@sikkuumiii/defuse 0.0.0-stage → 0.5.0

package/dist/src/platform/deps.js

@@ -0,0 +1,304 @@
+/**
+ * THE DEPENDENCY CHECK: DO THE LIBRARIES THIS PROJECT PINS HAVE KNOWN ADVISORIES?
+ * ==============================================================================
+ *
+ * Every other check reads the code a project wrote. Most of what a project
+ * runs, it did not write: it is in the lockfile. This reads the versions a
+ * lockfile pins and asks OSV (osv.dev, the open advisory database behind
+ * OSV-Scanner) which of them have published advisories.
+ *
+ * WHY IT IS A SEPARATE COMMAND. It is the one check that talks to the network.
+ * `defuse scan` promises nothing leaves the machine, and keeps that promise;
+ * `defuse deps` sends package names and versions - never code - to api.osv.dev,
+ * and says so before it does.
+ *
+ * WHAT IT CAN AND CANNOT CLAIM. A pinned version that matches an advisory says
+ * the vulnerable code is installed. It says nothing about whether this project
+ * ever calls it. Signature-grade by nature, and every result says so.
+ *
+ * Lockfiles it recognises but cannot read yet are listed by name, and lines it
+ * could not read are counted with the reason - never silently skipped.
+ */
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { signatureFinding } from '../core/finding.js';
+import { DEPENDENCY_RULE } from './dependency-rule.js';
+import { globToRegExp } from '../engine/walk.js';
+export { DEPENDENCY_RULE };
+/** A version that is a release, not a path, URL or branch. */
+const RELEASE = /^v?\d/;
+const READERS = {
+    'package-lock.json': (text, file) => {
+        const lock = JSON.parse(text);
+        const found = [];
+        if (lock.packages) {
+            for (const [key, p] of Object.entries(lock.packages)) {
+                if (key === '' || p.link || !p.version)
+                    continue; // the project itself, or a workspace link
+                found.push([p.name ?? key.slice(key.lastIndexOf('node_modules/') + 'node_modules/'.length), p.version]);
+            }
+        }
+        else {
+            const walk = (deps) => {
+                for (const [name, d] of Object.entries(deps ?? {})) {
+                    if (d.version)
+                        found.push([name, d.version]);
+                    walk(d.dependencies);
+                }
+            };
+            walk(lock.dependencies);
+        }
+        return split(found, 'npm', file);
+    },
+    'composer.lock': (text, file) => {
+        const lock = JSON.parse(text);
+        const all = [...(lock['packages'] ?? []), ...(lock['packages-dev'] ?? [])];
+        return split(all.map((p) => [p.name, p.version]), 'Packagist', file);
+    },
+    'requirements.txt': (text, file) => {
+        const packages = [];
+        const skipped = [];
+        for (const raw of text.split(/\r?\n/)) {
+            const line = raw.replace(/\s+#.*$/, '').trim();
+            if (!line || line.startsWith('#'))
+                continue;
+            if (line.startsWith('-')) {
+                skipped.push(`${line} - an option line (-r, -e, --index-url...), not followed`);
+                continue;
+            }
+            const m = /^([A-Za-z0-9._-]+)(?:\[[^\]]*\])?\s*==\s*([^\s;,]+)$/.exec(line.split(';')[0].trim());
+            if (m)
+                packages.push({ name: m[1], version: m[2], ecosystem: 'PyPI', file });
+            else
+                skipped.push(`${line} - not pinned with ==, so the installed version is unknown`);
+        }
+        return { packages, skipped };
+    },
+    'go.mod': (text, file) => {
+        const found = [];
+        let inRequire = false;
+        for (const raw of text.split(/\r?\n/)) {
+            const line = raw.replace(/\/\/.*$/, '').trim();
+            if (/^require\s*\($/.test(line))
+                inRequire = true;
+            else if (inRequire && line === ')')
+                inRequire = false;
+            else {
+                const m = (inRequire ? /^(\S+)\s+(\S+)$/ : /^require\s+(\S+)\s+(\S+)$/).exec(line);
+                if (m)
+                    found.push([m[1], m[2]]);
+            }
+        }
+        const result = split(found, 'Go', file);
+        if (/^replace\b/m.test(text)) {
+            result.skipped.push('replace directives - not applied, so a replaced module is checked at its required version');
+        }
+        return result;
+    },
+};
+function split(found, ecosystem, file) {
+    const packages = [];
+    const skipped = [];
+    for (const [name, version] of found) {
+        if (RELEASE.test(version))
+            packages.push({ name, version, ecosystem, file });
+        else
+            skipped.push(`${name} ${version} - not a release version (a path, URL or branch)`);
+    }
+    return { packages, skipped };
+}
+/** Recognised by name, not read yet. Listed in the output, never ignored in silence. */
+export const UNREAD_LOCKFILES = new Set([
+    'yarn.lock', 'pnpm-lock.yaml', 'npm-shrinkwrap.json', 'Pipfile.lock', 'poetry.lock', 'uv.lock',
+    'Cargo.lock', 'Gemfile.lock', 'pom.xml', 'build.gradle', 'build.gradle.kts', 'gradle.lockfile',
+    'packages.lock.json',
+]);
+const SKIP_DIRS = new Set(['node_modules', 'vendor', '.git', '.venv', 'venv', '__pycache__']);
+/** Parse one lockfile by its file name. Null when the name is not one this reads. */
+export function readLockfile(file, text) {
+    const reader = READERS[path.basename(file)];
+    if (!reader)
+        return null;
+    try {
+        return { file, ...reader(text, file) };
+    }
+    catch (error) {
+        return { file, packages: [], skipped: [`the whole file - it did not parse: ${error.message}`] };
+    }
+}
+/** Every lockfile under `target`, read; plus the recognised ones that are not. `exclude` means what scan --exclude means. */
+export function findLockfiles(target, exclude = []) {
+    const read = [];
+    const unread = [];
+    const patterns = exclude.map(globToRegExp);
+    const visit = (p) => {
+        const relative = path.relative(target, p).split(path.sep).join('/');
+        if (relative && patterns.some((re) => re.test(relative)))
+            return;
+        if (statSync(p).isDirectory()) {
+            for (const entry of readdirSync(p))
+                if (!SKIP_DIRS.has(entry))
+                    visit(path.join(p, entry));
+            return;
+        }
+        const name = path.basename(p);
+        if (UNREAD_LOCKFILES.has(name))
+            unread.push(p);
+        else if (READERS[name])
+            read.push(readLockfile(p, readFileSync(p, 'utf8')));
+    };
+    visit(target);
+    return { read, unread };
+}
+const OSV = 'https://api.osv.dev/v1';
+const BATCH = 1000; // OSV's own limit per querybatch call
+/**
+ * Ask OSV about every pinned package. Sends name, ecosystem and version only.
+ * `fetchImpl` is injectable so the tests can run without a network.
+ */
+export async function queryOsv(pinned, fetchImpl = fetch) {
+    const unique = [...new Map(pinned.map((p) => [`${p.ecosystem}|${p.name}|${p.version}`, p])).values()];
+    const call = async (url, body) => {
+        const signal = AbortSignal.timeout(30_000);
+        const response = await fetchImpl(url, body
+            ? { method: 'POST', body: JSON.stringify(body), headers: { 'content-type': 'application/json' }, signal }
+            : { signal });
+        if (!response.ok)
+            throw new Error(`OSV answered ${response.status} for ${url}`);
+        return response.json();
+    };
+    const idsPer = [];
+    const incomplete = [];
+    for (let i = 0; i < unique.length; i += BATCH) {
+        const chunk = unique.slice(i, i + BATCH);
+        const answer = (await call(`${OSV}/querybatch`, {
+            queries: chunk.map((p) => ({ package: { name: p.name, ecosystem: p.ecosystem }, version: p.version })),
+        }));
+        if (!Array.isArray(answer.results) || answer.results.length !== chunk.length) {
+            throw new Error('OSV returned a batch answer of the wrong shape - nothing was checked');
+        }
+        answer.results.forEach((r, j) => {
+            idsPer.push((r.vulns ?? []).map((v) => v.id));
+            if (r.next_page_token)
+                incomplete.push(`${chunk[j].name} ${chunk[j].version} - more advisories exist than one page`);
+        });
+    }
+    // ponytail: one GET per distinct advisory, all at once; add a concurrency cap if OSV starts refusing.
+    const details = new Map();
+    await Promise.all([...new Set(idsPer.flat())].map(async (id) => details.set(id, (await call(`${OSV}/vulns/${encodeURIComponent(id)}`)))));
+    const hits = unique.flatMap((pkg, i) => {
+        const ids = idsPer[i];
+        return ids.length ? [{ pkg, advisories: mergeSame(ids.map((id) => toAdvisory(details.get(id), pkg))) }] : [];
+    });
+    return { hits, checked: unique.length, incomplete };
+}
+const RANK = { critical: 4, high: 3, medium: 2, low: 1 };
+/**
+ * The whole check for `scan --deps`: find lockfiles, ask OSV, and return one
+ * signature-based finding per affected package, located on its lockfile line.
+ * `display` turns an absolute path into the one the report shows.
+ */
+export async function checkDependencies(target, display, exclude = [], fetchImpl = fetch) {
+    const { read, unread } = findLockfiles(target, exclude);
+    const pinned = read.flatMap((r) => r.packages);
+    const answer = pinned.length ? await queryOsv(pinned, fetchImpl) : { hits: [], checked: 0, incomplete: [] };
+    const texts = new Map();
+    const linesOf = (file) => {
+        if (!texts.has(file))
+            texts.set(file, readFileSync(file, 'utf8').split(/\r?\n/));
+        return texts.get(file);
+    };
+    return {
+        findings: answer.hits.map((h) => dependencyFinding(h, linesOf(h.pkg.file), display(h.pkg.file))),
+        report: {
+            source: 'api.osv.dev',
+            checkedAt: new Date().toISOString(),
+            read: read.map((r) => ({ file: display(r.file), packages: r.packages.length, skipped: r.skipped })),
+            notRead: unread.map(display),
+            checked: answer.checked,
+            incomplete: answer.incomplete,
+        },
+    };
+}
+export function dependencyFinding(hit, lines, file) {
+    const { pkg, advisories } = hit;
+    // ponytail: first line naming the package (with its version, if one does); a lockfile has no AST to point at.
+    const named = (needle) => lines.findIndex((l) => l.includes(needle));
+    const at = [`node_modules/${pkg.name}"`, `"${pkg.name}"`, pkg.name]
+        .map((n) => {
+        const withVersion = lines.findIndex((l) => l.includes(n) && l.includes(pkg.version));
+        return withVersion >= 0 ? withVersion : named(n);
+    })
+        .find((i) => i >= 0) ?? 0;
+    const text = (lines[at] ?? '').trim();
+    const rated = advisories.filter((a) => a.severity !== 'unrated');
+    const top = rated.reduce((best, a) => (RANK[a.severity] > RANK[best] ? a.severity : best), 'low');
+    const severity = (rated.length ? top : 'medium');
+    const ids = advisories.map((a) => [a.id, ...a.aliases.filter((x) => x.startsWith('CVE-'))].join('/'));
+    const fixed = [...new Set(advisories.flatMap((a) => a.fixed))];
+    return signatureFinding({
+        ruleId: DEPENDENCY_RULE.id,
+        ruleName: DEPENDENCY_RULE.name,
+        cwe: 'CWE-1395',
+        owasp: DEPENDENCY_RULE.owasp,
+        severity,
+        message: `${pkg.name} ${pkg.version} has ${advisories.length} published advisor${advisories.length === 1 ? 'y' : 'ies'}` +
+            (fixed.length ? ` - fixed versions: ${fixed.join(', ')}` : ' - no fixed version published'),
+        location: {
+            file,
+            startLine: at + 1,
+            startColumn: 1,
+            endLine: at + 1,
+            endColumn: (lines[at]?.length ?? 0) + 1,
+            astNodeType: 'lockfile-entry',
+            astNodePath: `${pkg.ecosystem} lockfile`,
+            snippet: text.length > 160 ? `${text.slice(0, 159)}…` : text,
+        },
+        reasoning: `osv.dev lists ${ids.join(', ')} for ${pkg.ecosystem} ${pkg.name} ${pkg.version}: ` +
+            advisories.map((a) => `${a.summary} (${a.severity})`).join('; ') +
+            '.' +
+            (rated.length
+                ? ''
+                : ' None of these advisories carries a severity rating, so medium is a placeholder, not an assessment.'),
+        limitations: DEPENDENCY_RULE.limitations,
+    });
+}
+/**
+ * One flaw, one entry. OSV holds the same CVE once per database (GHSA-, GO-,
+ * PYSEC-...), so a project would otherwise see one bug listed two or three
+ * times. Entries naming each other, or sharing an alias, are folded into one;
+ * a rated entry wins over an unrated one, and every id is kept in `aliases`.
+ */
+export function mergeSame(advisories) {
+    const groups = [];
+    for (const a of advisories) {
+        const names = new Set([a.id, ...a.aliases]);
+        const group = groups.find((g) => g.some((b) => b.id === a.id || names.has(b.id) || b.aliases.some((x) => names.has(x))));
+        if (group)
+            group.push(a);
+        else
+            groups.push([a]);
+    }
+    return groups.map((g) => {
+        const lead = g.find((a) => a.severity !== 'unrated') ?? g[0];
+        const ids = new Set(g.flatMap((a) => [a.id, ...a.aliases]));
+        ids.delete(lead.id);
+        return { ...lead, aliases: [...ids], fixed: [...new Set(g.flatMap((a) => a.fixed))] };
+    });
+}
+function toAdvisory(v, pkg) {
+    const fixed = (v.affected ?? [])
+        .filter((a) => a.package?.name === pkg.name && a.package?.ecosystem === pkg.ecosystem)
+        // GIT ranges name commits, not versions anyone can install.
+        .flatMap((a) => (a.ranges ?? []).filter((r) => r.type !== 'GIT'))
+        .flatMap((r) => (r.events ?? []).flatMap((e) => (e.fixed ? [e.fixed] : [])));
+    const rated = v.database_specific?.severity?.toLowerCase().replace('moderate', 'medium');
+    return {
+        id: v.id,
+        summary: v.summary ?? v.details?.split('\n')[0]?.slice(0, 160) ?? '(no summary published)',
+        aliases: v.aliases ?? [],
+        severity: rated && ['critical', 'high', 'medium', 'low'].includes(rated) ? rated : 'unrated',
+        fixed: [...new Set(fixed)],
+    };
+}
+//# sourceMappingURL=deps.js.map

package/dist/src/platform/deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../../src/platform/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAwC,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAyB,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAyB,CAAC;AAsClD,8DAA8D;AAC9D,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,MAAM,OAAO,GAA2B;IACtC,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAG3B,CAAC;QACF,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrD,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO;oBAAE,SAAS,CAAC,0CAA0C;gBAC5F,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,CAAC,IAA0C,EAAQ,EAAE;gBAChE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;oBACnD,IAAI,CAAC,CAAC,OAAO;wBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC7C,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,eAAe,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyE,CAAC;QACtG,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,kBAAkB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,0DAA0D,CAAC,CAAC;gBAChF,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,sDAAsD,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAClG,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;;gBAC1E,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,4DAA4D,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC;iBAC7C,IAAI,SAAS,IAAI,IAAI,KAAK,GAAG;gBAAE,SAAS,GAAG,KAAK,CAAC;iBACjD,CAAC;gBACJ,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnF,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACxC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;QACnH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAC;AAOF,SAAS,KAAK,CAAC,KAA+C,EAAE,SAAoB,EAAE,IAAY;IAChG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;;YACxE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,OAAO,kDAAkD,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS;IAC9F,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,iBAAiB;IAC9F,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AAE9F,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,sCAAuC,KAAe,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC7G,CAAC;AACH,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,UAA6B,EAAE;IAC3E,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,CAAS,EAAQ,EAAE;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO;QACjE,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aAC1C,IAAI,OAAO,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAE,CAAC,CAAC;IAC/E,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,CAAC,CAAC;IACd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,GAAG,GAAG,wBAAwB,CAAC;AACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,sCAAsC;AAE1D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAyB,EACzB,YAA0B,KAAK;IAE/B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAE,IAAc,EAAoB,EAAE;QACnE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,GAAG,EACH,IAAI;YACF,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE;YACzG,CAAC,CAAC,EAAE,MAAM,EAAE,CACf,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC;QAChF,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,aAAa,EAAE;YAC9C,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;SACvG,CAAC,CAAqF,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,eAAe;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,wCAAwC,CAAC,CAAC;QACzH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,sGAAsG;IACtG,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAY,CAAC,CAAC,CAClI,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAmB,EAAE;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACvB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChH,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;AACtD,CAAC;AAGD,MAAM,IAAI,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAEjF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,OAAiC,EACjC,UAA6B,EAAE,EAC/B,YAA0B,KAAK;IAE/B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC5G,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,MAAM,OAAO,GAAG,CAAC,IAAY,EAAY,EAAE;QACzC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;IAC1B,CAAC,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAChG,MAAM,EAAE;YACN,MAAM,EAAE,aAAa;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACnG,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAkB,EAAE,KAAwB,EAAE,IAAY;IAC1F,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;IAChC,8GAA8G;IAC9G,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,GAAG,CAAC,gBAAgB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC;SAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrF,OAAO,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAE,GAAG,IAAI,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACpG,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAa,CAAC;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,gBAAgB,CAAC;QACtB,MAAM,EAAE,eAAe,CAAC,EAAE;QAC1B,QAAQ,EAAE,eAAe,CAAC,IAAI;QAC9B,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,eAAe,CAAC,KAAK;QAC5B,QAAQ;QACR,OAAO,EACL,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,QAAQ,UAAU,CAAC,MAAM,qBAAqB,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;YAC/G,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,+BAA+B,CAAC;QAC7F,QAAQ,EAAE;YACR,IAAI;YACJ,SAAS,EAAE,EAAE,GAAG,CAAC;YACjB,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,EAAE,GAAG,CAAC;YACf,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;YACvC,WAAW,EAAE,gBAAgB;YAC7B,WAAW,EAAE,GAAG,GAAG,CAAC,SAAS,WAAW;YACxC,OAAO,EAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;SAC7D;QACD,SAAS,EACP,iBAAiB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,IAAI;YACnF,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAChE,GAAG;YACH,CAAC,KAAK,CAAC,MAAM;gBACX,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,qGAAqG,CAAC;QAC5G,WAAW,EAAE,eAAe,CAAC,WAAW;KACzC,CAAC,CAAC;AACL,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,UAA+B;IACvD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzH,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YACpB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpB,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,CAAU,EAAE,GAAW;IACzC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,KAAK,GAAG,CAAC,SAAS,CAAC;QACtF,4DAA4D;SAC3D,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;SAChE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,CAAC,CAAC,iBAAiB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzF,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,wBAAwB;QAC1F,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;QACxB,QAAQ,EAAE,KAAK,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC5F,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;KAC3B,CAAC;AACJ,CAAC"}

package/dist/src/platform/php-facts.d.ts

@@ -0,0 +1,49 @@
+/**
+ * WHAT DEFUSE KNOWS ABOUT PHP RELEASES - AND WHEN IT LAST CHECKED.
+ * ================================================================
+ *
+ * Every other check in Defuse reads the code it is given and needs nothing
+ * else. This one compares a version number with facts about the world, and
+ * facts about the world go stale: a release that is current today is missing a
+ * fix next month. So the table carries the date it was checked, and every
+ * finding and report built on it prints that date. A stale table is then a
+ * visible fact rather than a quiet wrong answer.
+ *
+ * Every entry was read from php.net on the date below, not from news reports:
+ *   https://www.php.net/supported-versions.php   support dates, 8.2 - 8.5
+ *   https://www.php.net/eol.php                  end-of-life dates
+ *   https://www.php.net/archive/2026             the 21 Oct 2026 security releases
+ *
+ * TO UPDATE: change the facts, change CHECKED, run `npm test`. The tests pin
+ * the table's shape, not today's numbers, so an update is a data change only.
+ */
+/** The day these facts were read from php.net. ISO date. */
+export declare const PHP_FACTS_CHECKED = "2026-10-28";
+/**
+ * Branches still receiving security fixes, and until when. A branch past its
+ * date on the day of the scan is treated as end of life - the scan date
+ * decides that, not the table date, so 8.2 turns out of support on 1 Jan 2027
+ * without anyone editing this file.
+ */
+export declare const PHP_SECURITY_UNTIL: Readonly<Record<string, string>>;
+/** Branches php.net lists as end of life, with the date support ended. */
+export declare const PHP_END_OF_LIFE: Readonly<Record<string, string>>;
+export interface PhpAdvisory {
+    /** The name it is known by, for a reader who has seen the news. */
+    readonly name: string;
+    readonly cves: readonly string[];
+    /** ISO date of the fixing releases. */
+    readonly published: string;
+    /** One plain sentence: what an attacker gets. */
+    readonly impact: string;
+    /** Per supported branch, the first release with the fix. */
+    readonly fixedIn: Readonly<Record<string, string>>;
+    /** The oldest branch reported affected. Older branches are end of life anyway. */
+    readonly oldestAffected: string;
+}
+/**
+ * Only advisories severe enough to change what a reader should do today. This
+ * is not a vulnerability database and does not pretend to be one - see the
+ * limitations text in runtime-version.ts. One entry is a deliberate start.
+ */
+export declare const PHP_ADVISORIES: readonly PhpAdvisory[];

package/dist/src/platform/php-facts.js

@@ -0,0 +1,67 @@
+/**
+ * WHAT DEFUSE KNOWS ABOUT PHP RELEASES - AND WHEN IT LAST CHECKED.
+ * ================================================================
+ *
+ * Every other check in Defuse reads the code it is given and needs nothing
+ * else. This one compares a version number with facts about the world, and
+ * facts about the world go stale: a release that is current today is missing a
+ * fix next month. So the table carries the date it was checked, and every
+ * finding and report built on it prints that date. A stale table is then a
+ * visible fact rather than a quiet wrong answer.
+ *
+ * Every entry was read from php.net on the date below, not from news reports:
+ *   https://www.php.net/supported-versions.php   support dates, 8.2 - 8.5
+ *   https://www.php.net/eol.php                  end-of-life dates
+ *   https://www.php.net/archive/2026             the 21 Oct 2026 security releases
+ *
+ * TO UPDATE: change the facts, change CHECKED, run `npm test`. The tests pin
+ * the table's shape, not today's numbers, so an update is a data change only.
+ */
+/** The day these facts were read from php.net. ISO date. */
+export const PHP_FACTS_CHECKED = '2026-10-28';
+/**
+ * Branches still receiving security fixes, and until when. A branch past its
+ * date on the day of the scan is treated as end of life - the scan date
+ * decides that, not the table date, so 8.2 turns out of support on 1 Jan 2027
+ * without anyone editing this file.
+ */
+export const PHP_SECURITY_UNTIL = {
+    '8.2': '2026-12-31',
+    '8.3': '2027-12-31',
+    '8.4': '2028-12-31',
+    '8.5': '2029-12-31',
+};
+/** Branches php.net lists as end of life, with the date support ended. */
+export const PHP_END_OF_LIFE = {
+    '8.1': '2025-12-31',
+    '8.0': '2023-11-26',
+    '7.4': '2022-11-28',
+    '7.3': '2021-12-06',
+    '7.2': '2020-11-30',
+    '7.1': '2019-12-01',
+    '7.0': '2019-01-10',
+    '5.6': '2018-12-31',
+    '5.5': '2016-07-21',
+    '5.4': '2015-09-03',
+    '5.3': '2014-08-14',
+    '5.2': '2011-01-06',
+    '5.1': '2006-08-24',
+    '5.0': '2005-09-05',
+};
+/**
+ * Only advisories severe enough to change what a reader should do today. This
+ * is not a vulnerability database and does not pretend to be one - see the
+ * limitations text in runtime-version.ts. One entry is a deliberate start.
+ */
+export const PHP_ADVISORIES = [
+    {
+        name: 'PHP2Shell',
+        cves: ['CVE-2026-109618', 'CVE-2026-109619'],
+        published: '2026-10-21',
+        impact: 'two critical flaws in PHP itself that can let an attacker run code on the server ' +
+            'without logging in, reported exploited in the wild',
+        fixedIn: { '8.2': '8.2.35', '8.3': '8.3.36', '8.4': '8.4.27', '8.5': '8.5.12' },
+        oldestAffected: '5.4',
+    },
+];
+//# sourceMappingURL=php-facts.js.map

package/dist/src/platform/php-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"php-facts.js","sourceRoot":"","sources":["../../../src/platform/php-facts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAqC;IAClE,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;CACpB,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAqC;IAC/D,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;CACpB,CAAC;AAgBF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD;QACE,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;QAC5C,SAAS,EAAE,YAAY;QACvB,MAAM,EACJ,mFAAmF;YACnF,oDAAoD;QACtD,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;QAC/E,cAAc,EAAE,KAAK;KACtB;CACF,CAAC"}

package/dist/src/platform/runtime-version.d.ts

@@ -0,0 +1,78 @@
+/**
+ * THE RUNTIME VERSION CHECK: WHICH PHP DOES THIS PROJECT SAY IT RUNS ON?
+ * =====================================================================
+ *
+ * Every other check in Defuse reads the code a project contains. PHP2Shell
+ * (CVE-2026-109618 / CVE-2026-109619, October 2026) was a reminder that perfect
+ * code on PHP 8.2.20 is still a server an attacker can take over: the bug was
+ * in PHP itself. Reading code cannot find that. Reading the version the
+ * project declares can - Dockerfiles, compose files, composer.json and
+ * `.php-version` all say which PHP the project expects.
+ *
+ * WHAT IT CAN AND CANNOT CLAIM. A declaration is not the server. A Dockerfile
+ * that says 8.2.20 may have been replaced, and one that says `php:8.2-apache`
+ * gets whatever 8.2 release was current when the image was built. So every
+ * result here is signature-based - a match against a declaration, never a
+ * proof about what runs - and every message says which file it read and how
+ * old the facts behind it are (php-facts.ts).
+ *
+ * Platform-free like the rest of the analysis: it takes text and returns
+ * findings, and the walker in engine/ decides which files to hand it.
+ */
+import { type SignatureFinding } from '../core/finding.js';
+export declare const RUNTIME_VERSION_RULE: {
+    readonly id: "runtime-version";
+    readonly name: "PHP version with a known critical flaw or no security support";
+    readonly owasp: "A03:2025 Software Supply Chain Failures";
+    readonly summary: "The project runs on a PHP version with a known serious flaw, or one that no longer gets security fixes.";
+    readonly fix: "Upgrade PHP to a supported release and update the version declared in the Dockerfile or composer.json.";
+    readonly explanation: string;
+    readonly limitations: string;
+};
+/** One file the walker handed over. `path` is the path a reader should see. */
+export interface RuntimeInputFile {
+    readonly path: string;
+    readonly text: string;
+}
+/** A version a project declares, with what the facts table says about it. */
+export interface DeclaredRuntime {
+    readonly file: string;
+    readonly line: number;
+    /** Where it came from, in words: "Dockerfile FROM", "composer.json require". */
+    readonly source: string;
+    /** Exactly as written: `php:8.2-apache`, `^7.4 || ^8.0`, `8.2.20`. */
+    readonly declared: string;
+    /** What Defuse concluded, in one plain sentence. */
+    readonly status: string;
+}
+export interface RuntimeCheckResult {
+    readonly findings: readonly SignatureFinding[];
+    readonly declared: readonly DeclaredRuntime[];
+    /** Things a reader must know that are not findings - a gap is never silent. */
+    readonly notes: readonly string[];
+    /** The date the facts table was checked against php.net. */
+    readonly factsChecked: string;
+}
+export interface RuntimeCheckOptions {
+    /** ISO date of the scan. End of support is judged against this, not the table date. */
+    readonly today: string;
+    /** How many PHP source files the scan read - a project with none needs no PHP version. */
+    readonly phpFilesScanned: number;
+}
+type Version = readonly [number, number, number];
+/** `2026-12-31` -> `31 Dec 2026`. */
+export declare function readableDate(iso: string): string;
+/** Which reader a file needs, by its name alone. Exported for the walker. */
+export declare function runtimeFileKind(fileName: string): 'dockerfile' | 'compose' | 'composer' | 'php-version' | null;
+type Comparison = {
+    readonly op: '>=' | '>' | '<' | '<=' | '=' | '!=';
+    readonly v: Version;
+};
+/**
+ * A composer version constraint, as alternatives of conditions - `^7.4 || ^8.0`
+ * is two alternatives. Null when any part cannot be read: an unreadable range
+ * is reported as unreadable, never guessed at.
+ */
+export declare function parseComposerRange(constraint: string): Comparison[][] | null;
+export declare function checkRuntimeVersions(files: readonly RuntimeInputFile[], options: RuntimeCheckOptions): RuntimeCheckResult;
+export {};