@package-broker/core 0.17.4 → 0.19.7

package/dist/plugins/security-advisories/advisory-service.js

@@ -0,0 +1,122 @@
+/*
+ * PACKAGE.broker
+ * Copyright (C) 2025 Łukasz Bajsarowicz
+ * Licensed under AGPL-3.0
+ */
+import { AdvisoryDatabase } from './advisory-db';
+import { getLogger } from '../../utils/logger';
+import semver from 'semver';
+/**
+ * Service for checking packages against known security advisories.
+ * Uses the Packagist security advisories API for real-time lookups.
+ */
+export class SecurityAdvisoryService {
+    db;
+    constructor(db) {
+        this.db = db || new AdvisoryDatabase();
+    }
+    /**
+     * Check a single package/version for vulnerabilities.
+     */
+    async checkPackage(packageName, version) {
+        const advisories = await this.db.queryPackages([packageName]);
+        const packageAdvisories = advisories.get(packageName) || [];
+        const matchingAdvisories = this.filterByVersion(packageAdvisories, version);
+        return {
+            package_name: packageName,
+            version,
+            advisories: matchingAdvisories,
+            is_vulnerable: matchingAdvisories.length > 0,
+        };
+    }
+    /**
+     * Check multiple packages for vulnerabilities (batch).
+     */
+    async checkPackages(packages) {
+        const uniqueNames = [...new Set(packages.map((p) => p.name))];
+        const advisoryMap = await this.db.queryPackages(uniqueNames);
+        return packages.map((pkg) => {
+            const packageAdvisories = advisoryMap.get(pkg.name) || [];
+            const matching = this.filterByVersion(packageAdvisories, pkg.version);
+            return {
+                package_name: pkg.name,
+                version: pkg.version,
+                advisories: matching,
+                is_vulnerable: matching.length > 0,
+            };
+        });
+    }
+    /**
+     * Get the underlying advisory database for direct access.
+     */
+    getDatabase() {
+        return this.db;
+    }
+    /**
+     * Filter advisories by checking if the given version falls within the affected range.
+     * Uses Composer-style version constraints (translated to semver ranges).
+     */
+    filterByVersion(advisories, version) {
+        const logger = getLogger();
+        const cleanVersion = semver.clean(version);
+        // If version is not valid semver (e.g. "dev-main"), return all advisories
+        if (!cleanVersion) {
+            return advisories;
+        }
+        return advisories.filter((advisory) => {
+            try {
+                const range = this.composerConstraintToSemver(advisory.affected_versions);
+                if (!range)
+                    return true; // Can't parse → assume affected for safety
+                return semver.satisfies(cleanVersion, range);
+            }
+            catch {
+                // If we can't determine, err on the side of caution
+                logger.debug('Could not parse version constraint', {
+                    constraint: advisory.affected_versions,
+                    version,
+                });
+                return true;
+            }
+        });
+    }
+    /**
+     * Convert a Composer version constraint to a semver range.
+     * Handles common patterns:
+     * - ">=2.0,<2.3.1"  → ">=2.0.0 <2.3.1"
+     * - ">=1.0,<1.5|>=2.0,<2.1"  → ">=1.0.0 <1.5.0 || >=2.0.0 <2.1.0"
+     * - "<5.4.46"  → "<5.4.46"
+     */
+    composerConstraintToSemver(constraint) {
+        if (!constraint)
+            return null;
+        // Split on pipe (OR) and handle each group
+        const groups = constraint.split('|').map((group) => group.trim());
+        const semverGroups = groups
+            .map((group) => {
+            // Split on comma (AND) within a group
+            const parts = group.split(',').map((p) => p.trim());
+            return parts
+                .map((part) => {
+                // Clean up Composer-specific syntax
+                return part
+                    .replace(/^([<>=!]+)\s*/, '$1') // Remove whitespace after operators
+                    .replace(/^~/, '~') // Tilde range
+                    .replace(/^\^/, '^'); // Caret range
+            })
+                .join(' ');
+        })
+            .filter(Boolean);
+        const result = semverGroups.join(' || ');
+        // Verify the range is valid
+        try {
+            if (semver.validRange(result))
+                return result;
+        }
+        catch {
+            // Fall through
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=advisory-service.js.map

package/dist/plugins/security-advisories/advisory-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory-service.js","sourceRoot":"","sources":["../../../src/plugins/security-advisories/advisory-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAyB,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,MAAM,MAAM,QAAQ,CAAC;AAS5B;;;GAGG;AACH,MAAM,OAAO,uBAAuB;IACjB,EAAE,CAAmB;IAEtC,YAAY,EAAqB;QAC/B,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,gBAAgB,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,OAAe;QACrD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9D,MAAM,iBAAiB,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAE5D,MAAM,kBAAkB,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAE5E,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,OAAO;YACP,UAAU,EAAE,kBAAkB;YAC9B,aAAa,EAAE,kBAAkB,CAAC,MAAM,GAAG,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,QAAkD;QAElD,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAE7D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1B,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAEtE,OAAO;gBACL,YAAY,EAAE,GAAG,CAAC,IAAI;gBACtB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,UAAU,EAAE,QAAQ;gBACpB,aAAa,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;aACnC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,eAAe,CAAC,UAA8B,EAAE,OAAe;QACrE,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE3C,0EAA0E;QAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;YACpC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAC1E,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;gBACpE,OAAO,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,oDAAoD;gBACpD,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;oBACjD,UAAU,EAAE,QAAQ,CAAC,iBAAiB;oBACtC,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,0BAA0B,CAAC,UAAkB;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAE7B,2CAA2C;QAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,MAAM;aACxB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACb,sCAAsC;YACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO,KAAK;iBACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBACZ,oCAAoC;gBACpC,OAAO,IAAI;qBACR,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,oCAAoC;qBACnE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,cAAc;qBACjC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc;YACxC,CAAC,CAAC;iBACD,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC;aACD,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,4BAA4B;QAC5B,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/plugins/security-advisories/advisory.handlers.d.ts

@@ -0,0 +1,13 @@
+import type { Context } from 'hono';
+import { SecurityAdvisoryService } from './advisory-service';
+export declare function getSecurityAdvisoryService(): SecurityAdvisoryService;
+export declare function setSecurityAdvisoryServiceInstance(service: SecurityAdvisoryService): void;
+/**
+ * GET /api/security/advisories?packages=vendor/pkg1,vendor/pkg2
+ */
+export declare function listAdvisories(c: Context): Promise<Response>;
+/**
+ * GET /api/security/advisories/:vendor/:package/:version
+ */
+export declare function checkPackageAdvisories(c: Context): Promise<Response>;
+//# sourceMappingURL=advisory.handlers.d.ts.map

package/dist/plugins/security-advisories/advisory.handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory.handlers.d.ts","sourceRoot":"","sources":["../../../src/plugins/security-advisories/advisory.handlers.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,wBAAgB,0BAA0B,IAAI,uBAAuB,CAKpE;AAED,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAEzF;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwDlE;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4B1E"}

package/dist/plugins/security-advisories/advisory.handlers.js

@@ -0,0 +1,87 @@
+/*
+ * PACKAGE.broker
+ * Copyright (C) 2025 Łukasz Bajsarowicz
+ * Licensed under AGPL-3.0
+ */
+import { SecurityAdvisoryService } from './advisory-service';
+import { AdvisoryDatabase } from './advisory-db';
+import { getLogger } from '../../utils/logger';
+// Singleton service instance — shared with the plugin when loaded
+let serviceInstance = null;
+export function getSecurityAdvisoryService() {
+    if (!serviceInstance) {
+        serviceInstance = new SecurityAdvisoryService(new AdvisoryDatabase());
+    }
+    return serviceInstance;
+}
+export function setSecurityAdvisoryServiceInstance(service) {
+    serviceInstance = service;
+}
+/**
+ * GET /api/security/advisories?packages=vendor/pkg1,vendor/pkg2
+ */
+export async function listAdvisories(c) {
+    const logger = getLogger();
+    const service = getSecurityAdvisoryService();
+    try {
+        const packagesParam = c.req.query('packages');
+        if (!packagesParam) {
+            return c.json({
+                advisories: {},
+                packages_checked: 0,
+                vulnerable_count: 0,
+            });
+        }
+        const packageNames = packagesParam
+            .split(',')
+            .map((p) => p.trim())
+            .filter(Boolean);
+        if (packageNames.length === 0) {
+            return c.json({
+                advisories: {},
+                packages_checked: 0,
+                vulnerable_count: 0,
+            });
+        }
+        // Cap at 100 packages per request
+        const cappedNames = packageNames.slice(0, 100);
+        const { results: advisoryMap, upstream_error } = await service.getDatabase().queryPackagesWithStatus(cappedNames);
+        const response = {};
+        for (const [name, advisories] of advisoryMap) {
+            response[name] = advisories;
+        }
+        return c.json({
+            advisories: response,
+            packages_checked: cappedNames.length,
+            vulnerable_count: advisoryMap.size,
+            ...(upstream_error && { upstream_error: true }),
+        });
+    }
+    catch (err) {
+        logger.error('Error listing advisories', {}, err instanceof Error ? err : new Error(String(err)));
+        return c.json({ error: 'Internal Server Error', message: 'Failed to check security advisories' }, 500);
+    }
+}
+/**
+ * GET /api/security/advisories/:vendor/:package/:version
+ */
+export async function checkPackageAdvisories(c) {
+    const logger = getLogger();
+    const service = getSecurityAdvisoryService();
+    try {
+        const vendor = c.req.param('vendor');
+        const pkg = c.req.param('package');
+        const version = c.req.param('version');
+        if (!vendor || !pkg || !version) {
+            return c.json({ error: 'Bad Request', message: 'Vendor, package, and version are required' }, 400);
+        }
+        const packageName = `${vendor}/${pkg}`;
+        const result = await service.checkPackage(packageName, version);
+        return c.json(result);
+    }
+    catch (err) {
+        logger.error('Error checking package advisories', { vendor: c.req.param('vendor'), package: c.req.param('package'), version: c.req.param('version') }, err instanceof Error ? err : new Error(String(err)));
+        return c.json({ error: 'Internal Server Error', message: 'Failed to check security advisories' }, 500);
+    }
+}
+//# sourceMappingURL=advisory.handlers.js.map

package/dist/plugins/security-advisories/advisory.handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory.handlers.js","sourceRoot":"","sources":["../../../src/plugins/security-advisories/advisory.handlers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,kEAAkE;AAClE,IAAI,eAAe,GAAmC,IAAI,CAAC;AAE3D,MAAM,UAAU,0BAA0B;IACxC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,eAAe,GAAG,IAAI,uBAAuB,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,OAAgC;IACjF,eAAe,GAAG,OAAO,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,CAAU;IAC7C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,UAAU,EAAE,EAAE;gBACd,gBAAgB,EAAE,CAAC;gBACnB,gBAAgB,EAAE,CAAC;aACpB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,aAAa;aAC/B,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,UAAU,EAAE,EAAE;gBACd,gBAAgB,EAAE,CAAC;gBACnB,gBAAgB,EAAE,CAAC;aACpB,CAAC,CAAC;QACL,CAAC;QAED,kCAAkC;QAClC,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAE/C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,GAC5C,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAEnE,MAAM,QAAQ,GAAuC,EAAE,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;QAC9B,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,UAAU,EAAE,QAAQ;YACpB,gBAAgB,EAAE,WAAW,CAAC,MAAM;YACpC,gBAAgB,EAAE,WAAW,CAAC,IAAI;YAClC,GAAG,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,0BAA0B,EAC1B,EAAE,EACF,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,qCAAqC,EAAE,EAClF,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,CAAU;IACrD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QACrG,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAEhE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,mCAAmC,EACnC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,EACnG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,qCAAqC,EAAE,EAClF,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/plugins/security-advisories/advisory.module.d.ts

@@ -0,0 +1,4 @@
+import { OpenAPIHono } from '@hono/zod-openapi';
+declare const securityModule: OpenAPIHono<import("hono").Env, {}, "/">;
+export default securityModule;
+//# sourceMappingURL=advisory.module.d.ts.map

package/dist/plugins/security-advisories/advisory.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory.module.d.ts","sourceRoot":"","sources":["../../../src/plugins/security-advisories/advisory.module.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIhD,QAAA,MAAM,cAAc,0CAAoB,CAAC;AAKzC,eAAe,cAAc,CAAC"}

package/dist/plugins/security-advisories/advisory.module.js

@@ -0,0 +1,13 @@
+/*
+ * PACKAGE.broker
+ * Copyright (C) 2025 Łukasz Bajsarowicz
+ * Licensed under AGPL-3.0
+ */
+import { OpenAPIHono } from '@hono/zod-openapi';
+import { listAdvisoriesRoute, checkPackageRoute } from './advisory.routes';
+import { listAdvisories, checkPackageAdvisories } from './advisory.handlers';
+const securityModule = new OpenAPIHono();
+securityModule.openapi(listAdvisoriesRoute, listAdvisories);
+securityModule.openapi(checkPackageRoute, checkPackageAdvisories);
+export default securityModule;
+//# sourceMappingURL=advisory.module.js.map

package/dist/plugins/security-advisories/advisory.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory.module.js","sourceRoot":"","sources":["../../../src/plugins/security-advisories/advisory.module.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC;AAEzC,cAAc,CAAC,OAAO,CAAC,mBAAmB,EAAE,cAAqB,CAAC,CAAC;AACnE,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,sBAA6B,CAAC,CAAC;AAEzE,eAAe,cAAc,CAAC"}

package/dist/plugins/security-advisories/advisory.routes.d.ts

@@ -0,0 +1,73 @@
+import { z } from '@hono/zod-openapi';
+export declare const listAdvisoriesRoute: {
+    method: "get";
+    path: "/advisories";
+    tags: string[];
+    summary: string;
+    description: string;
+    request: {
+        query: z.ZodObject<{
+            packages: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    };
+    responses: {
+        200: {
+            description: string;
+            content: {
+                'application/json': {
+                    schema: z.ZodObject<{
+                        advisories: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+                            cve: z.ZodNullable<z.ZodString>;
+                            title: z.ZodString;
+                            link: z.ZodString;
+                            affected_versions: z.ZodString;
+                            package_name: z.ZodString;
+                        }, z.core.$strip>>>;
+                        packages_checked: z.ZodNumber;
+                        vulnerable_count: z.ZodNumber;
+                        upstream_error: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strip>;
+                };
+            };
+        };
+    };
+} & {
+    getRoutingPath(): "/advisories";
+};
+export declare const checkPackageRoute: {
+    method: "get";
+    path: "/advisories/{vendor}/{package}/{version}";
+    tags: string[];
+    summary: string;
+    request: {
+        params: z.ZodObject<{
+            vendor: z.ZodString;
+            package: z.ZodString;
+            version: z.ZodString;
+        }, z.core.$strip>;
+    };
+    responses: {
+        200: {
+            description: string;
+            content: {
+                'application/json': {
+                    schema: z.ZodObject<{
+                        package_name: z.ZodString;
+                        version: z.ZodString;
+                        advisories: z.ZodArray<z.ZodObject<{
+                            cve: z.ZodNullable<z.ZodString>;
+                            title: z.ZodString;
+                            link: z.ZodString;
+                            affected_versions: z.ZodString;
+                            package_name: z.ZodString;
+                        }, z.core.$strip>>;
+                        is_vulnerable: z.ZodBoolean;
+                    }, z.core.$strip>;
+                };
+            };
+        };
+    };
+} & {
+    getRoutingPath(): "/advisories/:vendor/:package/:version";
+};
+//# sourceMappingURL=advisory.routes.d.ts.map

package/dist/plugins/security-advisories/advisory.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory.routes.d.ts","sourceRoot":"","sources":["../../../src/plugins/security-advisories/advisory.routes.ts"],"names":[],"mappings":"AAMA,OAAO,EAAe,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAiBnD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgC9B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsB5B,CAAC"}

package/dist/plugins/security-advisories/advisory.routes.js

@@ -0,0 +1,76 @@
+/*
+ * PACKAGE.broker
+ * Copyright (C) 2025 Łukasz Bajsarowicz
+ * Licensed under AGPL-3.0
+ */
+import { createRoute, z } from '@hono/zod-openapi';
+const advisorySchema = z.object({
+    cve: z.string().nullable(),
+    title: z.string(),
+    link: z.string(),
+    affected_versions: z.string(),
+    package_name: z.string(),
+});
+const vulnerabilityCheckResultSchema = z.object({
+    package_name: z.string(),
+    version: z.string(),
+    advisories: z.array(advisorySchema),
+    is_vulnerable: z.boolean(),
+});
+export const listAdvisoriesRoute = createRoute({
+    method: 'get',
+    path: '/advisories',
+    tags: ['Security'],
+    summary: 'Check packages for security advisories',
+    description: 'Query the Packagist security advisories database for vulnerabilities affecting specified packages.',
+    request: {
+        query: z.object({
+            packages: z
+                .string()
+                .optional()
+                .openapi({
+                description: 'Comma-separated list of package names to check (e.g. "symfony/http-kernel,laravel/framework")',
+                example: 'symfony/http-kernel,laravel/framework',
+            }),
+        }),
+    },
+    responses: {
+        200: {
+            description: 'Advisory check results',
+            content: {
+                'application/json': {
+                    schema: z.object({
+                        advisories: z.record(z.string(), z.array(advisorySchema)),
+                        packages_checked: z.number(),
+                        vulnerable_count: z.number(),
+                        upstream_error: z.boolean().optional(),
+                    }),
+                },
+            },
+        },
+    },
+});
+export const checkPackageRoute = createRoute({
+    method: 'get',
+    path: '/advisories/{vendor}/{package}/{version}',
+    tags: ['Security'],
+    summary: 'Check a specific package version for advisories',
+    request: {
+        params: z.object({
+            vendor: z.string().openapi({ description: 'Composer vendor name (e.g. "symfony")', example: 'symfony' }),
+            package: z.string().openapi({ description: 'Composer package name (e.g. "http-kernel")', example: 'http-kernel' }),
+            version: z.string().openapi({ description: 'Package version (e.g. "6.3.0")', example: '6.3.0' }),
+        }),
+    },
+    responses: {
+        200: {
+            description: 'Vulnerability check result for specific package version',
+            content: {
+                'application/json': {
+                    schema: vulnerabilityCheckResultSchema,
+                },
+            },
+        },
+    },
+});
+//# sourceMappingURL=advisory.routes.js.map

package/dist/plugins/security-advisories/advisory.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory.routes.js","sourceRoot":"","sources":["../../../src/plugins/security-advisories/advisory.routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,CAAC,UAAU,CAAC;IAClB,OAAO,EAAE,wCAAwC;IACjD,WAAW,EAAE,oGAAoG;IACjH,OAAO,EAAE;QACP,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;YACd,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,OAAO,CAAC;gBACP,WAAW,EAAE,+FAA+F;gBAC5G,OAAO,EAAE,uCAAuC;aACjD,CAAC;SACL,CAAC;KACH;IACD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,wBAAwB;YACrC,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;wBACf,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;wBACzD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;wBAC5B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;qBACvC,CAAC;iBACH;aACF;SACF;KACF;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,0CAA0C;IAChD,IAAI,EAAE,CAAC,UAAU,CAAC;IAClB,OAAO,EAAE,iDAAiD;IAC1D,OAAO,EAAE;QACP,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;YACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,uCAAuC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YACxG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,4CAA4C,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YAClH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;SACjG,CAAC;KACH;IACD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,yDAAyD;YACtE,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,8BAA8B;iBACvC;aACF;SACF;KACF;CACF,CAAC,CAAC"}

package/dist/plugins/security-advisories/index.d.ts

@@ -0,0 +1,31 @@
+import type { BrokerPlugin } from '../../kernel/plugin';
+import { SecurityAdvisoryService } from './advisory-service';
+import { AdvisoryDatabase } from './advisory-db';
+export { SecurityAdvisoryService } from './advisory-service';
+export { AdvisoryDatabase, type SecurityAdvisory } from './advisory-db';
+interface SecurityAdvisoryServices extends Record<string, unknown> {
+    securityAdvisoryService: SecurityAdvisoryService;
+    securityAdvisoryDb: AdvisoryDatabase;
+}
+interface SecurityAdvisoryEvents extends Record<string, unknown> {
+    'package.synced': {
+        packageName: string;
+        version: string;
+    };
+    'security.advisory.found': {
+        packageName: string;
+        version: string;
+        advisoryCount: number;
+    };
+}
+/**
+ * Security Advisories Plugin
+ *
+ * The first real plugin built on the Phase 0 kernel. It:
+ * 1. Registers a SecurityAdvisoryService in the service container
+ * 2. Subscribes to `package.synced` events to check packages
+ * 3. Emits `security.advisory.found` when vulnerabilities are detected
+ * 4. Adds a sync observer to scan packages after repository sync
+ */
+export declare const securityAdvisoriesPlugin: BrokerPlugin<SecurityAdvisoryServices, SecurityAdvisoryEvents>;
+//# sourceMappingURL=index.d.ts.map

package/dist/plugins/security-advisories/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/plugins/security-advisories/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAExE,UAAU,wBAAyB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAChE,uBAAuB,EAAE,uBAAuB,CAAC;IACjD,kBAAkB,EAAE,gBAAgB,CAAC;CACtC;AAED,UAAU,sBAAuB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC9D,gBAAgB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,yBAAyB,EAAE;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,EAAE,YAAY,CACjD,wBAAwB,EACxB,sBAAsB,CA0GvB,CAAC"}

package/dist/plugins/security-advisories/index.js

@@ -0,0 +1,100 @@
+/*
+ * PACKAGE.broker
+ * Copyright (C) 2025 Łukasz Bajsarowicz
+ * Licensed under AGPL-3.0
+ */
+import { SecurityAdvisoryService } from './advisory-service';
+import { AdvisoryDatabase } from './advisory-db';
+import { setSecurityAdvisoryServiceInstance } from './advisory.handlers';
+import { getLogger } from '../../utils/logger';
+export { SecurityAdvisoryService } from './advisory-service';
+export { AdvisoryDatabase } from './advisory-db';
+/**
+ * Security Advisories Plugin
+ *
+ * The first real plugin built on the Phase 0 kernel. It:
+ * 1. Registers a SecurityAdvisoryService in the service container
+ * 2. Subscribes to `package.synced` events to check packages
+ * 3. Emits `security.advisory.found` when vulnerabilities are detected
+ * 4. Adds a sync observer to scan packages after repository sync
+ */
+export const securityAdvisoriesPlugin = {
+    name: 'security-advisories',
+    version: '1.0.0',
+    register(ctx) {
+        const logger = getLogger();
+        const db = new AdvisoryDatabase();
+        const service = new SecurityAdvisoryService(db);
+        // Share service instance with HTTP handlers
+        setSecurityAdvisoryServiceInstance(service);
+        // Register services
+        ctx.services.register('securityAdvisoryDb', () => db);
+        ctx.services.register('securityAdvisoryService', () => service);
+        // Subscribe to package.synced events — store unsubscribe handle
+        const unsubscribeSynced = ctx.events.on('package.synced', async (payload) => {
+            const { packageName, version } = payload;
+            try {
+                const result = await service.checkPackage(packageName, version);
+                if (result.is_vulnerable) {
+                    logger.warn('Security advisory found', {
+                        package: packageName,
+                        version,
+                        advisoryCount: result.advisories.length,
+                    });
+                    ctx.events.emit('security.advisory.found', {
+                        packageName,
+                        version,
+                        advisoryCount: result.advisories.length,
+                    });
+                }
+            }
+            catch (err) {
+                logger.error('Security advisory check failed', { package: packageName, version }, err instanceof Error ? err : new Error(String(err)));
+            }
+        });
+        // Add sync observer — store reference for cleanup
+        const syncObserver = async (payload) => {
+            const syncPayload = payload;
+            if (!syncPayload.packages || syncPayload.packages.length === 0)
+                return;
+            try {
+                const results = await service.checkPackages(syncPayload.packages);
+                const vulnerable = results.filter((r) => r.is_vulnerable);
+                if (vulnerable.length > 0) {
+                    logger.warn('Vulnerable packages detected after sync', {
+                        repoId: syncPayload.repoId,
+                        vulnerableCount: vulnerable.length,
+                        totalChecked: syncPayload.packages.length,
+                    });
+                }
+            }
+            catch (err) {
+                logger.error('Post-sync security scan failed', { repoId: syncPayload.repoId }, err instanceof Error ? err : new Error(String(err)));
+            }
+        };
+        ctx.hooks.addSyncObserver(syncObserver);
+        // Store cleanup references on the plugin object for dispose()
+        securityAdvisoriesPlugin._unsubscribeSynced = unsubscribeSynced;
+        securityAdvisoriesPlugin._syncObserver = syncObserver;
+        securityAdvisoriesPlugin._hooks = ctx.hooks;
+        logger.info('Security advisories plugin registered');
+    },
+    async dispose() {
+        const logger = getLogger();
+        // Clean up event subscription
+        const unsubscribe = securityAdvisoriesPlugin._unsubscribeSynced;
+        if (typeof unsubscribe === 'function') {
+            unsubscribe();
+        }
+        // Clean up sync observer
+        const hooks = securityAdvisoriesPlugin._hooks;
+        const observer = securityAdvisoriesPlugin._syncObserver;
+        if (hooks && observer) {
+            hooks.removeSyncObserver(observer);
+        }
+        // Reset shared service instance
+        setSecurityAdvisoryServiceInstance(null);
+        logger.info('Security advisories plugin disposed');
+    },
+};
+//# sourceMappingURL=index.js.map

package/dist/plugins/security-advisories/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/security-advisories/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,kCAAkC,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,eAAe,CAAC;AAgBxE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAGjC;IACF,IAAI,EAAE,qBAAqB;IAC3B,OAAO,EAAE,OAAO;IAEhB,QAAQ,CAAC,GAAG;QACV,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAI,gBAAgB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAEhD,4CAA4C;QAC5C,kCAAkC,CAAC,OAAO,CAAC,CAAC;QAE5C,oBAAoB;QACpB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACtD,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;QAEhE,gEAAgE;QAChE,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1E,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;YAEzC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAEhE,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;wBACrC,OAAO,EAAE,WAAW;wBACpB,OAAO;wBACP,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM;qBACxC,CAAC,CAAC;oBAEH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;wBACzC,WAAW;wBACX,OAAO;wBACP,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CACV,gCAAgC,EAChC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,EACjC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,kDAAkD;QAClD,MAAM,YAAY,GAAiB,KAAK,EAAE,OAAgB,EAAE,EAAE;YAC5D,MAAM,WAAW,GAAG,OAGnB,CAAC;YAEF,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAEvE,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAClE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAE1D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;wBACrD,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,eAAe,EAAE,UAAU,CAAC,MAAM;wBAClC,YAAY,EAAE,WAAW,CAAC,QAAQ,CAAC,MAAM;qBAC1C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CACV,gCAAgC,EAChC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,EAC9B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QAEF,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QAExC,8DAA8D;QAC7D,wBAAgC,CAAC,kBAAkB,GAAG,iBAAiB,CAAC;QACxE,wBAAgC,CAAC,aAAa,GAAG,YAAY,CAAC;QAC9D,wBAAgC,CAAC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC;QAErD,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAE3B,8BAA8B;QAC9B,MAAM,WAAW,GAAI,wBAAgC,CAAC,kBAAkB,CAAC;QACzE,IAAI,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;YACtC,WAAW,EAAE,CAAC;QAChB,CAAC;QAED,yBAAyB;QACzB,MAAM,KAAK,GAAI,wBAAgC,CAAC,MAAM,CAAC;QACvD,MAAM,QAAQ,GAAI,wBAAgC,CAAC,aAAa,CAAC;QACjE,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YACtB,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAED,gCAAgC;QAChC,kCAAkC,CAAC,IAAW,CAAC,CAAC;QAEhD,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACrD,CAAC;CACF,CAAC"}