praxis-sec 1.0.0

package/cli/utils/intel/sources/gitleaks.js

@@ -0,0 +1,101 @@
+/**
+ * Gitleaks rules — community-maintained secret detection regex set.
+ * https://github.com/gitleaks/gitleaks
+ *
+ * We sync the upstream rules list (TOML config) and convert to praxis's
+ * SECRET_PATTERNS shape. Rules already present (by name) in our hardcoded
+ * patterns.js are skipped to avoid duplicates.
+ *
+ * Result: ~150 → ~400 secret detection patterns without code changes.
+ */
+
+import { fetchText } from '../http.js';
+
+const URL = 'https://raw.githubusercontent.com/gitleaks/gitleaks/master/config/gitleaks.toml';
+const TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7d
+
+export const name = 'gitleaks';
+export const tier = 'core';
+export const description = 'Gitleaks regex rule set (additional secret patterns)';
+
+export async function fetchAll() {
+  const toml = await fetchText(URL);
+  const rules = parseRules(toml);
+  return {
+    sourceUrl: URL,
+    count: rules.length,
+    rules,
+  };
+}
+
+/**
+ * Tiny TOML parser — only handles what gitleaks.toml uses:
+ *   [[rules]]
+ *   id = "..."
+ *   description = "..."
+ *   regex = '''...'''
+ *   keywords = ["..."]
+ *
+ * Avoids pulling in a TOML dependency for one file.
+ */
+function parseRules(toml) {
+  const rules = [];
+  const sections = toml.split(/^\[\[rules\]\]\s*$/m).slice(1);
+
+  for (const section of sections) {
+    const lines = section.split('\n');
+    const rule = {};
+    let collectingMultiline = null;
+    let multilineBuf = '';
+
+    for (const line of lines) {
+      if (collectingMultiline) {
+        if (line.includes("'''")) {
+          multilineBuf += line.slice(0, line.indexOf("'''"));
+          rule[collectingMultiline] = multilineBuf;
+          collectingMultiline = null;
+          multilineBuf = '';
+        } else {
+          multilineBuf += line + '\n';
+        }
+        continue;
+      }
+
+      // Stop at next section
+      if (/^\[/.test(line.trim())) break;
+
+      const m = line.match(/^\s*(id|description|regex|tags)\s*=\s*(.*)$/);
+      if (!m) continue;
+      const [, key, rawVal] = m;
+      const val = rawVal.trim();
+
+      if (val.startsWith("'''")) {
+        if (val.length > 3 && val.endsWith("'''")) {
+          rule[key] = val.slice(3, -3);
+        } else {
+          collectingMultiline = key;
+          multilineBuf = val.slice(3) + '\n';
+        }
+      } else if (val.startsWith('"') || val.startsWith("'")) {
+        rule[key] = val.slice(1, -1);
+      } else if (val.startsWith('[')) {
+        rule[key] = val.replace(/[[\]"']/g, '').split(',').map(s => s.trim()).filter(Boolean);
+      } else {
+        rule[key] = val;
+      }
+    }
+
+    if (rule.id && rule.regex) {
+      rules.push({
+        id: rule.id,
+        description: rule.description || rule.id,
+        regex: rule.regex,
+        tags: Array.isArray(rule.tags) ? rule.tags : [],
+      });
+    }
+  }
+
+  return rules;
+}
+
+export const TTL = TTL_MS;

package/cli/utils/intel/sources/kev.js

@@ -0,0 +1,38 @@
+/**
+ * CISA KEV — Known Exploited Vulnerabilities catalog.
+ * https://www.cisa.gov/known-exploited-vulnerabilities-catalog
+ *
+ * Single JSON, refreshed daily. ~1300 entries. We keep just the CVE IDs
+ * + minimal metadata; downstream code uses isInKev(cve) for prioritization.
+ */
+
+import { fetchJson } from '../http.js';
+
+const URL = 'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json';
+const TTL_MS = 24 * 60 * 60 * 1000; // 24h
+
+export const name = 'kev';
+export const tier = 'core';
+export const description = 'CISA Known Exploited Vulnerabilities catalog';
+
+export async function fetchAll() {
+  const data = await fetchJson(URL);
+  const entries = (data.vulnerabilities || []).map(v => ({
+    cve: v.cveID,
+    vendor: v.vendorProject,
+    product: v.product,
+    name: v.vulnerabilityName,
+    dateAdded: v.dateAdded,
+    dueDate: v.dueDate,
+    requiredAction: v.requiredAction,
+    knownRansomware: v.knownRansomwareCampaignUse === 'Known',
+  }));
+
+  return {
+    catalogVersion: data.catalogVersion,
+    dateReleased: data.dateReleased,
+    entries,
+  };
+}
+
+export const TTL = TTL_MS;

package/cli/utils/intel/sources/nvd.js

@@ -0,0 +1,84 @@
+/**
+ * NVD 2.0 — National Vulnerability Database (NIST).
+ * https://services.nvd.nist.gov/rest/json/cves/2.0
+ *
+ * Used for on-demand CVE detail enrichment, not bulk download.
+ * Bulk would be 250k+ entries; we let the merger pull only the CVEs that
+ * also appear in OSV/GHSA/KEV. With NVD_API_KEY set, rate limit lifts to
+ * 50 req / 30s; otherwise 5 req / 30s.
+ */
+
+import { fetchJson } from '../http.js';
+
+const BASE = 'https://services.nvd.nist.gov/rest/json/cves/2.0';
+const TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7d (CVE descriptions don't change often)
+
+export const name = 'nvd';
+export const tier = 'core';
+export const description = 'NVD 2.0 — CVE detail enrichment (NIST)';
+
+/**
+ * Bulk cache build: enrich a list of CVE IDs (typically pulled from KEV +
+ * OSV during merge). Returns { details: { CVE-YYYY-NNNN: {...} } }.
+ *
+ * Respects NVD's 6 req / 30s no-key limit (we sleep 6s between requests).
+ * With NVD_API_KEY in env, drops to 600ms.
+ */
+export async function fetchAll({ cveList = [] } = {}) {
+  const apiKey = process.env.NVD_API_KEY;
+  const delayMs = apiKey ? 600 : 6000;
+  const headers = apiKey ? { apiKey } : {};
+  const details = {};
+
+  // Cap to avoid an unbounded job. Caller can pass a smaller list.
+  const targets = cveList.slice(0, 500);
+  let lastError = null;
+
+  for (const cve of targets) {
+    try {
+      const res = await fetchJson(`${BASE}?cveId=${encodeURIComponent(cve)}`, { headers });
+      const item = res.vulnerabilities?.[0]?.cve;
+      if (!item) continue;
+      details[cve] = {
+        id: item.id,
+        published: item.published,
+        lastModified: item.lastModified,
+        descriptions: (item.descriptions || []).filter(d => d.lang === 'en').map(d => d.value),
+        cvss: extractCvss(item.metrics),
+        references: (item.references || []).slice(0, 5).map(r => r.url),
+        weaknesses: (item.weaknesses || []).flatMap(w => (w.description || []).map(d => d.value)),
+      };
+    } catch (err) {
+      lastError = err.message;
+    }
+    await sleep(delayMs);
+  }
+
+  return {
+    fetchedCount: Object.keys(details).length,
+    requestedCount: targets.length,
+    apiKeyUsed: !!apiKey,
+    lastError,
+    details,
+  };
+}
+
+function extractCvss(metrics) {
+  if (!metrics) return null;
+  const v31 = metrics.cvssMetricV31?.[0]?.cvssData;
+  const v40 = metrics.cvssMetricV40?.[0]?.cvssData;
+  const data = v40 || v31;
+  if (!data) return null;
+  return {
+    version: data.version,
+    score: data.baseScore,
+    severity: data.baseSeverity?.toLowerCase(),
+    vector: data.vectorString,
+  };
+}
+
+function sleep(ms) {
+  return new Promise(r => setTimeout(r, ms));
+}
+
+export const TTL = TTL_MS;

package/cli/utils/intel/sources/osv.js

@@ -0,0 +1,132 @@
+/**
+ * OSV.dev — Open Source Vulnerabilities (Google).
+ *
+ * Strategy: pull the per-ecosystem advisory zip dumps that OSV publishes daily.
+ * https://google.github.io/osv.dev/data/
+ *
+ * Each ecosystem zip has one JSON per advisory. We download a small set of
+ * common ecosystems, extract just the fields praxis needs, and produce a
+ * single normalized array of records:
+ *
+ *   { id, ecosystem, package, ranges, severity, cves, summary, references }
+ *
+ * Two query helpers are exposed via the merged ThreatIntel: lookupOsv() and
+ * a faster live-query mode that hits POST https://api.osv.dev/v1/query for
+ * a single package.
+ */
+
+import { fetchJson } from '../http.js';
+
+const ECOSYSTEMS = ['npm', 'PyPI', 'Go', 'RubyGems', 'crates.io', 'Maven', 'Packagist', 'NuGet'];
+const TTL_MS = 12 * 60 * 60 * 1000; // 12h
+
+export const name = 'osv';
+export const tier = 'core';
+export const description = 'OSV.dev — Google open-source vuln database (npm, PyPI, Go, etc.)';
+
+export async function fetchAll() {
+  // The full OSV dump is large (~hundreds of MB). For the bundled feed we keep
+  // the seed lean by querying the OSV API for the most common malicious /
+  // high-severity advisories. For richer offline coverage, praxis queries
+  // OSV live during scans (see lookupLive() below).
+  //
+  // Here we batch-query OSV for a curated list of historically compromised
+  // packages so the merged threat-intel.json always carries a usable seed,
+  // even when the user is offline at scan time.
+  const knownCompromised = [
+    { ecosystem: 'npm', name: 'event-stream' },
+    { ecosystem: 'npm', name: 'flatmap-stream' },
+    { ecosystem: 'npm', name: 'eslint-scope' },
+    { ecosystem: 'npm', name: 'ua-parser-js' },
+    { ecosystem: 'npm', name: 'coa' },
+    { ecosystem: 'npm', name: 'rc' },
+    { ecosystem: 'npm', name: 'colors' },
+    { ecosystem: 'npm', name: 'node-ipc' },
+    { ecosystem: 'npm', name: '@solana/web3.js' },
+    { ecosystem: 'npm', name: 'lottie-player' },
+    { ecosystem: 'npm', name: 'axios' },
+    { ecosystem: 'PyPI', name: 'litellm' },
+    { ecosystem: 'PyPI', name: 'ctx' },
+    { ecosystem: 'PyPI', name: 'phpass' },
+  ];
+
+  const records = [];
+  for (const target of knownCompromised) {
+    try {
+      const adv = await fetchJson('https://api.osv.dev/v1/query', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ package: { name: target.name, ecosystem: target.ecosystem } }),
+      });
+      for (const v of adv.vulns || []) {
+        records.push(normalize(v, target.ecosystem, target.name));
+      }
+    } catch {
+      // Skip individual failures — orchestrator will report partial success
+    }
+  }
+
+  return { records, ecosystems: ECOSYSTEMS };
+}
+
+/**
+ * Live single-package lookup. Used by the supply-chain agent at scan time
+ * when we have a package name + version to check.
+ */
+export async function lookupLive(name, version, ecosystem = 'npm') {
+  try {
+    const body = { package: { name, ecosystem } };
+    if (version) body.version = version;
+    const res = await fetchJson('https://api.osv.dev/v1/query', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+      timeout: 8000,
+      retries: 1,
+    });
+    return (res.vulns || []).map(v => normalize(v, ecosystem, name));
+  } catch {
+    return [];
+  }
+}
+
+function normalize(vuln, ecosystem, packageName) {
+  const cves = (vuln.aliases || []).filter(a => /^CVE-/i.test(a));
+  const severity = pickSeverity(vuln);
+  const ranges = (vuln.affected || [])
+    .filter(a => a.package?.name === packageName || !a.package?.name)
+    .flatMap(a => a.ranges || []);
+
+  return {
+    id: vuln.id,
+    ecosystem,
+    package: packageName,
+    summary: vuln.summary || vuln.details?.slice(0, 200) || '',
+    severity,
+    cves,
+    ranges: ranges.map(r => ({
+      type: r.type,
+      events: (r.events || []).map(e => ({ ...e })),
+    })),
+    references: (vuln.references || []).slice(0, 5).map(r => r.url),
+    published: vuln.published || vuln.modified || null,
+  };
+}
+
+function pickSeverity(vuln) {
+  // OSV severity comes in either CVSS_V3 or DB-specific fields. Prefer CVSS.
+  for (const s of vuln.severity || []) {
+    if (s.type === 'CVSS_V3' || s.type === 'CVSS_V4') {
+      const score = parseFloat((s.score || '').match(/\/([0-9.]+)$/)?.[1] || s.score);
+      if (!Number.isNaN(score)) {
+        if (score >= 9.0) return 'critical';
+        if (score >= 7.0) return 'high';
+        if (score >= 4.0) return 'medium';
+        return 'low';
+      }
+    }
+  }
+  return vuln.database_specific?.severity?.toLowerCase() || 'medium';
+}
+
+export const TTL = TTL_MS;

package/cli/utils/intel/sources/phylum.js

@@ -0,0 +1,44 @@
+/**
+ * Phylum — paid.
+ * https://docs.phylum.io
+ *
+ * Requires PHYLUM_API_KEY. Phylum surfaces malicious-package telemetry
+ * and dependency risk scores via /api/data/packages and /api/data/jobs.
+ * Skipped silently when not set.
+ */
+
+import { fetchJson } from '../http.js';
+
+const TTL_MS = 6 * 60 * 60 * 1000;
+
+export const name = 'phylum';
+export const tier = 'optional';
+export const description = 'Phylum supply-chain risk feed (requires PHYLUM_API_KEY)';
+export const envKey = 'PHYLUM_API_KEY';
+
+export async function fetchAll() {
+  const key = process.env.PHYLUM_API_KEY;
+  if (!key) return { skipped: true, reason: 'PHYLUM_API_KEY not set' };
+
+  const headers = { Authorization: `Bearer ${key}` };
+  const data = await fetchJson(
+    'https://api.phylum.io/api/v0/data/malicious-packages?limit=200',
+    { headers, timeout: 20000 },
+  );
+
+  const advisories = (data.items || data || []).map(p => ({
+    package: p.name,
+    ecosystem: p.ecosystem || p.type,
+    version: p.version,
+    severity: p.severity || 'high',
+    summary: p.summary || p.description,
+    published: p.published_at || p.created_at,
+  }));
+
+  return {
+    count: advisories.length,
+    advisories,
+  };
+}
+
+export const TTL = TTL_MS;

package/cli/utils/intel/sources/snyk.js

@@ -0,0 +1,46 @@
+/**
+ * Snyk Vulnerability DB — paid.
+ * https://docs.snyk.io/snyk-api
+ *
+ * Requires SNYK_TOKEN. Skipped silently when not set.
+ * The /rest/orgs/{org_id}/issues endpoint returns issues across an org's
+ * monitored projects. We expose a thin pull that grabs recent issues.
+ */
+
+import { fetchJson } from '../http.js';
+
+const TTL_MS = 12 * 60 * 60 * 1000;
+
+export const name = 'snyk';
+export const tier = 'optional';
+export const description = 'Snyk Vulnerability Database (requires SNYK_TOKEN)';
+export const envKey = 'SNYK_TOKEN';
+
+export async function fetchAll() {
+  const token = process.env.SNYK_TOKEN;
+  const orgId = process.env.SNYK_ORG_ID;
+  if (!token) return { skipped: true, reason: 'SNYK_TOKEN not set' };
+  if (!orgId) return { skipped: true, reason: 'SNYK_ORG_ID not set' };
+
+  const headers = { Authorization: `token ${token}` };
+  const url = `https://api.snyk.io/rest/orgs/${orgId}/issues?version=2024-10-15&limit=100`;
+  const data = await fetchJson(url, { headers });
+
+  const issues = (data.data || []).map(item => ({
+    id: item.id,
+    severity: item.attributes?.effective_severity_level,
+    title: item.attributes?.title,
+    package: item.relationships?.scan_item?.data?.id,
+    cves: item.attributes?.problems?.filter(p => p.source === 'CVE').map(p => p.id) || [],
+    cvss: item.attributes?.cvss_v3,
+    published: item.attributes?.created_at,
+  }));
+
+  return {
+    orgId,
+    count: issues.length,
+    issues,
+  };
+}
+
+export const TTL = TTL_MS;

package/cli/utils/intel/sources/socket.js

@@ -0,0 +1,69 @@
+/**
+ * Socket.dev — paid.
+ * https://docs.socket.dev/reference
+ *
+ * Requires SOCKET_API_KEY. Best-in-class supply-chain risk scoring for npm
+ * (typosquats, install-script risk, dependency drift, malware). Skipped
+ * silently when not set.
+ *
+ * For the merged feed we pull the recent malware advisories list. Live
+ * package lookup is exposed via lookupLive() and called by the supply-chain
+ * agent during a scan.
+ */
+
+import { fetchJson } from '../http.js';
+
+const TTL_MS = 6 * 60 * 60 * 1000; // 6h — Socket updates often
+
+export const name = 'socket';
+export const tier = 'optional';
+export const description = 'Socket.dev supply-chain risk feed (requires SOCKET_API_KEY)';
+export const envKey = 'SOCKET_API_KEY';
+
+function authHeader() {
+  const key = process.env.SOCKET_API_KEY;
+  if (!key) return null;
+  // Socket uses HTTP Basic with the API key as username, blank password
+  const b64 = Buffer.from(`${key}:`).toString('base64');
+  return { Authorization: `Basic ${b64}` };
+}
+
+export async function fetchAll() {
+  const headers = authHeader();
+  if (!headers) return { skipped: true, reason: 'SOCKET_API_KEY not set' };
+
+  const data = await fetchJson('https://api.socket.dev/v0/threat-feed?limit=200', {
+    headers,
+    timeout: 20000,
+  });
+
+  return {
+    count: (data.results || []).length,
+    advisories: (data.results || []).map(t => ({
+      id: t.id,
+      package: t.purl || t.name,
+      ecosystem: t.ecosystem,
+      severity: t.severity,
+      summary: t.summary || t.description,
+      published: t.created_at,
+      threatType: t.threat_type,
+    })),
+  };
+}
+
+/** Live single-package lookup. Used by supply-chain agent. */
+export async function lookupLive(pkg, ecosystem = 'npm') {
+  const headers = authHeader();
+  if (!headers) return null;
+  try {
+    const data = await fetchJson(
+      `https://api.socket.dev/v0/${ecosystem}/${encodeURIComponent(pkg)}/score`,
+      { headers, timeout: 8000, retries: 1 },
+    );
+    return data;
+  } catch {
+    return null;
+  }
+}
+
+export const TTL = TTL_MS;

package/cli/utils/intel/sources/sonatype.js

@@ -0,0 +1,84 @@
+/**
+ * Sonatype OSS Index — free with low rate limits, paid for higher volume.
+ * https://ossindex.sonatype.org/rest
+ *
+ * Optional auth via SONATYPE_USER + SONATYPE_TOKEN raises the limit.
+ * Operates per-batch component lookup (POST /api/v3/component-report).
+ * For the merged feed we fetch a small recent-vulns sample; primary use
+ * is the lookupLive() helper at scan time.
+ */
+
+import { fetchJson } from '../http.js';
+
+const TTL_MS = 12 * 60 * 60 * 1000;
+
+export const name = 'sonatype';
+export const tier = 'optional';
+export const description = 'Sonatype OSS Index (anonymous works; SONATYPE_USER/TOKEN raises limits)';
+export const envKey = 'SONATYPE_USER';
+
+function authHeader() {
+  const user = process.env.SONATYPE_USER;
+  const token = process.env.SONATYPE_TOKEN;
+  if (!user || !token) return null;
+  const b64 = Buffer.from(`${user}:${token}`).toString('base64');
+  return { Authorization: `Basic ${b64}` };
+}
+
+export async function fetchAll() {
+  // Default seed: query a known-noisy set so users get sample data without
+  // configuring credentials. This is the only source where a no-key call
+  // still yields useful seed records.
+  const headers = { 'content-type': 'application/json', ...(authHeader() || {}) };
+  const seed = ['pkg:npm/lodash@4.17.20', 'pkg:npm/axios@0.21.0', 'pkg:pypi/requests@2.19.0'];
+
+  try {
+    const data = await fetchJson('https://ossindex.sonatype.org/api/v3/component-report', {
+      method: 'POST',
+      headers,
+      body: JSON.stringify({ coordinates: seed }),
+      timeout: 15000,
+    });
+    const advisories = (Array.isArray(data) ? data : []).flatMap(report =>
+      (report.vulnerabilities || []).map(v => ({
+        purl: report.coordinates,
+        cve: (v.cve || v.id),
+        cvssScore: v.cvssScore,
+        cvssVector: v.cvssVector,
+        title: v.title,
+        description: v.description?.slice(0, 200),
+        reference: v.reference,
+      }))
+    );
+
+    return {
+      authed: !!authHeader(),
+      count: advisories.length,
+      advisories,
+    };
+  } catch (err) {
+    if (!authHeader()) {
+      return { skipped: true, reason: `Anonymous query failed (${err.message}). Set SONATYPE_USER/TOKEN.` };
+    }
+    throw err;
+  }
+}
+
+/** Live PURL lookup for use in scan-time enrichment. */
+export async function lookupLive(purls = []) {
+  const headers = { 'content-type': 'application/json', ...(authHeader() || {}) };
+  if (!purls.length) return [];
+  try {
+    return await fetchJson('https://ossindex.sonatype.org/api/v3/component-report', {
+      method: 'POST',
+      headers,
+      body: JSON.stringify({ coordinates: purls.slice(0, 128) }),
+      timeout: 12000,
+      retries: 1,
+    });
+  } catch {
+    return [];
+  }
+}
+
+export const TTL = TTL_MS;

package/cli/utils/intel/sources/threatpack.js

@@ -0,0 +1,69 @@
+/**
+ * Praxis Threat-Pack — AI attack-vector signature pack (core feed)
+ * ===============================================================
+ *
+ * A versioned, fetchable pack of AI-security detection knowledge:
+ *   - probes:    prompt-injection signatures (same schema as the bundled
+ *                corpus — new jailbreak/obfuscation families arrive as data)
+ *   - eaa:       Endpoint-AI-Agent-Abuse technique additions
+ *   - gateways:  known model-gateway domains (allowlist updates)
+ *
+ * The bundled seed lives at cli/data/threatpacks/latest.json. The feed
+ * URL can be overridden with PRAXIS_THREATPACK_URL (defaults to the seed
+ * version on GitHub). Graceful degradation: a fetch failure marks the
+ * source failed and the scan continues with the bundled corpus.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { fetchText } from '../http.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const SEED_PATH = path.join(__dirname, '..', '..', '..', 'data', 'threatpacks', 'latest.json');
+
+const DEFAULT_URL = 'https://raw.githubusercontent.com/Ganron007/Praxis/main/cli/data/threatpacks/latest.json';
+const TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7d
+
+export const name = 'threatpack';
+export const tier = 'core';
+export const description = 'Praxis AI attack-vector signature pack (probes, EAA additions, gateway allowlists)';
+
+function loadSeed() {
+  try {
+    return JSON.parse(fs.readFileSync(SEED_PATH, 'utf-8'));
+  } catch {
+    return { version: '0.0.0', probes: [], eaa: [], gateways: [] };
+  }
+}
+
+export async function fetchAll() {
+  const seed = loadSeed();
+  const url = process.env.PRAXIS_THREATPACK_URL || DEFAULT_URL;
+
+  // Try the remote pack; fall back to the bundled seed on any failure.
+  try {
+    const raw = await fetchText(url);
+    const pack = JSON.parse(raw);
+    if (!pack.version || !Array.isArray(pack.probes)) {
+      throw new Error('malformed threat pack');
+    }
+    return {
+      sourceUrl: url,
+      version: pack.version,
+      probes: pack.probes,
+      eaa: pack.eaa || [],
+      gateways: pack.gateways || [],
+      fetchedRemote: true,
+    };
+  } catch {
+    return {
+      sourceUrl: SEED_PATH,
+      version: seed.version,
+      probes: seed.probes || [],
+      eaa: seed.eaa || [],
+      gateways: seed.gateways || [],
+      fetchedRemote: false,
+    };
+  }
+}