@securecode-ai/mcp 0.2.1 → 0.3.1

package/dist/dependency/depCache.d.ts

@@ -0,0 +1,22 @@
+import { CacheStore } from './finding';
+/**
+ * A file-backed CacheStore. Loads the cache file lazily on first `get`,
+ * buffers updates in memory, and flushes to disk atomically on each
+ * `update`. Safe for the single-threaded MCP server; not safe for
+ * concurrent processes writing the same file.
+ */
+export declare class FileCacheStore implements CacheStore {
+    private workspaceRoot;
+    private cachePath;
+    private loaded;
+    private dirty;
+    constructor(workspaceRoot: string);
+    private load;
+    get<T>(key: string): T | undefined;
+    update(key: string, value: unknown): void;
+    /**
+     * Write the cache to disk atomically (.tmp + rename). Called after
+     * each `update` so a crash never loses more than the last entry.
+     */
+    private flush;
+}

package/dist/dependency/depCache.js

@@ -0,0 +1,115 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileCacheStore = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * File-based NVD CVSS cache for the MCP server.
+ *
+ * The extension uses `vscode.Memento` (workspaceState) for this. The MCP
+ * server has no VS Code API, so we store the cache as a JSON file at
+ * `.securecode/nvd-cache.json` inside the workspace root.
+ *
+ * Implements the `CacheStore` interface ({ get, update }) that
+ * `enrichWithNvd` expects.
+ */
+const CACHE_DIR = '.securecode';
+const CACHE_FILE = 'nvd-cache.json';
+const SCHEMA_VERSION = 1;
+/**
+ * A file-backed CacheStore. Loads the cache file lazily on first `get`,
+ * buffers updates in memory, and flushes to disk atomically on each
+ * `update`. Safe for the single-threaded MCP server; not safe for
+ * concurrent processes writing the same file.
+ */
+class FileCacheStore {
+    workspaceRoot;
+    cachePath;
+    loaded = null;
+    dirty = false;
+    constructor(workspaceRoot) {
+        this.workspaceRoot = workspaceRoot;
+        this.cachePath = path.join(workspaceRoot, CACHE_DIR, CACHE_FILE);
+    }
+    load() {
+        if (this.loaded)
+            return this.loaded;
+        try {
+            if (fs.existsSync(this.cachePath)) {
+                const raw = fs.readFileSync(this.cachePath, 'utf8');
+                const parsed = JSON.parse(raw);
+                if (parsed.version === SCHEMA_VERSION && parsed.entries) {
+                    this.loaded = parsed;
+                    return this.loaded;
+                }
+            }
+        }
+        catch { /* file corrupt or missing — start fresh */ }
+        this.loaded = { version: SCHEMA_VERSION, entries: {} };
+        return this.loaded;
+    }
+    get(key) {
+        const cache = this.load();
+        return cache.entries[key];
+    }
+    update(key, value) {
+        const cache = this.load();
+        cache.entries[key] = value;
+        this.dirty = true;
+        this.flush();
+    }
+    /**
+     * Write the cache to disk atomically (.tmp + rename). Called after
+     * each `update` so a crash never loses more than the last entry.
+     */
+    flush() {
+        if (!this.dirty || !this.loaded)
+            return;
+        try {
+            const dir = path.join(this.workspaceRoot, CACHE_DIR);
+            if (!fs.existsSync(dir)) {
+                fs.mkdirSync(dir, { recursive: true });
+            }
+            const tmp = this.cachePath + '.tmp';
+            fs.writeFileSync(tmp, JSON.stringify(this.loaded, null, 2), 'utf8');
+            fs.renameSync(tmp, this.cachePath);
+            this.dirty = false;
+        }
+        catch { /* best effort — cache is optional */ }
+    }
+}
+exports.FileCacheStore = FileCacheStore;
+//# sourceMappingURL=depCache.js.map

package/dist/dependency/depCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"depCache.js","sourceRoot":"","sources":["../../src/dependency/depCache.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAG7B;;;;;;;;;GASG;AAEH,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,MAAM,cAAc,GAAG,CAAC,CAAC;AAOzB;;;;;GAKG;AACH,MAAa,cAAc;IACf,aAAa,CAAS;IACtB,SAAS,CAAS;IAClB,MAAM,GAAqB,IAAI,CAAC;IAChC,KAAK,GAAG,KAAK,CAAC;IAEtB,YAAY,aAAqB;QAC7B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACrE,CAAC;IAEO,IAAI;QACR,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,CAAC;YACD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;gBAC5C,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACtD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;oBACrB,OAAO,IAAI,CAAC,MAAM,CAAC;gBACvB,CAAC;YACL,CAAC;QACL,CAAC;QAAC,MAAM,CAAC,CAAC,2CAA2C,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,GAAG,CAAI,GAAW;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAkB,CAAC;IAC/C,CAAC;IAED,MAAM,CAAC,GAAW,EAAE,KAAc;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAA4D,CAAC;QAClF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACxC,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;YACpC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACpE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;IACrD,CAAC;CACJ;AAxDD,wCAwDC"}

package/dist/dependency/dependencyChecker.d.ts

@@ -0,0 +1,48 @@
+import { ScanFinding, CacheStore } from './finding';
+import { ResolvedPackage, Vulnerability } from './types';
+import { LicensePolicyMode } from './licensePolicy';
+export interface DependencyScanOptions {
+    /** Workspace root to scan recursively for lockfiles. */
+    workspaceRoot: string;
+    /** VS Code memento (workspaceState) for NVD CVSS caching. */
+    state: CacheStore;
+    /** License policy mode (off | warn | error). Default 'warn'. */
+    licensePolicy?: LicensePolicyMode;
+    /** Whether to also query GitHub Advisory via `gh` CLI. Default true (skips gracefully if gh absent). */
+    useGhsa?: boolean;
+}
+export interface DependencyScanResult {
+    /** ScanFinding-shaped records (source: 'dependency'), ready for the unified panel. */
+    findings: ScanFinding[];
+    /** Raw matched vulnerabilities keyed by `${ecosystem}:${name}@${version}` (for diagnostics). */
+    matches: Map<string, Vulnerability[]>;
+    /** Number of packages scanned (excluding unresolved). */
+    packageCount: number;
+    /** Number of packages marked unresolved (unpinned requirements.txt, etc.). */
+    unresolvedCount: number;
+    /** Parsed lockfile paths. */
+    lockfiles: string[];
+    /** All resolved packages (for Apply affordance lookups). */
+    packages: ResolvedPackage[];
+    /** True when GHSA enrichment was skipped because `gh` is not installed. */
+    ghsaSkipped?: boolean;
+}
+/**
+ * Run the full dependency vulnerability check.
+ *
+ * Pipeline:
+ *   1. Find lockfiles in the workspace.
+ *   2. Parse each one (returns the full resolved transitive tree).
+ *   3. Resolve + dedupe across lockfiles (npm-family collapses; pip-family collapses).
+ *   4. Batch-query OSV.dev (name + version only — no source code leaves the machine).
+ *   5. Optionally enrich with GHSA via `gh` CLI (graceful skip if absent).
+ *   6. Fill in missing CVSS via NVD (24h workspaceState cache).
+ *   7. Compute min-safe-version for each matched vulnerable package.
+ *   8. Run license policy check (default 'warn') against the project license.
+ *   9. Produce ScanFinding[] records with source: 'dependency' and a
+ *      dependency{...} block carrying everything the Apply affordance needs.
+ *
+ * No AI calls, no API changes. OSV and NVD are the only network egress, and
+ * only package names + versions go to them.
+ */
+export declare function scanDependencies(opts: DependencyScanOptions): Promise<DependencyScanResult>;

package/dist/dependency/dependencyChecker.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanDependencies = scanDependencies;
+const resolver_1 = require("./resolver");
+const osvClient_1 = require("./osvClient");
+const minSafeVersion_1 = require("./minSafeVersion");
+const licensePolicy_1 = require("./licensePolicy");
+/**
+ * Run the full dependency vulnerability check.
+ *
+ * Pipeline:
+ *   1. Find lockfiles in the workspace.
+ *   2. Parse each one (returns the full resolved transitive tree).
+ *   3. Resolve + dedupe across lockfiles (npm-family collapses; pip-family collapses).
+ *   4. Batch-query OSV.dev (name + version only — no source code leaves the machine).
+ *   5. Optionally enrich with GHSA via `gh` CLI (graceful skip if absent).
+ *   6. Fill in missing CVSS via NVD (24h workspaceState cache).
+ *   7. Compute min-safe-version for each matched vulnerable package.
+ *   8. Run license policy check (default 'warn') against the project license.
+ *   9. Produce ScanFinding[] records with source: 'dependency' and a
+ *      dependency{...} block carrying everything the Apply affordance needs.
+ *
+ * No AI calls, no API changes. OSV and NVD are the only network egress, and
+ * only package names + versions go to them.
+ */
+async function scanDependencies(opts) {
+    const policy = opts.licensePolicy ?? 'warn';
+    const useGhsa = opts.useGhsa !== false;
+    // Map an Ecosystem to its OSV family name. npm-family collapses to 'npm',
+    // pip-family collapses to 'PyPI'.
+    const ecosystemFamilyOf = (e) => e === 'pip' || e === 'pipenv' ? 'PyPI' : 'npm';
+    // 1. Find lockfiles.
+    const found = (0, resolver_1.findLockfiles)(opts.workspaceRoot);
+    const lockfilePaths = [
+        ...found.npm, ...found.yarn, ...found.pnpm, ...found.pipenv, ...found.pip,
+    ];
+    // 2. Parse.
+    const parsed = lockfilePaths
+        .map(resolver_1.parseLockfile)
+        .filter((p) => p !== null);
+    // 3. Resolve + dedupe.
+    const packages = (0, resolver_1.resolveAll)(parsed);
+    const unresolved = packages.filter(p => p.unresolved);
+    const queryable = packages.filter(p => !p.unresolved);
+    // 4. OSV batch.
+    const osvMap = await (0, osvClient_1.queryOsvBatch)(queryable);
+    // 5. GHSA via REST API (best-effort enrichment).
+    // Only query packages that OSV flagged as vulnerable — GHSA is an
+    // enrichment source, not a primary source. This keeps the request
+    // count low (typically 5-30 packages) and within the 60 req/hr
+    // unauthenticated GitHub rate limit.
+    let ghsaMap = new Map();
+    let ghsaSkipped = false;
+    if (useGhsa) {
+        // Collect packages that OSV found vulnerabilities for.
+        const osvFlagged = queryable.filter(p => {
+            const fam = ecosystemFamilyOf(p.ecosystem);
+            const key = `${fam}:${p.name}@${p.version}`;
+            return osvMap.has(key);
+        });
+        if (osvFlagged.length > 0) {
+            if (await (0, osvClient_1.ghCliAvailable)()) {
+                try {
+                    ghsaMap = await (0, osvClient_1.queryGhsaViaCli)(osvFlagged);
+                }
+                catch {
+                    // ignore — OSV data already includes GHSA records most of the time.
+                }
+            }
+            else {
+                ghsaSkipped = true;
+            }
+        }
+    }
+    // 6. Merge OSV + GHSA per package key, dedupe by vuln id.
+    const matches = new Map();
+    const allKeys = new Set([...osvMap.keys(), ...ghsaMap.keys()]);
+    for (const key of allKeys) {
+        const osvList = osvMap.get(key) || [];
+        const ghsaList = ghsaMap.get(key) || [];
+        const merged = [];
+        const seenIds = new Set();
+        for (const v of [...osvList, ...ghsaList]) {
+            if (seenIds.has(v.id))
+                continue;
+            seenIds.add(v.id);
+            merged.push(v);
+        }
+        // NVD enrichment (cached).
+        await (0, osvClient_1.enrichWithNvd)(merged, opts.state);
+        matches.set(key, merged);
+    }
+    // 7. Compute min-safe-version and build vulnerability findings.
+    const findings = [];
+    // For each package with vulnerabilities, produce ONE rolled-up finding
+    // (not one per CVE) to keep the sidebar readable. The dependency block
+    // carries the worst CVE id + the min-safe-version; the message carries
+    // the upgrade suggestion.
+    // Sort: highest CVSS first so the most severe is the "rolled-up" id.
+    for (const pkg of queryable) {
+        const fam = ecosystemFamilyOf(pkg.ecosystem);
+        const key = `${fam}:${pkg.name}@${pkg.version}`;
+        const vulns = matches.get(key);
+        if (!vulns || vulns.length === 0)
+            continue;
+        const sortedVulns = vulns.slice().sort((a, b) => (b.cvssScore ?? 0) - (a.cvssScore ?? 0));
+        const worst = sortedVulns[0];
+        const minSafe = (0, minSafeVersion_1.computeMinSafeVersion)(pkg, sortedVulns);
+        const severity = (worst.cvssScore ?? 0) >= 7 ? 'ERROR' : 'WARNING';
+        const vulnCount = sortedVulns.length;
+        const cveList = sortedVulns.map(v => v.id).slice(0, 5).join(', ');
+        const message = minSafe
+            ? `${(0, minSafeVersion_1.upgradeSuggestion)(pkg, minSafe)} — ${vulnCount} vulnerable ${vulnCount === 1 ? 'advisory' : 'advisories'}: ${cveList}`
+            : `${pkg.name}@${pkg.version} has ${vulnCount} vulnerable ${vulnCount === 1 ? 'advisory' : 'advisories'} with NO known fix: ${cveList}`;
+        findings.push({
+            check_id: `dep.${worst.id}`,
+            severity,
+            message,
+            start: { line: 1, col: 1 },
+            end: { line: 1, col: 1 },
+            source: 'dependency',
+            dependency: {
+                ecosystem: pkg.ecosystem,
+                name: pkg.name,
+                installedVersion: pkg.version,
+                fixedVersion: minSafe,
+                license: pkg.license,
+                manifestPath: pkg.manifestPath,
+                unresolved: pkg.unresolved,
+            },
+        });
+    }
+    // Unresolved requirements.txt entries -> a single warning per package
+    // so the user knows why those weren't queried against OSV.
+    for (const pkg of unresolved) {
+        findings.push({
+            check_id: `dep.unresolved.${pkg.name}`,
+            severity: 'WARNING',
+            message: `Cannot resolve ${pkg.name} version from ${pkg.manifestPath || 'requirements'} (pin it with == or use a lockfile) — skipped from OSV scan`,
+            start: { line: 1, col: 1 },
+            end: { line: 1, col: 1 },
+            source: 'dependency',
+            dependency: {
+                ecosystem: pkg.ecosystem,
+                name: pkg.name,
+                installedVersion: pkg.version || '',
+                license: pkg.license,
+                manifestPath: pkg.manifestPath,
+                unresolved: true,
+            },
+        });
+    }
+    // 8. License policy.
+    // Use the most permissive-looking projectLicense discovered across lockfiles
+    // (the first one — typically package.json's). If there are multiple projects,
+    // license findings are produced per-package and the policy is conservative.
+    let projectLicense;
+    for (const lf of parsed) {
+        if (lf.projectLicense) {
+            projectLicense = lf.projectLicense;
+            break;
+        }
+    }
+    const licenseFindings = (0, licensePolicy_1.checkLicenses)(packages, projectLicense, policy);
+    for (const lf of licenseFindings) {
+        findings.push(licenseFindingToScanFinding(lf));
+    }
+    return {
+        findings,
+        matches,
+        packageCount: queryable.length,
+        unresolvedCount: unresolved.length,
+        lockfiles: lockfilePaths,
+        packages,
+        ...(ghsaSkipped ? { ghsaSkipped: true } : {}),
+    };
+}
+function licenseFindingToScanFinding(lf) {
+    return {
+        check_id: `dep.license.${lf.package.name}`,
+        severity: lf.severity === 'ERROR' ? 'ERROR' : 'WARNING',
+        message: lf.reason,
+        start: { line: 1, col: 1 },
+        end: { line: 1, col: 1 },
+        source: 'dependency',
+        dependency: {
+            ecosystem: lf.package.ecosystem,
+            name: lf.package.name,
+            installedVersion: lf.package.version,
+            license: lf.license,
+            manifestPath: lf.package.manifestPath,
+            unresolved: lf.package.unresolved,
+        },
+    };
+}
+//# sourceMappingURL=dependencyChecker.js.map

package/dist/dependency/dependencyChecker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencyChecker.js","sourceRoot":"","sources":["../../src/dependency/dependencyChecker.ts"],"names":[],"mappings":";;AAyDA,4CAoKC;AA3ND,yCAA0F;AAC1F,2CAA4F;AAC5F,qDAA4E;AAC5E,mDAIyB;AA8BzB;;;;;;;;;;;;;;;;;GAiBG;AACI,KAAK,UAAU,gBAAgB,CAAC,IAA2B;IAC9D,MAAM,MAAM,GAAsB,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;IAEvC,0EAA0E;IAC1E,kCAAkC;IAClC,MAAM,iBAAiB,GAAG,CAAC,CAAY,EAAkB,EAAE,CACvD,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAEnD,qBAAqB;IACrB,MAAM,KAAK,GAAuB,IAAA,wBAAa,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG;QAClB,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG;KAC5E,CAAC;IAEF,YAAY;IACZ,MAAM,MAAM,GAAG,aAAa;SACvB,GAAG,CAAC,wBAAa,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAE3D,uBAAuB;IACvB,MAAM,QAAQ,GAAG,IAAA,qBAAU,EAAC,MAAM,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAEtD,gBAAgB;IAChB,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAC;IAE9C,iDAAiD;IACjD,kEAAkE;IAClE,kEAAkE;IAClE,+DAA+D;IAC/D,qCAAqC;IACrC,IAAI,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,OAAO,EAAE,CAAC;QACV,uDAAuD;QACvD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACpC,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,MAAM,IAAA,0BAAc,GAAE,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACD,OAAO,GAAG,MAAM,IAAA,2BAAe,EAAC,UAAU,CAAC,CAAC;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACL,oEAAoE;gBACxE,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,WAAW,GAAG,IAAI,CAAC;YACvB,CAAC;QACL,CAAC;IACL,CAAC;IAED,0DAA0D;IAC1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,SAAS;YAChC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QACD,2BAA2B;QAC3B,MAAM,IAAA,yBAAa,EAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,gEAAgE;IAChE,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,0BAA0B;IAE1B,qEAAqE;IACrE,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE3C,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAA,sCAAqB,EAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAwB,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC;QACrC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,OAAO;YACnB,CAAC,CAAC,GAAG,IAAA,kCAAiB,EAAC,GAAG,EAAE,OAAO,CAAC,MAAM,SAAS,eAAe,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,KAAK,OAAO,EAAE;YAC3H,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,QAAQ,SAAS,eAAe,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,uBAAuB,OAAO,EAAE,CAAC;QAE5I,QAAQ,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,OAAO,KAAK,CAAC,EAAE,EAAE;YAC3B,QAAQ;YACR,OAAO;YACP,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;YAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;YACxB,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE;gBACR,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,gBAAgB,EAAE,GAAG,CAAC,OAAO;gBAC7B,YAAY,EAAE,OAAO;gBACrB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;aAC7B;SACJ,CAAC,CAAC;IACP,CAAC;IAED,sEAAsE;IACtE,2DAA2D;IAC3D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,kBAAkB,GAAG,CAAC,IAAI,EAAE;YACtC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,kBAAkB,GAAG,CAAC,IAAI,iBAAiB,GAAG,CAAC,YAAY,IAAI,cAAc,6DAA6D;YACnJ,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;YAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;YACxB,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE;gBACR,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,gBAAgB,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE;gBACnC,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,IAAI;aACnB;SACJ,CAAC,CAAC;IACP,CAAC;IAED,qBAAqB;IACrB,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,cAAkC,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACtB,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,EAAE,CAAC,cAAc,CAAC;YACnC,MAAM;QACV,CAAC;IACL,CAAC;IACD,MAAM,eAAe,GAAG,IAAA,6BAAa,EAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IACxE,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACH,QAAQ;QACR,OAAO;QACP,YAAY,EAAE,SAAS,CAAC,MAAM;QAC9B,eAAe,EAAE,UAAU,CAAC,MAAM;QAClC,SAAS,EAAE,aAAa;QACxB,QAAQ;QACR,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;AACN,CAAC;AAED,SAAS,2BAA2B,CAAC,EAAkB;IACnD,OAAO;QACH,QAAQ,EAAE,eAAe,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE;QAC1C,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACvD,OAAO,EAAE,EAAE,CAAC,MAAM;QAClB,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;QAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;QACxB,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE;YACR,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS;YAC/B,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI;YACrB,gBAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO;YACpC,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,YAAY,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY;YACrC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU;SACpC;KACJ,CAAC;AACN,CAAC"}

package/dist/dependency/finding.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Shared types for the MCP dependency scanner.
+ *
+ * ScanFinding is copied from the extension's apiClient.ts (line 74-97) to
+ * avoid importing that file, which drags in `axios` and `vscode` — neither
+ * available in the MCP server.
+ *
+ * CacheStore replaces the extension's `vscode.Memento` dependency. The MCP
+ * server implements this with a file-based cache (depCache.ts).
+ */
+export interface ScanFinding {
+    check_id: string;
+    severity: 'ERROR' | 'WARNING';
+    message: string;
+    start: {
+        line: number;
+        col: number;
+    };
+    end: {
+        line: number;
+        col: number;
+    };
+    source?: 'code' | 'dependency';
+    dependency?: {
+        ecosystem: 'npm' | 'yarn' | 'pnpm' | 'pip' | 'pipenv';
+        name: string;
+        installedVersion: string;
+        fixedVersion?: string;
+        license?: string;
+        manifestPath?: string;
+        unresolved?: boolean;
+    };
+}
+/**
+ * Minimal cache interface — the only part of `vscode.Memento` the dependency
+ * checker uses (`get<T>(key)` and `update(key, value)`). The MCP server
+ * implements this with a file-based JSON cache (see depCache.ts).
+ */
+export interface CacheStore {
+    get<T>(key: string): T | undefined;
+    update(key: string, value: unknown): Promise<void> | void;
+}

package/dist/dependency/finding.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Shared types for the MCP dependency scanner.
+ *
+ * ScanFinding is copied from the extension's apiClient.ts (line 74-97) to
+ * avoid importing that file, which drags in `axios` and `vscode` — neither
+ * available in the MCP server.
+ *
+ * CacheStore replaces the extension's `vscode.Memento` dependency. The MCP
+ * server implements this with a file-based cache (depCache.ts).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=finding.js.map

package/dist/dependency/finding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.js","sourceRoot":"","sources":["../../src/dependency/finding.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG"}

package/dist/dependency/licensePolicy.d.ts

@@ -0,0 +1,56 @@
+import { ResolvedPackage } from './types';
+/**
+ * SPDX license policy.
+ *
+ * Default behavior (matching the `secureCode.licensePolicy` setting):
+ *   - "off":    no license findings are produced.
+ *   "warn":     produce a WARNING-severity finding for copyleft licenses
+ *               (GPL/AGPL/LGPL/Mozilla/Eclipse/Commons-Clause/CC-BY-NC, etc.)
+ *               in projects that look proprietary (no license field, or a
+ *               non-OSI/non-copyleft license field).
+ *   "error":    same, but ERROR severity.
+ *
+ * The "looks proprietary" test is conservative: if the project's own
+ * `projectLicense` is missing or is a permissive/proprietary-ish license
+ * (MIT, ISC, Apache-2.0, BSD-*, UNLICENSED, proprietary, or absent), then
+ * a copyleft transitive dep is flagged. If the project itself is GPL,
+ * GPL deps are fine and not flagged.
+ */
+export type LicensePolicyMode = 'off' | 'warn' | 'error';
+export interface LicenseFinding {
+    package: ResolvedPackage;
+    /** SPDX license id (or the raw string if not SPDX-valid). */
+    license: string;
+    /** True when the license matches a copyleft/restrictive prefix. */
+    copyleft: boolean;
+    /** Why this package was flagged. */
+    reason: string;
+    /** Severity the caller should use. */
+    severity: 'ERROR' | 'WARNING' | 'INFO';
+}
+/**
+ * Project-level license classifier: does it look proprietary?
+ *   - No license field -> yes (likely proprietary).
+ *   - A permissive license (MIT, ISC, Apache-2.0, BSD, ...) -> yes (the
+ *     presence of copyleft deps creates a conflict).
+ *   - A copyleft license -> no (GPL deps in a GPL project are fine).
+ */
+export declare function projectLooksProprietary(projectLicense: string | undefined): boolean;
+/** Does a SPDX/license string match a copyleft/restrictive prefix? */
+export declare function isCopyleft(license: string | undefined): boolean;
+/**
+ * Produce license findings for copyleft dependencies under the configured policy.
+ *
+ * `projectLicense` is the project's own SPDX string (from package.json/Pipfile);
+ * undefined when not discoverable.
+ *
+ * Returns one LicenseFinding per copyleft package when:
+ *   - policy !== 'off', AND
+ *   - the project looks proprietary, AND
+ *   - the package has a license string that matches a copyleft prefix.
+ *
+ * Packages with no license at all are NOT flagged here (we can't tell), and
+ * packages with non-copyleft licenses are not flagged. This is the
+ * GPL-in-a-commercial-project detector from the spec.
+ */
+export declare function checkLicenses(packages: ResolvedPackage[], projectLicense: string | undefined, policy: LicensePolicyMode): LicenseFinding[];

package/dist/dependency/licensePolicy.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.projectLooksProprietary = projectLooksProprietary;
+exports.isCopyleft = isCopyleft;
+exports.checkLicenses = checkLicenses;
+const spdxCorrect = require("spdx-correct");
+/**
+ * Normalize a license string to a canonical SPDX id when possible.
+ * e.g. "GPLv3" -> "GPL-3.0-only", "Apache 2.0" -> "Apache-2.0".
+ * Returns the original string (trimmed) if spdx-correct can't normalize it,
+ * so the copyleft prefix matcher still gets a chance to flag obvious cases.
+ */
+function normalizeSpdx(license) {
+    if (!license)
+        return undefined;
+    const trimmed = license.trim();
+    if (!trimmed)
+        return undefined;
+    try {
+        const corrected = spdxCorrect(trimmed);
+        return corrected || trimmed;
+    }
+    catch {
+        return trimmed;
+    }
+}
+/**
+ * Copyleft / restrictive SPDX identifiers (and well-known non-OSI ones)
+ * that we flag in proprietary-looking projects. Matched case-insensitively
+ * against the SPDX id's case-insensitive prefix.
+ */
+const COPYLEFT_PREFIXES = [
+    'GPL-', 'AGPL-', 'LGPL-', 'MPL-', 'EPL-', 'CDDL-', 'CPL-',
+    'CC-BY-NC', 'CC-BY-SA', 'CC-BY-ND', 'COMMONS-CLAUSE',
+    'BUSL-', 'SSPL-', 'RSAL-', 'JSON', 'EUPL-',
+];
+/** Permissive / proprietary-looking licenses where a copyleft dep is flagged. */
+const PERMISSIVE_OR_PROPRIETARY = new Set([
+    'MIT', 'ISC', 'Apache-2.0', 'BSD-2-Clause', 'BSD-3-Clause', '0BSD',
+    'Unlicense', 'UNLICENSED', 'SEE LICENSE IN LICENSE', 'SEE-LICENSE-IN-LICENSE',
+    'PROPRIETARY', 'COMMERCIAL',
+]);
+/**
+ * Project-level license classifier: does it look proprietary?
+ *   - No license field -> yes (likely proprietary).
+ *   - A permissive license (MIT, ISC, Apache-2.0, BSD, ...) -> yes (the
+ *     presence of copyleft deps creates a conflict).
+ *   - A copyleft license -> no (GPL deps in a GPL project are fine).
+ */
+function projectLooksProprietary(projectLicense) {
+    const norm = normalizeSpdx(projectLicense);
+    if (!norm)
+        return true;
+    if (PERMISSIVE_OR_PROPRIETARY.has(norm.toUpperCase()))
+        return true;
+    // Copyleft-looking project license -> not proprietary.
+    const up = norm.toUpperCase();
+    if (COPYLEFT_PREFIXES.some(p => up.startsWith(p)))
+        return false;
+    // Anything else -> treat as proprietary to be safe.
+    return true;
+}
+/** Does a SPDX/license string match a copyleft/restrictive prefix? */
+function isCopyleft(license) {
+    const norm = normalizeSpdx(license);
+    if (!norm)
+        return false;
+    const up = norm.toUpperCase();
+    return COPYLEFT_PREFIXES.some(p => up.startsWith(p));
+}
+/**
+ * Produce license findings for copyleft dependencies under the configured policy.
+ *
+ * `projectLicense` is the project's own SPDX string (from package.json/Pipfile);
+ * undefined when not discoverable.
+ *
+ * Returns one LicenseFinding per copyleft package when:
+ *   - policy !== 'off', AND
+ *   - the project looks proprietary, AND
+ *   - the package has a license string that matches a copyleft prefix.
+ *
+ * Packages with no license at all are NOT flagged here (we can't tell), and
+ * packages with non-copyleft licenses are not flagged. This is the
+ * GPL-in-a-commercial-project detector from the spec.
+ */
+function checkLicenses(packages, projectLicense, policy) {
+    if (policy === 'off')
+        return [];
+    if (!projectLooksProprietary(projectLicense))
+        return [];
+    const out = [];
+    const severity = policy === 'error' ? 'ERROR' : 'WARNING';
+    for (const p of packages) {
+        if (!p.license)
+            continue;
+        if (!isCopyleft(p.license))
+            continue;
+        const normalized = normalizeSpdx(p.license) || p.license;
+        out.push({
+            package: p,
+            license: normalized,
+            copyleft: true,
+            reason: `Copyleft license "${normalized}" on "${p.name}" conflicts with this project's ${projectLicense ? `"${projectLicense}"` : 'unspecified'} license.`,
+            severity,
+        });
+    }
+    return out;
+}
+//# sourceMappingURL=licensePolicy.js.map

package/dist/dependency/licensePolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"licensePolicy.js","sourceRoot":"","sources":["../../src/dependency/licensePolicy.ts"],"names":[],"mappings":";;AA8EA,0DASC;AAGD,gCAKC;AAiBD,sCAyBC;AAxID,4CAA6C;AAE7C;;;;;GAKG;AACH,SAAS,aAAa,CAAC,OAA2B;IAC9C,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,SAAS,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,OAAO,CAAC;IACnB,CAAC;AACL,CAAC;AAsBD;;;;GAIG;AACH,MAAM,iBAAiB,GAAG;IACtB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACzD,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB;IACpD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;CAC7C,CAAC;AAEF,iFAAiF;AACjF,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACtC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM;IAClE,WAAW,EAAE,YAAY,EAAE,wBAAwB,EAAE,wBAAwB;IAC7E,aAAa,EAAE,YAAY;CAC9B,CAAC,CAAC;AAcH;;;;;;GAMG;AACH,SAAgB,uBAAuB,CAAC,cAAkC;IACtE,MAAM,IAAI,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,uDAAuD;IACvD,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC9B,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,oDAAoD;IACpD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,sEAAsE;AACtE,SAAgB,UAAU,CAAC,OAA2B;IAClD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC9B,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,aAAa,CACzB,QAA2B,EAC3B,cAAkC,EAClC,MAAyB;IAEzB,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC;QAAE,OAAO,EAAE,CAAC;IAExD,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAwB,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,SAAS;QACzB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,SAAS;QACrC,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;QACzD,GAAG,CAAC,IAAI,CAAC;YACL,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,qBAAqB,UAAU,SAAS,CAAC,CAAC,IAAI,mCAClD,cAAc,CAAC,CAAC,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,CAAC,aAC7C,WAAW;YACX,QAAQ;SACX,CAAC,CAAC;IACP,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}