPath = join(rulesDir, "supabase.yaml");
+    await writeFile(rulesPath, rulesYaml, "utf-8");
+    return rulesPath;
+}
+//# sourceMappingURL=semgrep.js.map

package/dist/scanners/semgrep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../src/scanners/semgrep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,MAAM,EAAqB,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAGtC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AA2DtC;;GAEG;AACH,MAAM,eAAe,GAAG;IACtB,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,SAAS;IACT,UAAU;CACX,CAAC;AAEF;;GAEG;AACH,MAAM,gBAAgB,GAAG;IACvB,YAAY;IACZ,UAAU;CACX,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,OAIC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,gCAAgC;IAChC,MAAM,gBAAgB,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAEvD,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YAC5C,KAAK,EAAE,gBAAgB,CAAC,KAAK;YAC7B,OAAO,EAAE,qBAAqB;SAC/B,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,0BAA0B,gBAAgB,CAAC,KAAK,qCAAqC;SAC7F,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;QACvC,OAAO,EAAE,gBAAgB,CAAC,OAAO;QACjC,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,eAAe;KAC7C,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,yBAAyB;QACzB,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC;QACpD,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,yCAAyC;QACzC,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBACrC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QAED,cAAc;QACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAE9E,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,SAAS;gBAClB,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAgB,CAAC;YACvD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACvC,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACjC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,gBAAgB,CAAC,OAAO;YACjC,SAAS,EAAE,OAAO;SACnB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAEjE,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,YAAY;SACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAC1B,WAAmB,EACnB,UAAoB,EACpB,OAAgB;IAEhB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG;YACX,GAAG,UAAU;YACb,SAAS;YACT,SAAS;YACT,iBAAiB,EAAE,2CAA2C;YAC9D,WAAW;SACZ,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE;YACnC,GAAG,EAAE,WAAW;YAChB,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,2BAA2B;YACvD,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,oBAAoB,EAAE,KAAK,EAAE,uBAAuB;aACrD;SACF,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,4CAA4C;YAC5C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;YAC3D,CAAC;iBAAM,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;gBAChC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;YAC1D,CAAC;iBAAM,CAAC;gBACN,4CAA4C;gBAC5C,OAAO,CAAC;oBACN,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;oBACnE,QAAQ,EAAE,IAAI,IAAI,SAAS;iBAC5B,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,KAAkB,EAAE,WAAmB;IAC/D,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC;YAEzD,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,MAAM,QAAQ,GAAG,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAC/C,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1C,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAEpC,2CAA2C;YAC3C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAExD,kBAAkB;YAClB,MAAM,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC;YAE3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,WAAW,MAAM,CAAC,MAAM,EAAE;gBAClC,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW;gBACnC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO;gBAChC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;gBAC5B,QAAQ;gBACR,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC9C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI;gBACvC,QAAQ,EAAE;oBACR,QAAQ,EAAE,IAAI,EAAE,IAAI;oBACpB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;oBACtB,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI;oBAC5B,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CACzB,KAA4C,EAC5C,IAAgB;IAEhB,oCAAoC;IACpC,MAAM,gBAAgB,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC,mBAAmB,CAAC,CAAC;IACjE,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC3C,IAAI,KAAK,IAAI,GAAG;YAAE,OAAO,UAAU,CAAC;QACpC,IAAI,KAAK,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC;QAChC,IAAI,KAAK,IAAI,GAAG;YAAE,OAAO,QAAQ,CAAC;QAClC,IAAI,KAAK,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mBAAmB;IACnB,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO;YACV,OAAO,MAAM,CAAC;QAChB,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,MAAM,CAAC;QACZ;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IAKzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE;YAC5C,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC1B,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC;oBACN,SAAS,EAAE,KAAK;oBAChB,KAAK,EAAE,MAAM,IAAI,mBAAmB;iBACrC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,OAAO,CAAC;gBACN,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,uDAAuD;aAC/D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,SAAiB;IAC3D,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDnB,CAAC;IAEA,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAC9D,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAClD,MAAM,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAE/C,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/scanners/semgrep.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Unit tests for Semgrep scanner module
+ *
+ * Note: These tests run actual semgrep scans which can take 5-10 seconds each.
+ * Tests have extended timeouts to accommodate this.
+ */
+export {};
+//# sourceMappingURL=semgrep.test.d.ts.map

package/dist/scanners/semgrep.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.test.d.ts","sourceRoot":"","sources":["../../src/scanners/semgrep.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/scanners/semgrep.test.js

@@ -0,0 +1,254 @@
+/**
+ * Unit tests for Semgrep scanner module
+ *
+ * Note: These tests run actual semgrep scans which can take 5-10 seconds each.
+ * Tests have extended timeouts to accommodate this.
+ */
+import { describe, it, expect, beforeEach, afterEach, afterAll } from "vitest";
+// Semgrep scans take ~6 seconds each, so we need longer timeouts
+const SEMGREP_TEST_TIMEOUT = 30000;
+import { mkdir, rm, writeFile, readFile } from "fs/promises";
+import { join } from "path";
+import { tmpdir } from "os";
+import { runSemgrep, checkSemgrepAvailable, generateSupabaseRules, } from "./semgrep.js";
+const TEST_BASE = join(tmpdir(), "vaspera-semgrep-test-" + Date.now() + "-" + Math.random().toString(36).slice(2));
+let testProjectPath;
+beforeEach(async () => {
+    testProjectPath = join(TEST_BASE, "project-" + Math.random().toString(36).slice(2));
+    await mkdir(testProjectPath, { recursive: true });
+});
+afterEach(async () => {
+    try {
+        await rm(testProjectPath, { recursive: true, force: true });
+    }
+    catch {
+        // Ignore cleanup errors
+    }
+});
+afterAll(async () => {
+    try {
+        await rm(TEST_BASE, { recursive: true, force: true });
+    }
+    catch {
+        // Ignore cleanup errors
+    }
+});
+describe("checkSemgrepAvailable", () => {
+    it("returns availability status", async () => {
+        const result = await checkSemgrepAvailable();
+        expect(result).toHaveProperty("available");
+        expect(typeof result.available).toBe("boolean");
+        if (result.available) {
+            expect(result.version).toBeDefined();
+        }
+        else {
+            expect(result.error).toBeDefined();
+        }
+    });
+});
+describe("runSemgrep", () => {
+    it("returns scanner result structure", async () => {
+        await writeFile(join(testProjectPath, "index.ts"), `export const x = 1;`);
+        const result = await runSemgrep(testProjectPath);
+        expect(result).toHaveProperty("scanner", "semgrep");
+        expect(result).toHaveProperty("findings");
+        expect(result).toHaveProperty("duration");
+        expect(result).toHaveProperty("success");
+        expect(Array.isArray(result.findings)).toBe(true);
+    }, SEMGREP_TEST_TIMEOUT);
+    it("returns error message when semgrep not available", async () => {
+        const available = await checkSemgrepAvailable();
+        if (!available.available) {
+            await writeFile(join(testProjectPath, "index.ts"), `export const x = 1;`);
+            const result = await runSemgrep(testProjectPath);
+            expect(result.success).toBe(false);
+            expect(result.error).toContain("not available");
+        }
+    }, SEMGREP_TEST_TIMEOUT);
+    it("all findings have confidence 100", async () => {
+        await writeFile(join(testProjectPath, "index.ts"), `export const x = 1;`);
+        const result = await runSemgrep(testProjectPath);
+        for (const finding of result.findings) {
+            expect(finding.confidence).toBe(100);
+        }
+    }, SEMGREP_TEST_TIMEOUT);
+    it("findings have proper structure", async () => {
+        await writeFile(join(testProjectPath, "index.ts"), `export const x = 1;`);
+        const result = await runSemgrep(testProjectPath);
+        for (const finding of result.findings) {
+            expect(finding.scanner).toBe("semgrep");
+            expect(finding.ruleId).toMatch(/^semgrep:/);
+            expect(finding.file).toBeDefined();
+            expect(finding.line).toBeGreaterThan(0);
+            expect(finding.message).toBeDefined();
+            expect(["critical", "high", "medium", "low", "info"]).toContain(finding.severity);
+        }
+    }, SEMGREP_TEST_TIMEOUT);
+    it("tracks duration", async () => {
+        await writeFile(join(testProjectPath, "index.ts"), `export const x = 1;`);
+        const result = await runSemgrep(testProjectPath);
+        expect(result.duration).toBeGreaterThanOrEqual(0);
+    }, SEMGREP_TEST_TIMEOUT);
+    it("accepts custom configs", async () => {
+        await writeFile(join(testProjectPath, "index.ts"), `export const x = 1;`);
+        const result = await runSemgrep(testProjectPath, {
+            configs: ["p/javascript"],
+        });
+        expect(result.scanner).toBe("semgrep");
+        if (result.success && result.rulesUsed) {
+            expect(result.rulesUsed).toContain("p/javascript");
+        }
+    }, SEMGREP_TEST_TIMEOUT);
+    it("uses project-local rules when available", async () => {
+        // Create local rules directory
+        const rulesDir = join(testProjectPath, ".vaspera", "semgrep-rules");
+        await mkdir(rulesDir, { recursive: true });
+        await writeFile(join(rulesDir, "custom.yaml"), `rules:
+  - id: test-rule
+    pattern: |
+      console.log(...)
+    message: "Console log detected"
+    languages: [javascript, typescript]
+    severity: INFO
+`);
+        await writeFile(join(testProjectPath, "index.ts"), `console.log("test");`);
+        const result = await runSemgrep(testProjectPath);
+        // If semgrep is available and ran successfully, custom rules should be loaded
+        if (result.success) {
+            expect(result.rulesUsed?.length || 0).toBeGreaterThanOrEqual(0);
+        }
+    }, SEMGREP_TEST_TIMEOUT);
+    it("handles timeout option", async () => {
+        await writeFile(join(testProjectPath, "index.ts"), `export const x = 1;`);
+        const result = await runSemgrep(testProjectPath, {
+            timeout: 1000, // Very short timeout
+        });
+        // Should either complete or timeout gracefully
+        expect(result.scanner).toBe("semgrep");
+    }, SEMGREP_TEST_TIMEOUT);
+});
+describe("runSemgrep - OWASP detection", () => {
+    it("detects potential SQL injection patterns", async () => {
+        const available = await checkSemgrepAvailable();
+        if (!available.available)
+            return;
+        await writeFile(join(testProjectPath, "db.ts"), `
+        import { db } from './connection';
+
+        export async function getUser(userId: string) {
+          // Vulnerable to SQL injection
+          const query = "SELECT * FROM users WHERE id = '" + userId + "'";
+          return db.query(query);
+        }
+      `);
+        const result = await runSemgrep(testProjectPath, {
+            configs: ["p/owasp-top-ten"],
+        });
+        if (result.success && result.findings.length > 0) {
+            // Should find SQL injection
+            const sqlFindings = result.findings.filter((f) => f.message.toLowerCase().includes("sql") ||
+                f.cweIds?.includes("CWE-89"));
+            expect(sqlFindings.length).toBeGreaterThanOrEqual(0); // May or may not detect
+        }
+    }, SEMGREP_TEST_TIMEOUT);
+    it("detects XSS patterns", async () => {
+        const available = await checkSemgrepAvailable();
+        if (!available.available)
+            return;
+        await writeFile(join(testProjectPath, "view.tsx"), `
+        export function UserProfile({ userInput }: { userInput: string }) {
+          return <div dangerouslySetInnerHTML={{ __html: userInput }} />;
+        }
+      `);
+        const result = await runSemgrep(testProjectPath, {
+            configs: ["p/react"],
+        });
+        if (result.success) {
+            // May detect dangerous React patterns
+            expect(result.scanner).toBe("semgrep");
+        }
+    }, SEMGREP_TEST_TIMEOUT);
+});
+describe("generateSupabaseRules", () => {
+    it("creates supabase.yaml rules file", async () => {
+        const rulesPath = await generateSupabaseRules(testProjectPath);
+        expect(rulesPath).toContain("supabase.yaml");
+        expect(rulesPath).toContain(".vaspera");
+        expect(rulesPath).toContain("semgrep-rules");
+        const content = await readFile(rulesPath, "utf-8");
+        expect(content).toContain("rules:");
+        expect(content).toContain("supabase-rls-missing");
+        expect(content).toContain("supabase-service-role-key");
+        expect(content).toContain("supabase-no-auth-check");
+    });
+    it("creates rules directory if not exists", async () => {
+        const rulesPath = await generateSupabaseRules(testProjectPath);
+        const content = await readFile(rulesPath, "utf-8");
+        expect(content).toBeDefined();
+    });
+    it("includes CWE references", async () => {
+        const rulesPath = await generateSupabaseRules(testProjectPath);
+        const content = await readFile(rulesPath, "utf-8");
+        expect(content).toContain("CWE-284"); // Improper Access Control
+        expect(content).toContain("CWE-862"); // Missing Authorization
+    });
+    it("includes severity levels", async () => {
+        const rulesPath = await generateSupabaseRules(testProjectPath);
+        const content = await readFile(rulesPath, "utf-8");
+        expect(content).toContain("severity: ERROR");
+        expect(content).toContain("severity: WARNING");
+    });
+    it("includes technology metadata", async () => {
+        const rulesPath = await generateSupabaseRules(testProjectPath);
+        const content = await readFile(rulesPath, "utf-8");
+        expect(content).toContain("technology:");
+        expect(content).toContain("supabase");
+    });
+});
+describe("runSemgrep - severity mapping", () => {
+    it("maps SARIF levels to vaspera severities", async () => {
+        await writeFile(join(testProjectPath, "index.ts"), `export const x = 1;`);
+        const result = await runSemgrep(testProjectPath);
+        // All findings should have valid vaspera severity
+        for (const finding of result.findings) {
+            expect(["critical", "high", "medium", "low", "info"]).toContain(finding.severity);
+        }
+    }, SEMGREP_TEST_TIMEOUT);
+});
+describe("runSemgrep - CWE extraction", () => {
+    it("extracts CWE IDs from rules", async () => {
+        await writeFile(join(testProjectPath, "index.ts"), `export const x = 1;`);
+        const result = await runSemgrep(testProjectPath);
+        // CWE IDs should be in proper format if present
+        for (const finding of result.findings) {
+            if (finding.cweIds && finding.cweIds.length > 0) {
+                for (const cwe of finding.cweIds) {
+                    expect(cwe).toMatch(/^CWE-\d+$/);
+                }
+            }
+        }
+    }, SEMGREP_TEST_TIMEOUT);
+});
+describe("runSemgrep - metadata", () => {
+    it("includes rule metadata in findings", async () => {
+        await writeFile(join(testProjectPath, "index.ts"), `export const x = 1;`);
+        const result = await runSemgrep(testProjectPath);
+        // Findings may include metadata
+        for (const finding of result.findings) {
+            if (finding.metadata) {
+                expect(typeof finding.metadata).toBe("object");
+            }
+        }
+    }, SEMGREP_TEST_TIMEOUT);
+    it("includes evidence (code snippet) when available", async () => {
+        await writeFile(join(testProjectPath, "index.ts"), `export const x = 1;`);
+        const result = await runSemgrep(testProjectPath);
+        // Some findings may include evidence
+        for (const finding of result.findings) {
+            if (finding.evidence) {
+                expect(typeof finding.evidence).toBe("string");
+            }
+        }
+    }, SEMGREP_TEST_TIMEOUT);
+});
+//# sourceMappingURL=semgrep.test.js.map

package/dist/scanners/semgrep.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.test.js","sourceRoot":"","sources":["../../src/scanners/semgrep.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAE/E,iEAAiE;AACjE,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,MAAM,SAAS,GAAG,IAAI,CACpB,MAAM,EAAE,EACR,uBAAuB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CACjF,CAAC;AACF,IAAI,eAAuB,CAAC;AAE5B,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAE7C,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEhD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAEzB,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAEhD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YACzB,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;YAE1E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,CAAC;YAEjD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAEzB,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,CAAC;QAEjD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAEzB,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,CAAC;QAEjD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC5C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAEzB,EAAE,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE;QAC/B,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAEzB,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,EAAE;YAC/C,OAAO,EAAE,CAAC,cAAc,CAAC;SAC1B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAEzB,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;QACpE,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,CACb,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,EAC7B;;;;;;;CAOL,CACI,CAAC;QACF,MAAM,SAAS,CACb,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EACjC,sBAAsB,CACvB,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,CAAC;QAEjD,8EAA8E;QAC9E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAEzB,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,EAAE;YAC/C,OAAO,EAAE,IAAI,EAAE,qBAAqB;SACrC,CAAC,CAAC;QAEH,+CAA+C;QAC/C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAC3B,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAChD,IAAI,CAAC,SAAS,CAAC,SAAS;YAAE,OAAO;QAEjC,MAAM,SAAS,CACb,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,EAC9B;;;;;;;;OAQC,CACF,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,EAAE;YAC/C,OAAO,EAAE,CAAC,iBAAiB,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,4BAA4B;YAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACvC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAC/B,CAAC;YACF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB;QAChF,CAAC;IACH,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAEzB,EAAE,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAChD,IAAI,CAAC,SAAS,CAAC,SAAS;YAAE,OAAO;QAEjC,MAAM,SAAS,CACb,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EACjC;;;;OAIC,CACF,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,EAAE;YAC/C,OAAO,EAAE,CAAC,SAAS,CAAC;SACrB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,sCAAsC;YACtC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAC3B,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,eAAe,CAAC,CAAC;QAE/D,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,eAAe,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,eAAe,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B;QAChE,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,eAAe,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,eAAe,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,CAAC;QAEjD,kDAAkD;QAClD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAC7D,OAAO,CAAC,QAAQ,CACjB,CAAC;QACJ,CAAC;IACH,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAC3B,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,CAAC;QAEjD,gDAAgD;QAChD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACjC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAC3B,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,CAAC;QAEjD,gCAAgC;QAChC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,CAAC,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAEzB,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,CAAC;QAEjD,qCAAqC;QACrC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,CAAC,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAC3B,CAAC,CAAC,CAAC"}