@securecode-ai/mcp 0.2.0 → 0.3.0

package/dist/dependency/minSafeVersion.d.ts

@@ -0,0 +1,32 @@
+import { ResolvedPackage, Vulnerability } from './types';
+/**
+ * Compute the smallest version bump that exits ALL affected ranges for a
+ * given vulnerable package.
+ *
+ * Strategy:
+ *   - Collect all explicit `fixed` bounds from affected ranges; the smallest
+ *     such fixed version is the minimal safe bump (you must reach at least it).
+ *   - If no `fixed` is available, but `introduced` is, there is no known fix —
+ *     return undefined and surface "no known fix" upstream.
+ *   - For npm-family we use `semver.minSatisfying` against the candidate set
+ *     and validate via `semver.valid`. For Python we fall back to a simple
+ *     dotted-version comparator since we deliberately do not depend on a
+ *     full PEP 440 library.
+ *
+ * The result is a *version string* (e.g. "4.17.21") suitable for an in-place
+ * manifest edit. We do NOT try to pick the smallest *major* bump — the user
+ * asked for the smallest version that exits all ranges, which is exactly
+ * the smallest `fixed` across all advisory ranges.
+ */
+export declare function computeMinSafeVersion(pkg: ResolvedPackage, vulns: Vulnerability[]): string | undefined;
+/**
+ * Loose PEP 440-ish comparator for dotted versions like "1.2.3" or "1.2.3rc1".
+ * Returns -1, 0, or 1. Good enough for "smallest fixed version" — not a
+ * general PEP 440 implementation (we explicitly avoid the `packaging` dep).
+ */
+export declare function comparePep440Loose(a: string, b: string): number;
+/**
+ * Build a human-readable upgrade suggestion for the webview / Apply flow.
+ * e.g. "Upgrade lodash 4.17.19 -> 4.17.21"
+ */
+export declare function upgradeSuggestion(pkg: ResolvedPackage, minSafe: string): string;

package/dist/dependency/minSafeVersion.js

@@ -0,0 +1,125 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeMinSafeVersion = computeMinSafeVersion;
+exports.comparePep440Loose = comparePep440Loose;
+exports.upgradeSuggestion = upgradeSuggestion;
+const semver = __importStar(require("semver"));
+/**
+ * Compute the smallest version bump that exits ALL affected ranges for a
+ * given vulnerable package.
+ *
+ * Strategy:
+ *   - Collect all explicit `fixed` bounds from affected ranges; the smallest
+ *     such fixed version is the minimal safe bump (you must reach at least it).
+ *   - If no `fixed` is available, but `introduced` is, there is no known fix —
+ *     return undefined and surface "no known fix" upstream.
+ *   - For npm-family we use `semver.minSatisfying` against the candidate set
+ *     and validate via `semver.valid`. For Python we fall back to a simple
+ *     dotted-version comparator since we deliberately do not depend on a
+ *     full PEP 440 library.
+ *
+ * The result is a *version string* (e.g. "4.17.21") suitable for an in-place
+ * manifest edit. We do NOT try to pick the smallest *major* bump — the user
+ * asked for the smallest version that exits all ranges, which is exactly
+ * the smallest `fixed` across all advisory ranges.
+ */
+function computeMinSafeVersion(pkg, vulns) {
+    const candidates = [];
+    for (const v of vulns) {
+        for (const a of v.affected) {
+            if (a.fixed)
+                candidates.push(a.fixed);
+        }
+    }
+    if (candidates.length === 0)
+        return undefined;
+    if (isNpmFamily(pkg)) {
+        // Pick the smallest valid semver among candidates.
+        const valid = candidates
+            .map(c => semver.coerce(c))
+            .filter((c) => c !== null)
+            .map(c => c.version)
+            .sort((a, b) => semver.compare(a, b));
+        return valid[0];
+    }
+    // Python: simple dotted-numeric compare.
+    const valid = candidates
+        .filter(c => /^\d+(\.\d+)*([._-]?[a-z0-9]+)?$/i.test(c))
+        .sort(comparePep440Loose);
+    return valid[0];
+}
+function isNpmFamily(pkg) {
+    return pkg.ecosystem === 'npm' || pkg.ecosystem === 'yarn' || pkg.ecosystem === 'pnpm';
+}
+/**
+ * Loose PEP 440-ish comparator for dotted versions like "1.2.3" or "1.2.3rc1".
+ * Returns -1, 0, or 1. Good enough for "smallest fixed version" — not a
+ * general PEP 440 implementation (we explicitly avoid the `packaging` dep).
+ */
+function comparePep440Loose(a, b) {
+    const pa = parseLooseVersion(a);
+    const pb = parseLooseVersion(b);
+    for (let i = 0; i < Math.max(pa.nums.length, pb.nums.length); i++) {
+        const ai = pa.nums[i] ?? 0;
+        const bi = pb.nums[i] ?? 0;
+        if (ai !== bi)
+            return ai - bi;
+    }
+    // Pre-release sorts before release (1.2.3rc1 < 1.2.3) — match PEP 440.
+    if (pa.pre && !pb.pre)
+        return -1;
+    if (!pa.pre && pb.pre)
+        return 1;
+    if (pa.pre && pb.pre)
+        return pa.pre < pb.pre ? -1 : pa.pre > pb.pre ? 1 : 0;
+    return 0;
+}
+function parseLooseVersion(v) {
+    const m = v.match(/^(\d+(?:\.\d+)*)(?:([a-z]+\d*))?$/i);
+    if (!m)
+        return { nums: [0] };
+    const nums = m[1].split('.').map(n => parseInt(n, 10));
+    const pre = m[2];
+    return { nums, pre };
+}
+/**
+ * Build a human-readable upgrade suggestion for the webview / Apply flow.
+ * e.g. "Upgrade lodash 4.17.19 -> 4.17.21"
+ */
+function upgradeSuggestion(pkg, minSafe) {
+    return `Upgrade ${pkg.name} ${pkg.version} -> ${minSafe}`;
+}
+//# sourceMappingURL=minSafeVersion.js.map

package/dist/dependency/minSafeVersion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minSafeVersion.js","sourceRoot":"","sources":["../../src/dependency/minSafeVersion.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,sDA2BC;AAWD,gDAaC;AAcD,8CAKC;AA5FD,+CAAiC;AAGjC;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,qBAAqB,CACjC,GAAoB,EACpB,KAAsB;IAEtB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,KAAK;gBAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,mDAAmD;QACnD,MAAM,KAAK,GAAG,UAAU;aACnB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;aAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACnB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,yCAAyC;IACzC,MAAM,KAAK,GAAG,UAAU;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SACvD,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,GAAoB;IACrC,OAAO,GAAG,CAAC,SAAS,KAAK,KAAK,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,CAAS,EAAE,CAAS;IACnD,MAAM,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAChE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAClC,CAAC;IACD,uEAAuE;IACvE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS;IAChC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAC7B,GAAoB,EACpB,OAAe;IAEf,OAAO,WAAW,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,OAAO,OAAO,EAAE,CAAC;AAC9D,CAAC"}

package/dist/dependency/osvClient.d.ts

@@ -0,0 +1,45 @@
+import { ResolvedPackage, Vulnerability } from './types';
+import { CacheStore } from './finding';
+/**
+ * Query OSV.dev in batches for the given resolved packages.
+ *
+ * Only package NAME + VERSION leave the machine. No source code is sent.
+ * Skips packages marked `unresolved` (we don't know the installed version).
+ *
+ * Returns a map keyed by `${ecosystem}:${name}@${version}` to a list of
+ * normalized Vulnerability records. Failures (network, parse) for a given
+ * batch are swallowed and that batch contributes no entries — the scan
+ * does not hard-fail on OSV being unreachable.
+ */
+export declare function queryOsvBatch(packages: ResolvedPackage[]): Promise<Map<string, Vulnerability[]>>;
+/**
+ * GitHub Advisory Database query via the REST API (https://api.github.com/advisories).
+ *
+ * This replaces the previous `gh` CLI approach. The REST API:
+ * - Requires no CLI installation (just `fetch()`)
+ * - Returns real CVSS scores (not approximated severity strings)
+ * - Provides `patched_version_range` with the first fixed version
+ * - Works unauthenticated at 60 req/hr (5000 req/hr with a token)
+ *
+ * Design: GHSA is an ENRICHMENT source, not a primary source. We only
+ * query for packages that OSV already flagged as vulnerable. This keeps
+ * the request count low (typically 5-30 packages) and within the
+ * unauthenticated rate limit.
+ *
+ * If a GitHub token is available (`gh auth token` or GITHUB_TOKEN env),
+ * it is used to lift the rate limit to 5000 req/hr for large projects.
+ */
+export declare function queryGhsaViaCli(packages: ResolvedPackage[]): Promise<Map<string, Vulnerability[]>>;
+/**
+ * With the REST API approach, GHSA is always "available" (works
+ * unauthenticated at 60 req/hr). Kept for backward compat with the
+ * `ghsaSkipped` flag in DependencyScanResult.
+ */
+export declare function ghCliAvailable(): Promise<boolean>;
+/**
+ * Enrich OSV records with NVD CVSS scores when missing, caching results
+ * in workspaceState for 24h.
+ *
+ * Mutates the records in place and returns them for convenience.
+ */
+export declare function enrichWithNvd(records: Vulnerability[], state: CacheStore): Promise<Vulnerability[]>;

package/dist/dependency/osvClient.js

@@ -0,0 +1,443 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryOsvBatch = queryOsvBatch;
+exports.queryGhsaViaCli = queryGhsaViaCli;
+exports.ghCliAvailable = ghCliAvailable;
+exports.enrichWithNvd = enrichWithNvd;
+const cp = __importStar(require("child_process"));
+const OSV_QUERYBATCH_URL = 'https://api.osv.dev/v1/querybatch';
+const OSV_BATCH_SIZE = 1000; // OSV limit per batch request.
+const GHSA_ADVISORIES_URL = 'https://api.github.com/advisories';
+const GHSA_PER_PAGE = 100;
+// Unauthenticated: 60 req/hr. With token: 5000 req/hr.
+// We only query GHSA for packages OSV flagged (enrichment), so 60/hr is
+// enough for typical projects (5-30 vulns). For larger projects, a token
+// from `gh auth token` or GITHUB_TOKEN env var lifts the limit.
+const GHSA_TIMEOUT_MS = 15000;
+/**
+ * Map our ecosystem to OSV's. npm-family all share the `npm` OSV ecosystem
+ * (they hit the same advisory data on the npm registry).
+ */
+function osvEcosystemOf(pkg) {
+    switch (pkg.ecosystem) {
+        case 'npm':
+        case 'yarn':
+        case 'pnpm':
+            return 'npm';
+        case 'pip':
+        case 'pipenv':
+            return 'PyPI';
+        default:
+            return null;
+    }
+}
+/**
+ * Query OSV.dev in batches for the given resolved packages.
+ *
+ * Only package NAME + VERSION leave the machine. No source code is sent.
+ * Skips packages marked `unresolved` (we don't know the installed version).
+ *
+ * Returns a map keyed by `${ecosystem}:${name}@${version}` to a list of
+ * normalized Vulnerability records. Failures (network, parse) for a given
+ * batch are swallowed and that batch contributes no entries — the scan
+ * does not hard-fail on OSV being unreachable.
+ */
+async function queryOsvBatch(packages) {
+    const out = new Map();
+    const queryable = packages.filter(p => !p.unresolved && !!p.version && !!p.name);
+    if (queryable.length === 0)
+        return out;
+    for (let i = 0; i < queryable.length; i += OSV_BATCH_SIZE) {
+        const slice = queryable.slice(i, i + OSV_BATCH_SIZE);
+        const queries = [];
+        const keyForIndex = [];
+        for (const p of slice) {
+            const eco = osvEcosystemOf(p);
+            if (!eco)
+                continue;
+            // npm-family names must match the npm registry casing OSV expects;
+            // OSV is case-sensitive on the npm ecosystem. Use the original name
+            // (npm is case-insensitive in practice but OSV stores as-published).
+            queries.push({ package: { name: p.name, ecosystem: eco }, version: p.version });
+            keyForIndex.push(`${eco}:${p.name}@${p.version}`);
+        }
+        if (queries.length === 0)
+            continue;
+        let body;
+        try {
+            body = JSON.stringify({ queries: queries.map(q => ({ package: q.package, version: q.version })) });
+        }
+        catch {
+            continue;
+        }
+        let resp = null;
+        try {
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 30000);
+            const r = await fetch(OSV_QUERYBATCH_URL, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body,
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (r.ok) {
+                resp = (await r.json());
+            }
+        }
+        catch {
+            // network error — skip this batch
+        }
+        if (!resp || !Array.isArray(resp.results))
+            continue;
+        for (let j = 0; j < resp.results.length; j++) {
+            const key = keyForIndex[j];
+            if (!key)
+                continue;
+            const r = resp.results[j];
+            const vulns = r?.vulns;
+            if (!vulns || vulns.length === 0)
+                continue;
+            const list = [];
+            for (const v of vulns) {
+                const affected = [];
+                if (Array.isArray(v.affected)) {
+                    for (const a of v.affected) {
+                        const ranges = a?.ranges || [];
+                        for (const rng of ranges) {
+                            if (!Array.isArray(rng.events))
+                                continue;
+                            let introduced;
+                            let fixed;
+                            for (const ev of rng.events) {
+                                if (typeof ev.introduced === 'string')
+                                    introduced = ev.introduced;
+                                if (typeof ev.fixed === 'string')
+                                    fixed = ev.fixed;
+                            }
+                            affected.push({
+                                ecosystem: a?.package?.ecosystem || 'npm',
+                                introduced,
+                                fixed,
+                                raw: JSON.stringify(rng),
+                            });
+                        }
+                    }
+                }
+                let cvssScore;
+                if (Array.isArray(v.severity)) {
+                    for (const s of v.severity) {
+                        if (s?.type === 'CVSS_V3' && typeof s.score === 'string') {
+                            // Try plain numeric score first (some records use "7.5").
+                            const num = parseFloat(s.score);
+                            if (!Number.isNaN(num) && s.score.trim().length <= 5) {
+                                cvssScore = num;
+                            }
+                            else {
+                                // Parse CVSS vector string (e.g. "CVSS:3.1/AV:N/AC:L/...").
+                                // Extract the base score from the vector by counting
+                                // the metrics — but since the vector doesn't contain a
+                                // precomputed score, fall back to NVD enrichment which
+                                // has the real baseScore field.
+                                // NVD enrichment (enrichWithNvd) will fill this in
+                                // if the record has a CVE alias.
+                            }
+                        }
+                    }
+                }
+                const references = [];
+                if (Array.isArray(v.references)) {
+                    for (const ref of v.references) {
+                        if (typeof ref?.url === 'string')
+                            references.push(ref.url);
+                    }
+                }
+                list.push({
+                    id: v.id,
+                    source: 'osv',
+                    summary: v.summary || '',
+                    affected,
+                    cvssScore,
+                    references,
+                });
+            }
+            out.set(key, list);
+        }
+    }
+    return out;
+}
+/**
+ * GitHub Advisory Database query via the REST API (https://api.github.com/advisories).
+ *
+ * This replaces the previous `gh` CLI approach. The REST API:
+ * - Requires no CLI installation (just `fetch()`)
+ * - Returns real CVSS scores (not approximated severity strings)
+ * - Provides `patched_version_range` with the first fixed version
+ * - Works unauthenticated at 60 req/hr (5000 req/hr with a token)
+ *
+ * Design: GHSA is an ENRICHMENT source, not a primary source. We only
+ * query for packages that OSV already flagged as vulnerable. This keeps
+ * the request count low (typically 5-30 packages) and within the
+ * unauthenticated rate limit.
+ *
+ * If a GitHub token is available (`gh auth token` or GITHUB_TOKEN env),
+ * it is used to lift the rate limit to 5000 req/hr for large projects.
+ */
+async function queryGhsaViaCli(packages) {
+    const out = new Map();
+    const queryable = packages.filter(p => !p.unresolved && !!p.version && !!p.name);
+    for (const p of queryable) {
+        const eco = osvEcosystemOf(p);
+        if (!eco)
+            continue;
+        const ghEco = eco === 'npm' ? 'npm' : 'pip';
+        let advisories;
+        try {
+            advisories = await queryGhsaRest(ghEco, p.name);
+        }
+        catch {
+            continue;
+        }
+        if (!advisories || advisories.length === 0)
+            continue;
+        const list = [];
+        for (const adv of advisories) {
+            if (!adv?.ghsa_id)
+                continue;
+            // Real CVSS score from the API (not approximated).
+            let cvssScore;
+            if (typeof adv.cvss?.score === 'number') {
+                cvssScore = adv.cvss.score;
+            }
+            else if (typeof adv.cvss_score === 'number') {
+                cvssScore = adv.cvss_score;
+            }
+            // Parse affected + fixed versions from the vulnerabilities array.
+            const affected = [];
+            const vulns = Array.isArray(adv.vulnerabilities) ? adv.vulnerabilities : [];
+            for (const v of vulns) {
+                const rawRange = typeof v?.vulnerable_version_range === 'string'
+                    ? v.vulnerable_version_range : '';
+                const patched = typeof v?.patched_version_range === 'string'
+                    ? v.patched_version_range : '';
+                // Extract the fixed version from the patched range.
+                // GitHub uses ">= X.Y.Z" for the first patched version.
+                let fixed;
+                if (patched) {
+                    const m = patched.match(/>=?\s*([0-9][0-9a-zA-Z.\-+]*)/);
+                    if (m)
+                        fixed = m[1];
+                }
+                // Extract the introduced version from the vulnerable range.
+                let introduced;
+                if (rawRange) {
+                    const m = rawRange.match(/>=?\s*([0-9][0-9a-zA-Z.\-+]*)/);
+                    if (m)
+                        introduced = m[1];
+                }
+                affected.push({ ecosystem: eco, introduced, fixed, raw: rawRange });
+            }
+            // References from the API.
+            const refs = Array.isArray(adv.references)
+                ? adv.references.map((r) => r?.url).filter((x) => typeof x === 'string')
+                : [];
+            // If there's a CVE alias, include it in references for NVD enrichment.
+            if (typeof adv.cve_id === 'string' && adv.cve_id) {
+                refs.push(`https://nvd.nist.gov/vuln/detail/${adv.cve_id}`);
+            }
+            list.push({
+                id: adv.ghsa_id,
+                source: 'ghsa',
+                summary: adv.summary || '',
+                affected,
+                cvssScore,
+                references: refs,
+            });
+        }
+        if (list.length > 0) {
+            const key = `${eco}:${p.name}@${p.version}`;
+            const existing = out.get(key) || [];
+            out.set(key, [...existing, ...list]);
+        }
+    }
+    return out;
+}
+/**
+ * Query the GitHub Advisory REST API for a single package.
+ *
+ * Uses optional authentication (GITHUB_TOKEN env or `gh auth token`)
+ * to lift the rate limit from 60/hr to 5000/hr. Without a token, the
+ * 60/hr limit is sufficient for enrichment (we only query packages OSV
+ * already flagged).
+ */
+async function queryGhsaRest(ecosystem, packageName) {
+    const url = `${GHSA_ADVISORIES_URL}?ecosystem=${encodeURIComponent(ecosystem)}&affected_package=${encodeURIComponent(packageName)}&per_page=${GHSA_PER_PAGE}`;
+    const headers = {
+        'Accept': 'application/vnd.github+json',
+        'User-Agent': 'SecureCode-Extension',
+    };
+    // Try to get a GitHub token for higher rate limits.
+    const token = await getGithubToken();
+    if (token) {
+        headers['Authorization'] = `Bearer ${token}`;
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), GHSA_TIMEOUT_MS);
+    try {
+        const r = await fetch(url, {
+            method: 'GET',
+            headers,
+            signal: controller.signal,
+        });
+        if (!r.ok)
+            return [];
+        const data = await r.json();
+        return Array.isArray(data) ? data : [];
+    }
+    catch {
+        return [];
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * Detect a GitHub token from env vars or `gh auth token`.
+ * Returns null if no token is available (unauthenticated mode).
+ */
+let _cachedToken;
+async function getGithubToken() {
+    if (_cachedToken !== undefined)
+        return _cachedToken;
+    // 1. Environment variables
+    const envToken = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+    if (envToken) {
+        _cachedToken = envToken;
+        return _cachedToken;
+    }
+    // 2. `gh auth token` (if gh CLI is installed and authenticated)
+    try {
+        _cachedToken = await new Promise(resolve => {
+            const child = cp.spawn('gh', ['auth', 'token'], { shell: true });
+            let stdout = '';
+            child.stdout.on('data', d => { stdout += d.toString(); });
+            child.on('error', () => resolve(null));
+            child.on('exit', code => {
+                const t = stdout.trim();
+                resolve(code === 0 && t ? t : null);
+            });
+        });
+    }
+    catch {
+        _cachedToken = null;
+    }
+    return _cachedToken;
+}
+/**
+ * With the REST API approach, GHSA is always "available" (works
+ * unauthenticated at 60 req/hr). Kept for backward compat with the
+ * `ghsaSkipped` flag in DependencyScanResult.
+ */
+async function ghCliAvailable() {
+    return true;
+}
+/**
+ * NVD CVSS fallback. Uses the public NVD REST endpoint keyed by CVE id.
+ *
+ * Cached in `workspaceState` for 24h to respect the public rate limit
+ * (5 req/30s without an API key). We only call NVD when an OSV record has
+ * a CVE alias but no CVSS score, to fill in the severity number.
+ */
+const NVD_CACHE_KEY_PREFIX = 'securecode.nvd.';
+const NVD_TTL_MS = 24 * 60 * 60 * 1000;
+async function nvdLookup(cveId) {
+    const url = `https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=${encodeURIComponent(cveId)}`;
+    try {
+        const r = await fetch(url, { headers: { 'User-Agent': 'SecureCode-Extension' } });
+        if (!r.ok)
+            return null;
+        const data = await r.json();
+        const vuln = data?.vulnerabilities?.[0]?.cve;
+        if (!vuln)
+            return null;
+        let score;
+        const metrics = vuln?.metrics;
+        const cvss = metrics?.cvssMetricV31?.[0] ?? metrics?.cvssMetricV30?.[0] ?? metrics?.cvssMetricV2?.[0];
+        if (cvss?.cvssData?.baseScore)
+            score = cvss.cvssData.baseScore;
+        const refs = Array.isArray(vuln?.references)
+            ? vuln.references.map((x) => x?.url).filter((y) => typeof y === 'string')
+            : [];
+        return { fetchedAt: Date.now(), score, url: refs[0] };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Enrich OSV records with NVD CVSS scores when missing, caching results
+ * in workspaceState for 24h.
+ *
+ * Mutates the records in place and returns them for convenience.
+ */
+async function enrichWithNvd(records, state) {
+    for (const v of records) {
+        if (v.cvssScore !== undefined)
+            continue;
+        // Only CVE-ids are resolvable on NVD.
+        if (!/^CVE-\d{4}-\d+$/i.test(v.id))
+            continue;
+        const cacheKey = NVD_CACHE_KEY_PREFIX + v.id;
+        const cached = state.get(cacheKey);
+        let entry;
+        if (cached && Date.now() - cached.fetchedAt < NVD_TTL_MS) {
+            entry = cached;
+        }
+        else {
+            entry = await nvdLookup(v.id);
+            if (entry)
+                state.update(cacheKey, entry);
+        }
+        if (entry?.score !== undefined) {
+            v.cvssScore = entry.score;
+            if (entry.url && (!v.references || v.references.length === 0)) {
+                v.references = [entry.url];
+            }
+        }
+    }
+    return records;
+}
+//# sourceMappingURL=osvClient.js.map

package/dist/dependency/osvClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"osvClient.js","sourceRoot":"","sources":["../../src/dependency/osvClient.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDA,sCAsHC;AAmBD,0CA0EC;AA4ED,wCAEC;AAyCD,sCA0BC;AAzZD,kDAAoC;AAIpC,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AAC/D,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,+BAA+B;AAC5D,MAAM,mBAAmB,GAAG,mCAAmC,CAAC;AAChE,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,uDAAuD;AACvD,wEAAwE;AACxE,yEAAyE;AACzE,gEAAgE;AAChE,MAAM,eAAe,GAAG,KAAK,CAAC;AAY9B;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAoB;IACxC,QAAQ,GAAG,CAAC,SAAS,EAAE,CAAC;QACpB,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM;YACP,OAAO,KAAK,CAAC;QACjB,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ;YACT,OAAO,MAAM,CAAC;QAClB;YACI,OAAO,IAAI,CAAC;IACpB,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,aAAa,CAC/B,QAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE/C,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAEvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC;QACrD,MAAM,OAAO,GAAe,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,WAAW,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEnC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACD,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;QAAC,MAAM,CAAC;YACL,SAAS;QACb,CAAC;QAED,IAAI,IAAI,GAA4B,IAAI,CAAC;QACzC,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,kBAAkB,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI;gBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;aAC5B,CAAC,CAAC;YACH,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACP,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAqB,CAAC;YAChD,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,kCAAkC;QACtC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QAEpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC;YACvB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC3C,MAAM,IAAI,GAAoB,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAoB,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;wBACzB,MAAM,MAAM,GAAU,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC;wBACtC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;4BACvB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gCAAE,SAAS;4BACzC,IAAI,UAA8B,CAAC;4BACnC,IAAI,KAAyB,CAAC;4BAC9B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gCAC1B,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ;oCAAE,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC;gCAClE,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ;oCAAE,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;4BACvD,CAAC;4BACD,QAAQ,CAAC,IAAI,CAAC;gCACV,SAAS,EAAG,CAAC,EAAE,OAAO,EAAE,SAA0B,IAAI,KAAK;gCAC3D,UAAU;gCACV,KAAK;gCACL,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;6BAC3B,CAAC,CAAC;wBACP,CAAC;oBACL,CAAC;gBACL,CAAC;gBACD,IAAI,SAA6B,CAAC;gBAClC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;wBACzB,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;4BACvD,0DAA0D;4BAC1D,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;4BAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gCACnD,SAAS,GAAG,GAAG,CAAC;4BACpB,CAAC;iCAAM,CAAC;gCACJ,4DAA4D;gCAC5D,qDAAqD;gCACrD,uDAAuD;gCACvD,uDAAuD;gCACvD,gCAAgC;gCAChC,mDAAmD;gCACnD,iCAAiC;4BACrC,CAAC;wBACL,CAAC;oBACL,CAAC;gBACL,CAAC;gBACD,MAAM,UAAU,GAAa,EAAE,CAAC;gBAChC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;wBAC7B,IAAI,OAAO,GAAG,EAAE,GAAG,KAAK,QAAQ;4BAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC/D,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC;oBACN,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;oBACxB,QAAQ;oBACR,SAAS;oBACT,UAAU;iBACb,CAAC,CAAC;YACP,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvB,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,UAAU,eAAe,CACjC,QAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE/C,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,KAAK,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5C,IAAI,UAAiB,CAAC;QACtB,IAAI,CAAC;YACD,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACL,SAAS;QACb,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACrD,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,EAAE,OAAO;gBAAE,SAAS;YAC5B,mDAAmD;YACnD,IAAI,SAA6B,CAAC;YAClC,IAAI,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACtC,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAC/B,CAAC;iBAAM,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC5C,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC;YAC/B,CAAC;YACD,kEAAkE;YAClE,MAAM,QAAQ,GAAoB,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,wBAAwB,KAAK,QAAQ;oBAC5D,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,qBAAqB,KAAK,QAAQ;oBACxD,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,oDAAoD;gBACpD,wDAAwD;gBACxD,IAAI,KAAyB,CAAC;gBAC9B,IAAI,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;oBACzD,IAAI,CAAC;wBAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxB,CAAC;gBACD,4DAA4D;gBAC5D,IAAI,UAA8B,CAAC;gBACnC,IAAI,QAAQ,EAAE,CAAC;oBACX,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;oBAC1D,IAAI,CAAC;wBAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7B,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,2BAA2B;YAC3B,MAAM,IAAI,GAAa,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;gBAChD,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAClF,CAAC,CAAC,EAAE,CAAC;YACT,uEAAuE;YACvE,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC/C,IAAI,CAAC,IAAI,CAAC,oCAAoC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC;gBACN,EAAE,EAAE,GAAG,CAAC,OAAO;gBACf,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE;gBAC1B,QAAQ;gBACR,SAAS;gBACT,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;QACP,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACpC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACzC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,WAAmB;IAC/D,MAAM,GAAG,GAAG,GAAG,mBAAmB,cAAc,kBAAkB,CAAC,SAAS,CAAC,qBAAqB,kBAAkB,CAAC,WAAW,CAAC,aAAa,aAAa,EAAE,CAAC;IAC9J,MAAM,OAAO,GAA2B;QACpC,QAAQ,EAAE,6BAA6B;QACvC,YAAY,EAAE,sBAAsB;KACvC,CAAC;IACF,oDAAoD;IACpD,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;IACrC,IAAI,KAAK,EAAE,CAAC;QACR,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,CAAC,CAAC;IACtE,IAAI,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,KAAK;YACb,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;YAAS,CAAC;QACP,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,IAAI,YAAuC,CAAC;AAC5C,KAAK,UAAU,cAAc;IACzB,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IACpD,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACX,YAAY,GAAG,QAAQ,CAAC;QACxB,OAAO,YAAY,CAAC;IACxB,CAAC;IACD,gEAAgE;IAChE,IAAI,CAAC;QACD,YAAY,GAAG,MAAM,IAAI,OAAO,CAAgB,OAAO,CAAC,EAAE;YACtD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACvC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACpB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxC,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAAC,MAAM,CAAC;QACL,YAAY,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,YAAY,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,cAAc;IAChC,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAC/C,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAIvC,KAAK,UAAU,SAAS,CAAC,KAAa;IAClC,MAAM,GAAG,GAAG,0DAA0D,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAClG,IAAI,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,IAAI,GAAQ,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,KAAyB,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;QACtG,IAAI,IAAI,EAAE,QAAQ,EAAE,SAAS;YAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/D,MAAM,IAAI,GAAa,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACnF,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,aAAa,CAC/B,OAAwB,EACxB,KAAiB;IAEjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,SAAS;QACxC,sCAAsC;QACtC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAE7C,MAAM,QAAQ,GAAG,oBAAoB,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAgB,QAAQ,CAAC,CAAC;QAClD,IAAI,KAA2B,CAAC;QAChC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,UAAU,EAAE,CAAC;YACvD,KAAK,GAAG,MAAM,CAAC;QACnB,CAAC;aAAM,CAAC;YACJ,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,KAAK;gBAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC;YAC1B,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC5D,CAAC,CAAC,UAAU,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC"}