scanoss 0.33.0 → 0.34.0

package/build/module/sdk/Dependencies/LocalDependency/parsers/pnpmParser.js

@@ -0,0 +1,251 @@
+import path from "path";
+import { PackageURL } from "packageurl-js";
+const PURL_TYPE = "npm";
+const MANIFEST_FILE = "pnpm-lock.yaml";
+// Regex for pnpm lockfile v5 format: /package-name/version or /@scope/package-name/version
+// May include peer dep suffixes like /@scope/pkg/1.0.0_peer@2.0.0
+const V5_PACKAGE_REGEX = /^\s{2,4}\/?(?<fullname>(?:@(?<scope>[^/]+)\/)?(?<name>[^/]+))\/(?<version>\d[^_:]*)/;
+// Regex for pnpm lockfile v6+ format: /package-name@version or /@scope/package-name@version
+// May include peer dep suffixes like /@scope/pkg@1.0.0(@peer/pkg@2.0.0)
+const V6_PACKAGE_REGEX = /^\s{2,4}'?\/?(?<fullname>(?:@(?<scope>[^/@]+)\/)?(?<name>[^@']+))@(?<version>\d[^(':\s]*)/;
+function parseLockfileVersion(fileContent) {
+    const match = fileContent.match(/^lockfileVersion:\s*'?(\d+)/m);
+    if (match)
+        return parseInt(match[1], 10);
+    return 0;
+}
+// For pnpm v9+: Parse importers section to get direct prod/dev dependency resolved versions.
+// Returns sets of package keys like "express@4.18.2" or "@angular/core@14.2.0".
+function parseImportersDeps(lines) {
+    const prodKeys = new Set();
+    const devKeys = new Set();
+    let inImporters = false;
+    let currentTarget = null;
+    let pkgName = null;
+    for (const line of lines) {
+        const trimmed = line.trimEnd();
+        if (trimmed === '')
+            continue;
+        if (/^importers:\s*$/.test(trimmed)) {
+            inImporters = true;
+            currentTarget = null;
+            pkgName = null;
+            continue;
+        }
+        if (!inImporters)
+            continue;
+        // End of importers section (next top-level key)
+        if (/^\S/.test(trimmed) && !trimmed.startsWith('#')) {
+            inImporters = false;
+            break;
+        }
+        const indent = line.search(/\S/);
+        // Workspace key at indent 2 (e.g., "  .:" or "  packages/app:")
+        if (indent === 2) {
+            currentTarget = null;
+            pkgName = null;
+            continue;
+        }
+        // Section header at indent 4 (dependencies:, devDependencies:, etc.)
+        if (indent === 4) {
+            if (/^\s{4}dependencies:\s*$/.test(trimmed) || /^\s{4}optionalDependencies:\s*$/.test(trimmed)) {
+                currentTarget = prodKeys;
+            }
+            else if (/^\s{4}devDependencies:\s*$/.test(trimmed)) {
+                currentTarget = devKeys;
+            }
+            else {
+                currentTarget = null;
+            }
+            pkgName = null;
+            continue;
+        }
+        if (!currentTarget)
+            continue;
+        // Package name at indent 6 (e.g., "      express:" or "      '@angular/core':")
+        if (indent === 6) {
+            const match = trimmed.match(/^\s{6}'?([^':]+)'?:\s*$/);
+            if (match) {
+                pkgName = match[1];
+            }
+            continue;
+        }
+        // Version at indent 8 (e.g., "        version: 4.18.2" or "        version: 14.2.0(rxjs@7.8.0)")
+        if (indent === 8 && pkgName) {
+            const match = trimmed.match(/^\s{8}version:\s*'?([^'\s]+)'?\s*$/);
+            if (match) {
+                // Strip peer dep suffixes in parentheses
+                const version = match[1].replace(/\(.*$/, '');
+                currentTarget.add(`${pkgName}@${version}`);
+                pkgName = null;
+            }
+        }
+    }
+    return { prodKeys, devKeys };
+}
+// For pnpm v9+: Build dependency graph from snapshots section.
+// Maps each package key (e.g., "express@4.18.2") to its dependency keys.
+function buildSnapshotGraph(lines) {
+    const graph = new Map();
+    let inSnapshots = false;
+    let currentKey = null;
+    let inDeps = false;
+    for (const line of lines) {
+        const trimmed = line.trimEnd();
+        if (trimmed === '')
+            continue;
+        if (/^snapshots:\s*$/.test(trimmed)) {
+            inSnapshots = true;
+            currentKey = null;
+            inDeps = false;
+            continue;
+        }
+        if (!inSnapshots)
+            continue;
+        // End of snapshots section (next top-level key)
+        if (/^\S/.test(trimmed) && !trimmed.startsWith('#')) {
+            inSnapshots = false;
+            break;
+        }
+        const indent = line.search(/\S/);
+        // Snapshot entry at indent 2 (e.g., "  express@4.18.2:" or "  lodash@4.17.21: {}")
+        if (indent === 2) {
+            const match = trimmed.match(/^\s{2}'?(.+?)(?:\([^)]*\))*'?:\s*(\{\})?\s*$/);
+            if (match) {
+                // Strip peer dep suffixes from key
+                currentKey = match[1].replace(/\(.*$/, '');
+                if (!graph.has(currentKey)) {
+                    graph.set(currentKey, []);
+                }
+                inDeps = false;
+                // Empty entry like "  lodash@4.17.21: {}"
+                if (match[2] === '{}') {
+                    currentKey = null;
+                }
+            }
+            continue;
+        }
+        if (!currentKey)
+            continue;
+        // Subsection header at indent 4
+        if (indent === 4) {
+            inDeps = /^\s{4}(?:dependencies|optionalDependencies):\s*$/.test(trimmed);
+            continue;
+        }
+        // Dependency entry at indent 6 (e.g., "      accepts: 1.3.8")
+        if (indent === 6 && inDeps) {
+            const match = trimmed.match(/^\s{6}'?([^':]+)'?:\s*'?([^'\s]+)'?/);
+            if (match) {
+                const depVersion = match[2].replace(/\(.*$/, '');
+                const depKey = `${match[1]}@${depVersion}`;
+                graph.get(currentKey).push(depKey);
+            }
+        }
+    }
+    return graph;
+}
+// BFS from prod dependencies through the snapshot graph to find all production-reachable packages.
+function findProductionPackages(prodKeys, graph) {
+    const visited = new Set();
+    const queue = [...prodKeys];
+    while (queue.length > 0) {
+        const key = queue.shift();
+        if (visited.has(key))
+            continue;
+        visited.add(key);
+        const deps = graph.get(key);
+        if (deps) {
+            for (const dep of deps) {
+                if (!visited.has(dep)) {
+                    queue.push(dep);
+                }
+            }
+        }
+    }
+    return visited;
+}
+function parsePackagesSection(fileContent) {
+    const entries = [];
+    const lines = fileContent.split('\n');
+    const lockfileVersion = parseLockfileVersion(fileContent);
+    let inPackagesSection = false;
+    let currentEntry = null;
+    const packageRegex = lockfileVersion >= 6 ? V6_PACKAGE_REGEX : V5_PACKAGE_REGEX;
+    // For v9+, determine dev scope from importers + snapshots instead of dev: flag
+    let prodPackages = null;
+    if (lockfileVersion >= 9) {
+        const { prodKeys, devKeys } = parseImportersDeps(lines);
+        // Only use v9 logic if importers section was found; otherwise fall back to defaults
+        if (prodKeys.size > 0 || devKeys.size > 0) {
+            const graph = buildSnapshotGraph(lines);
+            prodPackages = findProductionPackages(prodKeys, graph);
+        }
+    }
+    for (const line of lines) {
+        // Detect start of packages section
+        if (/^packages:/.test(line)) {
+            inPackagesSection = true;
+            continue;
+        }
+        // Detect end of packages section (next top-level key)
+        if (inPackagesSection && /^\S/.test(line) && !line.startsWith('#')) {
+            // Save last entry
+            if (currentEntry)
+                entries.push(currentEntry);
+            inPackagesSection = false;
+            continue;
+        }
+        if (!inPackagesSection)
+            continue;
+        // Try to match a package key line
+        const match = line.match(packageRegex);
+        if (match && match.groups) {
+            // Save previous entry
+            if (currentEntry)
+                entries.push(currentEntry);
+            const pkgScope = match.groups.scope || undefined;
+            const pkgName = match.groups.name;
+            const pkgVersion = match.groups.version;
+            let isDev = false;
+            if (lockfileVersion >= 9 && prodPackages) {
+                // For v9+, a package is dev if it's NOT reachable from production dependencies
+                const key = pkgScope ? `@${pkgScope}/${pkgName}@${pkgVersion}` : `${pkgName}@${pkgVersion}`;
+                isDev = !prodPackages.has(key);
+            }
+            currentEntry = {
+                scope: pkgScope,
+                name: pkgName,
+                version: pkgVersion,
+                dev: isDev,
+            };
+            continue;
+        }
+        // Check for dev flag within current entry (v5-v8 only)
+        if (lockfileVersion < 9 && currentEntry && /^\s+dev:\s*true/.test(line)) {
+            currentEntry.dev = true;
+        }
+    }
+    // Don't forget last entry
+    if (currentEntry)
+        entries.push(currentEntry);
+    return entries;
+}
+export function pnpmLockParser(fileContent, filePath) {
+    const results = { file: filePath, purls: [] };
+    if (path.basename(filePath) != MANIFEST_FILE)
+        return Promise.resolve(results);
+    try {
+        const packages = parsePackagesSection(fileContent);
+        for (const pkg of packages) {
+            const namespace = pkg.scope ? `@${pkg.scope}` : undefined;
+            const purlString = new PackageURL(PURL_TYPE, namespace, pkg.name, pkg.version, undefined, undefined).toString();
+            const scope = pkg.dev ? "devDependencies" : "dependencies";
+            results.purls.push({ purl: purlString, requirement: pkg.version, scope: scope });
+        }
+    }
+    catch (e) {
+        console.error(e);
+    }
+    return Promise.resolve(results);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicG5wbVBhcnNlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uLy4uL3NyYy9zZGsvRGVwZW5kZW5jaWVzL0xvY2FsRGVwZW5kZW5jeS9wYXJzZXJzL3BucG1QYXJzZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBQ3hCLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxlQUFlLENBQUM7QUFHM0MsTUFBTSxTQUFTLEdBQUcsS0FBSyxDQUFDO0FBQ3hCLE1BQU0sYUFBYSxHQUFHLGdCQUFnQixDQUFDO0FBRXZDLDJGQUEyRjtBQUMzRixrRUFBa0U7QUFDbEUsTUFBTSxnQkFBZ0IsR0FBRyxxRkFBcUYsQ0FBQztBQUUvRyw0RkFBNEY7QUFDNUYsd0VBQXdFO0FBQ3hFLE1BQU0sZ0JBQWdCLEdBQUcsMkZBQTJGLENBQUM7QUFTckgsU0FBUyxvQkFBb0IsQ0FBQyxXQUFtQjtJQUMvQyxNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDLDhCQUE4QixDQUFDLENBQUM7SUFDaEUsSUFBSSxLQUFLO1FBQUUsT0FBTyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ3pDLE9BQU8sQ0FBQyxDQUFDO0FBQ1gsQ0FBQztBQUVELDZGQUE2RjtBQUM3RixnRkFBZ0Y7QUFDaEYsU0FBUyxrQkFBa0IsQ0FBQyxLQUFlO0lBQ3pDLE1BQU0sUUFBUSxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFDbkMsTUFBTSxPQUFPLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUVsQyxJQUFJLFdBQVcsR0FBRyxLQUFLLENBQUM7SUFDeEIsSUFBSSxhQUFhLEdBQXVCLElBQUksQ0FBQztJQUM3QyxJQUFJLE9BQU8sR0FBa0IsSUFBSSxDQUFDO0lBRWxDLEtBQUssTUFBTSxJQUFJLElBQUksS0FBSyxFQUFFLENBQUM7UUFDekIsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQy9CLElBQUksT0FBTyxLQUFLLEVBQUU7WUFBRSxTQUFTO1FBRTdCLElBQUksaUJBQWlCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDcEMsV0FBVyxHQUFHLElBQUksQ0FBQztZQUNuQixhQUFhLEdBQUcsSUFBSSxDQUFDO1lBQ3JCLE9BQU8sR0FBRyxJQUFJLENBQUM7WUFDZixTQUFTO1FBQ1gsQ0FBQztRQUVELElBQUksQ0FBQyxXQUFXO1lBQUUsU0FBUztRQUUzQixnREFBZ0Q7UUFDaEQsSUFBSSxLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3BELFdBQVcsR0FBRyxLQUFLLENBQUM7WUFDcEIsTUFBTTtRQUNSLENBQUM7UUFFRCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBRWpDLGdFQUFnRTtRQUNoRSxJQUFJLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNqQixhQUFhLEdBQUcsSUFBSSxDQUFDO1lBQ3JCLE9BQU8sR0FBRyxJQUFJLENBQUM7WUFDZixTQUFTO1FBQ1gsQ0FBQztRQUVELHFFQUFxRTtRQUNyRSxJQUFJLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNqQixJQUFJLHlCQUF5QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxpQ0FBaUMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDL0YsYUFBYSxHQUFHLFFBQVEsQ0FBQztZQUMzQixDQUFDO2lCQUFNLElBQUksNEJBQTRCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7Z0JBQ3RELGFBQWEsR0FBRyxPQUFPLENBQUM7WUFDMUIsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLGFBQWEsR0FBRyxJQUFJLENBQUM7WUFDdkIsQ0FBQztZQUNELE9BQU8sR0FBRyxJQUFJLENBQUM7WUFDZixTQUFTO1FBQ1gsQ0FBQztRQUVELElBQUksQ0FBQyxhQUFhO1lBQUUsU0FBUztRQUU3QixnRkFBZ0Y7UUFDaEYsSUFBSSxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDakIsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO1lBQ3ZELElBQUksS0FBSyxFQUFFLENBQUM7Z0JBQ1YsT0FBTyxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNyQixDQUFDO1lBQ0QsU0FBUztRQUNYLENBQUM7UUFFRCxpR0FBaUc7UUFDakcsSUFBSSxNQUFNLEtBQUssQ0FBQyxJQUFJLE9BQU8sRUFBRSxDQUFDO1lBQzVCLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsb0NBQW9DLENBQUMsQ0FBQztZQUNsRSxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUNWLHlDQUF5QztnQkFDekMsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQzlDLGFBQWEsQ0FBQyxHQUFHLENBQUMsR0FBRyxPQUFPLElBQUksT0FBTyxFQUFFLENBQUMsQ0FBQztnQkFDM0MsT0FBTyxHQUFHLElBQUksQ0FBQztZQUNqQixDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFRCxPQUFPLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDO0FBQy9CLENBQUM7QUFFRCwrREFBK0Q7QUFDL0QseUVBQXlFO0FBQ3pFLFNBQVMsa0JBQWtCLENBQUMsS0FBZTtJQUN6QyxNQUFNLEtBQUssR0FBRyxJQUFJLEdBQUcsRUFBb0IsQ0FBQztJQUUxQyxJQUFJLFdBQVcsR0FBRyxLQUFLLENBQUM7SUFDeEIsSUFBSSxVQUFVLEdBQWtCLElBQUksQ0FBQztJQUNyQyxJQUFJLE1BQU0sR0FBRyxLQUFLLENBQUM7SUFFbkIsS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUN6QixNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDL0IsSUFBSSxPQUFPLEtBQUssRUFBRTtZQUFFLFNBQVM7UUFFN0IsSUFBSSxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNwQyxXQUFXLEdBQUcsSUFBSSxDQUFDO1lBQ25CLFVBQVUsR0FBRyxJQUFJLENBQUM7WUFDbEIsTUFBTSxHQUFHLEtBQUssQ0FBQztZQUNmLFNBQVM7UUFDWCxDQUFDO1FBRUQsSUFBSSxDQUFDLFdBQVc7WUFBRSxTQUFTO1FBRTNCLGdEQUFnRDtRQUNoRCxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDcEQsV0FBVyxHQUFHLEtBQUssQ0FBQztZQUNwQixNQUFNO1FBQ1IsQ0FBQztRQUVELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7UUFFakMsbUZBQW1GO1FBQ25GLElBQUksTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ2pCLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsOENBQThDLENBQUMsQ0FBQztZQUM1RSxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUNWLG1DQUFtQztnQkFDbkMsVUFBVSxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFDO2dCQUMzQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO29CQUMzQixLQUFLLENBQUMsR0FBRyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDNUIsQ0FBQztnQkFDRCxNQUFNLEdBQUcsS0FBSyxDQUFDO2dCQUNmLDBDQUEwQztnQkFDMUMsSUFBSSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUM7b0JBQ3RCLFVBQVUsR0FBRyxJQUFJLENBQUM7Z0JBQ3BCLENBQUM7WUFDSCxDQUFDO1lBQ0QsU0FBUztRQUNYLENBQUM7UUFFRCxJQUFJLENBQUMsVUFBVTtZQUFFLFNBQVM7UUFFMUIsZ0NBQWdDO1FBQ2hDLElBQUksTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ2pCLE1BQU0sR0FBRyxrREFBa0QsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDMUUsU0FBUztRQUNYLENBQUM7UUFFRCw4REFBOEQ7UUFDOUQsSUFBSSxNQUFNLEtBQUssQ0FBQyxJQUFJLE1BQU0sRUFBRSxDQUFDO1lBQzNCLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMscUNBQXFDLENBQUMsQ0FBQztZQUNuRSxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUNWLE1BQU0sVUFBVSxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFDO2dCQUNqRCxNQUFNLE1BQU0sR0FBRyxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxVQUFVLEVBQUUsQ0FBQztnQkFDM0MsS0FBSyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDdEMsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRUQsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDO0FBRUQsbUdBQW1HO0FBQ25HLFNBQVMsc0JBQXNCLENBQzdCLFFBQXFCLEVBQ3JCLEtBQTRCO0lBRTVCLE1BQU0sT0FBTyxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFDbEMsTUFBTSxLQUFLLEdBQUcsQ0FBQyxHQUFHLFFBQVEsQ0FBQyxDQUFDO0lBRTVCLE9BQU8sS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN4QixNQUFNLEdBQUcsR0FBRyxLQUFLLENBQUMsS0FBSyxFQUFHLENBQUM7UUFDM0IsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQztZQUFFLFNBQVM7UUFDL0IsT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUVqQixNQUFNLElBQUksR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzVCLElBQUksSUFBSSxFQUFFLENBQUM7WUFDVCxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO2dCQUN2QixJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO29CQUN0QixLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUNsQixDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRUQsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQztBQUVELFNBQVMsb0JBQW9CLENBQUMsV0FBbUI7SUFDL0MsTUFBTSxPQUFPLEdBQXVCLEVBQUUsQ0FBQztJQUN2QyxNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3RDLE1BQU0sZUFBZSxHQUFHLG9CQUFvQixDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBRTFELElBQUksaUJBQWlCLEdBQUcsS0FBSyxDQUFDO0lBQzlCLElBQUksWUFBWSxHQUE0QixJQUFJLENBQUM7SUFFakQsTUFBTSxZQUFZLEdBQUcsZUFBZSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLGdCQUFnQixDQUFDO0lBRWhGLCtFQUErRTtJQUMvRSxJQUFJLFlBQVksR0FBdUIsSUFBSSxDQUFDO0lBQzVDLElBQUksZUFBZSxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQ3pCLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLEdBQUcsa0JBQWtCLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDeEQsb0ZBQW9GO1FBQ3BGLElBQUksUUFBUSxDQUFDLElBQUksR0FBRyxDQUFDLElBQUksT0FBTyxDQUFDLElBQUksR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUMxQyxNQUFNLEtBQUssR0FBRyxrQkFBa0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUN4QyxZQUFZLEdBQUcsc0JBQXNCLENBQUMsUUFBUSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ3pELENBQUM7SUFDSCxDQUFDO0lBRUQsS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUN6QixtQ0FBbUM7UUFDbkMsSUFBSSxZQUFZLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDNUIsaUJBQWlCLEdBQUcsSUFBSSxDQUFDO1lBQ3pCLFNBQVM7UUFDWCxDQUFDO1FBRUQsc0RBQXNEO1FBQ3RELElBQUksaUJBQWlCLElBQUksS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNuRSxrQkFBa0I7WUFDbEIsSUFBSSxZQUFZO2dCQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDN0MsaUJBQWlCLEdBQUcsS0FBSyxDQUFDO1lBQzFCLFNBQVM7UUFDWCxDQUFDO1FBRUQsSUFBSSxDQUFDLGlCQUFpQjtZQUFFLFNBQVM7UUFFakMsa0NBQWtDO1FBQ2xDLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDdkMsSUFBSSxLQUFLLElBQUksS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQzFCLHNCQUFzQjtZQUN0QixJQUFJLFlBQVk7Z0JBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQztZQUU3QyxNQUFNLFFBQVEsR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFDLEtBQUssSUFBSSxTQUFTLENBQUM7WUFDakQsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUM7WUFDbEMsTUFBTSxVQUFVLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7WUFFeEMsSUFBSSxLQUFLLEdBQUcsS0FBSyxDQUFDO1lBQ2xCLElBQUksZUFBZSxJQUFJLENBQUMsSUFBSSxZQUFZLEVBQUUsQ0FBQztnQkFDekMsK0VBQStFO2dCQUMvRSxNQUFNLEdBQUcsR0FBRyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksUUFBUSxJQUFJLE9BQU8sSUFBSSxVQUFVLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FBRyxPQUFPLElBQUksVUFBVSxFQUFFLENBQUM7Z0JBQzVGLEtBQUssR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDakMsQ0FBQztZQUVELFlBQVksR0FBRztnQkFDYixLQUFLLEVBQUUsUUFBUTtnQkFDZixJQUFJLEVBQUUsT0FBTztnQkFDYixPQUFPLEVBQUUsVUFBVTtnQkFDbkIsR0FBRyxFQUFFLEtBQUs7YUFDWCxDQUFDO1lBQ0YsU0FBUztRQUNYLENBQUM7UUFFRCx1REFBdUQ7UUFDdkQsSUFBSSxlQUFlLEdBQUcsQ0FBQyxJQUFJLFlBQVksSUFBSSxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUN4RSxZQUFZLENBQUMsR0FBRyxHQUFHLElBQUksQ0FBQztRQUMxQixDQUFDO0lBQ0gsQ0FBQztJQUVELDBCQUEwQjtJQUMxQixJQUFJLFlBQVk7UUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBRTdDLE9BQU8sT0FBTyxDQUFDO0FBQ2pCLENBQUM7QUFFRCxNQUFNLFVBQVUsY0FBYyxDQUFDLFdBQW1CLEVBQUUsUUFBZ0I7SUFDbEUsTUFBTSxPQUFPLEdBQXFCLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLENBQUM7SUFFaEUsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLGFBQWE7UUFDMUMsT0FBTyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBRWxDLElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLG9CQUFvQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBRW5ELEtBQUssTUFBTSxHQUFHLElBQUksUUFBUSxFQUFFLENBQUM7WUFDM0IsTUFBTSxTQUFTLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxHQUFHLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztZQUMxRCxNQUFNLFVBQVUsR0FBRyxJQUFJLFVBQVUsQ0FBQyxTQUFTLEVBQUUsU0FBUyxFQUFFLEdBQUcsQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLE9BQU8sRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDaEgsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQztZQUMzRCxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFLEdBQUcsQ0FBQyxPQUFPLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDbkYsQ0FBQztJQUNILENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1gsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNuQixDQUFDO0lBRUQsT0FBTyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0FBQ2xDLENBQUMifQ==

package/build/module/sdk/Dependencies/LocalDependency/parsers/pyParser.d.ts

@@ -1,2 +1,3 @@
 import { ILocalDependency } from "../DependencyTypes";
 export declare function requirementsParser(fileContent: string, filePath: string): Promise<ILocalDependency>;
+export declare function pipRequirementsLockParser(fileContent: string, filePath: string): Promise<ILocalDependency>;

package/build/module/sdk/Dependencies/LocalDependency/parsers/pyParser.js

@@ -10,14 +10,8 @@ function parseDep(str) {
     };
 }
 const PURL_TYPE = 'pypi';
-// Parse a requirements.txt file from python projects
-// See reference on: https://pip.pypa.io/en/stable/reference/requirements-file-format/
-const MANIFEST_FILE = 'requirements.txt';
-export function requirementsParser(fileContent, filePath) {
-    // If the file is not a python manifest file, return an empty results
+function parseRequirementsContent(fileContent, filePath) {
     const results = { file: filePath, purls: [] };
-    if (path.basename(filePath) != MANIFEST_FILE)
-        return Promise.resolve(results);
     const lines = fileContent.split('\n');
     for (let line of lines) {
         line = line.trim();
@@ -35,6 +29,9 @@ export function requirementsParser(fileContent, filePath) {
             else if (line.startsWith('-r')) {
                 continue;
             } // Recursive dependencies (NOT SUPPORTED YET)
+            else if (line.startsWith('-')) {
+                continue;
+            } // Skip pip options (e.g. --hash, -i, -e, etc.)
             else {
                 const dep = parseDep(line);
                 if (!dep.sym) {
@@ -52,6 +49,25 @@ export function requirementsParser(fileContent, filePath) {
             }
         }
     }
-    return Promise.resolve(results);
+    return results;
+}
+// Parse a requirements.txt file from python projects
+// See reference on: https://pip.pypa.io/en/stable/reference/requirements-file-format/
+const MANIFEST_FILE = 'requirements.txt';
+export function requirementsParser(fileContent, filePath) {
+    // If the file is not a python manifest file, return an empty results
+    const results = { file: filePath, purls: [] };
+    if (path.basename(filePath) != MANIFEST_FILE)
+        return Promise.resolve(results);
+    return Promise.resolve(parseRequirementsContent(fileContent, filePath));
+}
+// Parse a pip_requirements_lock.txt file (pip-compile / pip-tools lock file)
+// Same format as requirements.txt but typically with pinned versions (==)
+const LOCK_MANIFEST_FILE = 'pip_requirements_lock.txt';
+export function pipRequirementsLockParser(fileContent, filePath) {
+    const results = { file: filePath, purls: [] };
+    if (path.basename(filePath) != LOCK_MANIFEST_FILE)
+        return Promise.resolve(results);
+    return Promise.resolve(parseRequirementsContent(fileContent, filePath));
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHlQYXJzZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvc2RrL0RlcGVuZGVuY2llcy9Mb2NhbERlcGVuZGVuY3kvcGFyc2Vycy9weVBhcnNlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLElBQUksTUFBTSxNQUFNLENBQUM7QUFDeEIsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLGVBQWUsQ0FBQztBQUUzQyxPQUFPLEVBQUUsV0FBVyxFQUFFLFVBQVUsRUFBRSxNQUFNLFNBQVMsQ0FBQztBQUdsRCxTQUFTLFFBQVEsQ0FBRSxHQUFXO0lBQzVCLE1BQU0sR0FBRyxHQUFHLDBEQUEwRCxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNqRixPQUFPO1FBQ0wsSUFBSSxFQUFFLEdBQUcsRUFBRSxNQUFNLEVBQUUsSUFBSTtRQUN2QixHQUFHLEVBQUUsR0FBRyxFQUFFLE1BQU0sRUFBRSxHQUFHO1FBQ3JCLE9BQU8sRUFBRSxHQUFHLEVBQUUsTUFBTSxFQUFFLE9BQU87S0FDOUIsQ0FBQztBQUNKLENBQUM7QUFFRCxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUM7QUFFekIscURBQXFEO0FBQ3JELHNGQUFzRjtBQUN0RixNQUFNLGFBQWEsR0FBRyxrQkFBa0IsQ0FBQztBQUN6QyxNQUFNLFVBQVUsa0JBQWtCLENBQUMsV0FBbUIsRUFBRSxRQUFnQjtJQUVwRSxxRUFBcUU7SUFDckUsTUFBTSxPQUFPLEdBQXFCLEVBQUMsSUFBSSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFDLENBQUM7SUFDOUQsSUFBRyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLGFBQWE7UUFDdkMsT0FBTyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBRXBDLE1BQU0sS0FBSyxHQUFrQixXQUFXLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBRXJELEtBQUssSUFBSSxJQUFJLElBQUksS0FBSyxFQUFFLENBQUM7UUFDckIsSUFBSSxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNuQixJQUFHLElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQztZQUFFLFNBQVM7UUFDOUIsSUFBRyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sR0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLCtCQUErQjtZQUN4RSxJQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO2dCQUNsQixzRkFBc0Y7Z0JBQ3RGLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsK0RBQStELENBQUMsQ0FBQztnQkFDeEYsU0FBUztZQUNiLENBQUM7aUJBQ0ksSUFBRyxXQUFXLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztnQkFBQSxTQUFTO1lBQUEsQ0FBQyxDQUFDLG1DQUFtQztpQkFDckUsSUFBRyxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7Z0JBQUEsU0FBUztZQUFBLENBQUMsQ0FBQyw2Q0FBNkM7aUJBQ25GLENBQUM7Z0JBRUYsTUFBTSxHQUFHLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDO2dCQUMzQixJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxDQUFDO29CQUNiLE1BQU0sVUFBVSxHQUFHLElBQUksVUFBVSxDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUsR0FBRyxDQUFDLElBQUksRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFDO29CQUM5RyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFDLElBQUksRUFBRSxVQUFVLEVBQUMsQ0FBQyxDQUFDO2dCQUN6QyxDQUFDO3FCQUFNLElBQUksR0FBRyxDQUFDLEdBQUcsS0FBSyxJQUFJLEVBQUUsQ0FBQztvQkFDNUIsTUFBTSxVQUFVLEdBQUcsSUFBSSxVQUFVLENBQUMsU0FBUyxFQUFFLFNBQVMsRUFBRSxHQUFHLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxPQUFPLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFDO29CQUNoSCxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFDLElBQUksRUFBRSxVQUFVLEVBQUMsQ0FBQyxDQUFDO2dCQUN6QyxDQUFDO3FCQUFNLENBQUM7b0JBQ04sTUFBTSxVQUFVLEdBQUcsSUFBSSxVQUFVLENBQUMsU0FBUyxFQUFFLFNBQVMsRUFBRSxHQUFHLENBQUMsSUFBSSxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUM7b0JBQzlHLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEVBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUsR0FBRyxDQUFDLEdBQUcsR0FBQyxHQUFHLENBQUMsT0FBTyxFQUFDLENBQUMsQ0FBQztnQkFDM0UsQ0FBQztZQUNMLENBQUM7UUFDTCxDQUFDO0lBQ0wsQ0FBQztJQUNILE9BQU8sT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQztBQUNsQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHlQYXJzZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvc2RrL0RlcGVuZGVuY2llcy9Mb2NhbERlcGVuZGVuY3kvcGFyc2Vycy9weVBhcnNlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLElBQUksTUFBTSxNQUFNLENBQUM7QUFDeEIsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLGVBQWUsQ0FBQztBQUUzQyxPQUFPLEVBQUUsV0FBVyxFQUFFLFVBQVUsRUFBRSxNQUFNLFNBQVMsQ0FBQztBQUdsRCxTQUFTLFFBQVEsQ0FBRSxHQUFXO0lBQzVCLE1BQU0sR0FBRyxHQUFHLDBEQUEwRCxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNqRixPQUFPO1FBQ0wsSUFBSSxFQUFFLEdBQUcsRUFBRSxNQUFNLEVBQUUsSUFBSTtRQUN2QixHQUFHLEVBQUUsR0FBRyxFQUFFLE1BQU0sRUFBRSxHQUFHO1FBQ3JCLE9BQU8sRUFBRSxHQUFHLEVBQUUsTUFBTSxFQUFFLE9BQU87S0FDOUIsQ0FBQztBQUNKLENBQUM7QUFFRCxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUM7QUFFekIsU0FBUyx3QkFBd0IsQ0FBQyxXQUFtQixFQUFFLFFBQWdCO0lBQ25FLE1BQU0sT0FBTyxHQUFxQixFQUFDLElBQUksRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBQyxDQUFDO0lBQzlELE1BQU0sS0FBSyxHQUFrQixXQUFXLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBRXJELEtBQUssSUFBSSxJQUFJLElBQUksS0FBSyxFQUFFLENBQUM7UUFDckIsSUFBSSxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNuQixJQUFHLElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQztZQUFFLFNBQVM7UUFDOUIsSUFBRyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sR0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLCtCQUErQjtZQUN4RSxJQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO2dCQUNsQixzRkFBc0Y7Z0JBQ3RGLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsK0RBQStELENBQUMsQ0FBQztnQkFDeEYsU0FBUztZQUNiLENBQUM7aUJBQ0ksSUFBRyxXQUFXLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztnQkFBQSxTQUFTO1lBQUEsQ0FBQyxDQUFDLG1DQUFtQztpQkFDckUsSUFBRyxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7Z0JBQUEsU0FBUztZQUFBLENBQUMsQ0FBQyw2Q0FBNkM7aUJBQ25GLElBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUFBLFNBQVM7WUFBQSxDQUFDLENBQUMsK0NBQStDO2lCQUNwRixDQUFDO2dCQUVGLE1BQU0sR0FBRyxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztnQkFDM0IsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsQ0FBQztvQkFDYixNQUFNLFVBQVUsR0FBRyxJQUFJLFVBQVUsQ0FBQyxTQUFTLEVBQUUsU0FBUyxFQUFFLEdBQUcsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztvQkFDOUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBQyxJQUFJLEVBQUUsVUFBVSxFQUFDLENBQUMsQ0FBQztnQkFDekMsQ0FBQztxQkFBTSxJQUFJLEdBQUcsQ0FBQyxHQUFHLEtBQUssSUFBSSxFQUFFLENBQUM7b0JBQzVCLE1BQU0sVUFBVSxHQUFHLElBQUksVUFBVSxDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUsR0FBRyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztvQkFDaEgsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBQyxJQUFJLEVBQUUsVUFBVSxFQUFDLENBQUMsQ0FBQztnQkFDekMsQ0FBQztxQkFBTSxDQUFDO29CQUNOLE1BQU0sVUFBVSxHQUFHLElBQUksVUFBVSxDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUsR0FBRyxDQUFDLElBQUksRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFDO29CQUM5RyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFLEdBQUcsQ0FBQyxHQUFHLEdBQUMsR0FBRyxDQUFDLE9BQU8sRUFBQyxDQUFDLENBQUM7Z0JBQzNFLENBQUM7WUFDTCxDQUFDO1FBQ0wsQ0FBQztJQUNMLENBQUM7SUFDSCxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDO0FBRUQscURBQXFEO0FBQ3JELHNGQUFzRjtBQUN0RixNQUFNLGFBQWEsR0FBRyxrQkFBa0IsQ0FBQztBQUN6QyxNQUFNLFVBQVUsa0JBQWtCLENBQUMsV0FBbUIsRUFBRSxRQUFnQjtJQUVwRSxxRUFBcUU7SUFDckUsTUFBTSxPQUFPLEdBQXFCLEVBQUMsSUFBSSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFDLENBQUM7SUFDOUQsSUFBRyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLGFBQWE7UUFDdkMsT0FBTyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBRXBDLE9BQU8sT0FBTyxDQUFDLE9BQU8sQ0FBQyx3QkFBd0IsQ0FBQyxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztBQUM1RSxDQUFDO0FBRUQsNkVBQTZFO0FBQzdFLDBFQUEwRTtBQUMxRSxNQUFNLGtCQUFrQixHQUFHLDJCQUEyQixDQUFDO0FBQ3ZELE1BQU0sVUFBVSx5QkFBeUIsQ0FBQyxXQUFtQixFQUFFLFFBQWdCO0lBRTNFLE1BQU0sT0FBTyxHQUFxQixFQUFDLElBQUksRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBQyxDQUFDO0lBQzlELElBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxrQkFBa0I7UUFDNUMsT0FBTyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBRXBDLE9BQU8sT0FBTyxDQUFDLE9BQU8sQ0FBQyx3QkFBd0IsQ0FBQyxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztBQUM1RSxDQUFDIn0=