@agenttool/telescope 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (78) hide show
  1. package/CLAUDE.md +71 -0
  2. package/LICENSE +202 -0
  3. package/NOTICE +4 -0
  4. package/README.md +230 -0
  5. package/dist/archive.d.ts +22 -0
  6. package/dist/archive.d.ts.map +1 -0
  7. package/dist/archive.js +477 -0
  8. package/dist/archive.js.map +1 -0
  9. package/dist/cli-core.d.ts +7 -0
  10. package/dist/cli-core.d.ts.map +1 -0
  11. package/dist/cli-core.js +154 -0
  12. package/dist/cli-core.js.map +1 -0
  13. package/dist/cli.d.ts +3 -0
  14. package/dist/cli.d.ts.map +1 -0
  15. package/dist/cli.js +4 -0
  16. package/dist/cli.js.map +1 -0
  17. package/dist/constants.d.ts +6 -0
  18. package/dist/constants.d.ts.map +1 -0
  19. package/dist/constants.js +15 -0
  20. package/dist/constants.js.map +1 -0
  21. package/dist/errors.d.ts +13 -0
  22. package/dist/errors.d.ts.map +1 -0
  23. package/dist/errors.js +25 -0
  24. package/dist/errors.js.map +1 -0
  25. package/dist/format.d.ts +4 -0
  26. package/dist/format.d.ts.map +1 -0
  27. package/dist/format.js +69 -0
  28. package/dist/format.js.map +1 -0
  29. package/dist/index.d.ts +14 -0
  30. package/dist/index.d.ts.map +1 -0
  31. package/dist/index.js +11 -0
  32. package/dist/index.js.map +1 -0
  33. package/dist/parsers/agent-txt.d.ts +25 -0
  34. package/dist/parsers/agent-txt.d.ts.map +1 -0
  35. package/dist/parsers/agent-txt.js +86 -0
  36. package/dist/parsers/agent-txt.js.map +1 -0
  37. package/dist/parsers/cards.d.ts +18 -0
  38. package/dist/parsers/cards.d.ts.map +1 -0
  39. package/dist/parsers/cards.js +46 -0
  40. package/dist/parsers/cards.js.map +1 -0
  41. package/dist/parsers/common.d.ts +19 -0
  42. package/dist/parsers/common.d.ts.map +1 -0
  43. package/dist/parsers/common.js +69 -0
  44. package/dist/parsers/common.js.map +1 -0
  45. package/dist/parsers/love.d.ts +29 -0
  46. package/dist/parsers/love.d.ts.map +1 -0
  47. package/dist/parsers/love.js +247 -0
  48. package/dist/parsers/love.js.map +1 -0
  49. package/dist/parsers/pathways.d.ts +13 -0
  50. package/dist/parsers/pathways.d.ts.map +1 -0
  51. package/dist/parsers/pathways.js +47 -0
  52. package/dist/parsers/pathways.js.map +1 -0
  53. package/dist/plans.d.ts +14 -0
  54. package/dist/plans.d.ts.map +1 -0
  55. package/dist/plans.js +131 -0
  56. package/dist/plans.js.map +1 -0
  57. package/dist/scan.d.ts +3 -0
  58. package/dist/scan.d.ts.map +1 -0
  59. package/dist/scan.js +1093 -0
  60. package/dist/scan.js.map +1 -0
  61. package/dist/target.d.ts +6 -0
  62. package/dist/target.d.ts.map +1 -0
  63. package/dist/target.js +180 -0
  64. package/dist/target.js.map +1 -0
  65. package/dist/transport.d.ts +23 -0
  66. package/dist/transport.d.ts.map +1 -0
  67. package/dist/transport.js +291 -0
  68. package/dist/transport.js.map +1 -0
  69. package/dist/types.d.ts +131 -0
  70. package/dist/types.d.ts.map +1 -0
  71. package/dist/types.js +2 -0
  72. package/dist/types.js.map +1 -0
  73. package/dist/verify.d.ts +12 -0
  74. package/dist/verify.d.ts.map +1 -0
  75. package/dist/verify.js +38 -0
  76. package/dist/verify.js.map +1 -0
  77. package/package.json +65 -0
  78. package/schema/agenttool-telescope-report-v0.1.schema.json +404 -0
@@ -0,0 +1,247 @@
1
+ import { isExactSemver, isNpmPackageName, isRecord, parseFailure, parseJsonBody, readBoundedString, } from "./common.js";
2
+ export function parseLoveDiscovery(body, limits) {
3
+ const decoded = parseJsonBody(body, limits);
4
+ if (!decoded.ok)
5
+ return decoded;
6
+ if (!isRecord(decoded.value))
7
+ return parseFailure("love_discovery_not_object");
8
+ if (decoded.value.protocol !== "love-package/v1") {
9
+ return parseFailure("love_discovery_protocol_mismatch");
10
+ }
11
+ const indexUrl = readBoundedString(decoded.value.index_url, 2_048);
12
+ if (!indexUrl)
13
+ return parseFailure("love_discovery_missing_index");
14
+ const warnings = [];
15
+ let npmMirror = null;
16
+ if (decoded.value.registry_mirrors !== undefined) {
17
+ if (!Array.isArray(decoded.value.registry_mirrors)) {
18
+ warnings.push("love_invalid_registry_mirrors");
19
+ }
20
+ else if (decoded.value.registry_mirrors.length > 32) {
21
+ return parseFailure("love_registry_mirror_limit");
22
+ }
23
+ else {
24
+ const candidates = decoded.value.registry_mirrors.filter((entry) => isRecord(entry) && entry.ecosystem === "npm");
25
+ if (candidates.length > 1) {
26
+ warnings.push("love_ambiguous_npm_mirror");
27
+ }
28
+ else if (candidates.length === 1) {
29
+ const candidate = candidates[0];
30
+ const registryUrl = readBoundedString(candidate?.registry_url, 2_048);
31
+ if (!registryUrl) {
32
+ warnings.push("love_invalid_npm_mirror");
33
+ }
34
+ else {
35
+ npmMirror = {
36
+ registry_url: registryUrl,
37
+ authority: typeof candidate?.authority === "boolean"
38
+ ? candidate.authority
39
+ : null,
40
+ };
41
+ }
42
+ }
43
+ }
44
+ }
45
+ return {
46
+ ok: true,
47
+ value: {
48
+ index_url: indexUrl,
49
+ access: readBoundedString(decoded.value.access, 256),
50
+ registry_role: readBoundedString(decoded.value.registry_role, 256),
51
+ npm_mirror: npmMirror,
52
+ },
53
+ warnings,
54
+ };
55
+ }
56
+ export function selectLoveManifest(body, limits, packageName, version) {
57
+ const decoded = parseJsonBody(body, limits);
58
+ if (!decoded.ok)
59
+ return decoded;
60
+ if (!isRecord(decoded.value))
61
+ return parseFailure("love_index_not_object");
62
+ if (decoded.value.protocol !== "love-package/v1" ||
63
+ decoded.value.document_type !== "package-index") {
64
+ return parseFailure("love_index_protocol_mismatch");
65
+ }
66
+ if (!Array.isArray(decoded.value.packages)) {
67
+ return parseFailure("love_index_missing_packages");
68
+ }
69
+ if (decoded.value.packages.length > 256) {
70
+ return parseFailure("love_index_package_limit");
71
+ }
72
+ const packages = decoded.value.packages.filter((entry) => isRecord(entry) && entry.name === packageName);
73
+ if (packages.length === 0)
74
+ return parseFailure("love_package_not_found");
75
+ if (packages.length > 1)
76
+ return parseFailure("love_package_ambiguous");
77
+ const selectedPackage = packages[0];
78
+ if (!selectedPackage || !Array.isArray(selectedPackage.versions)) {
79
+ return parseFailure("love_index_missing_versions");
80
+ }
81
+ if (selectedPackage.versions.length > 256) {
82
+ return parseFailure("love_index_version_limit");
83
+ }
84
+ const versions = selectedPackage.versions.filter((entry) => isRecord(entry) && entry.version === version);
85
+ if (versions.length === 0)
86
+ return parseFailure("love_version_not_found");
87
+ if (versions.length > 1)
88
+ return parseFailure("love_version_ambiguous");
89
+ const manifestUrl = readBoundedString(versions[0]?.manifest_url, 2_048);
90
+ if (!manifestUrl)
91
+ return parseFailure("love_manifest_url_invalid");
92
+ return {
93
+ ok: true,
94
+ value: { manifest_url: manifestUrl },
95
+ warnings: ["love_index_latest_ignored"],
96
+ };
97
+ }
98
+ function parseAbsoluteHttpUrl(value) {
99
+ const raw = readBoundedString(value, 2_048);
100
+ if (!raw || /\s/.test(raw))
101
+ return null;
102
+ try {
103
+ const url = new URL(raw);
104
+ if ((url.protocol !== "http:" && url.protocol !== "https:") ||
105
+ url.username ||
106
+ url.password ||
107
+ url.hash) {
108
+ return null;
109
+ }
110
+ return url.href;
111
+ }
112
+ catch {
113
+ return null;
114
+ }
115
+ }
116
+ function validSourcePath(value) {
117
+ if (value === ".")
118
+ return true;
119
+ const path = readBoundedString(value, 1_000);
120
+ if (!path || path.includes("\\") || /[\u0000-\u001f\u007f]/.test(path)) {
121
+ return false;
122
+ }
123
+ const segments = path.split("/");
124
+ return segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
125
+ }
126
+ export function parseLoveManifest(body, limits, expectedName, expectedVersion) {
127
+ const decoded = parseJsonBody(body, limits);
128
+ if (!decoded.ok)
129
+ return decoded;
130
+ if (!isRecord(decoded.value))
131
+ return parseFailure("love_manifest_not_object");
132
+ if (decoded.value.protocol !== "love-package/v1" ||
133
+ decoded.value.document_type !== "package-manifest") {
134
+ return parseFailure("love_manifest_protocol_mismatch");
135
+ }
136
+ const name = readBoundedString(decoded.value.name, 214);
137
+ const version = readBoundedString(decoded.value.version, 128);
138
+ if (!name ||
139
+ !version ||
140
+ !isNpmPackageName(name) ||
141
+ !isExactSemver(version) ||
142
+ name !== expectedName ||
143
+ version !== expectedVersion) {
144
+ return parseFailure("love_manifest_identity_mismatch");
145
+ }
146
+ if (!isRecord(decoded.value.artifact)) {
147
+ return parseFailure("love_manifest_missing_artifact");
148
+ }
149
+ const description = readBoundedString(decoded.value.description, 2_000);
150
+ const hasLicense = Object.prototype.hasOwnProperty.call(decoded.value, "license");
151
+ const license = decoded.value.license;
152
+ if (!description ||
153
+ !hasLicense ||
154
+ !(license === null || readBoundedString(license, 500) !== null) ||
155
+ !isRecord(decoded.value.runtime) ||
156
+ decoded.value.runtime.kind !== "javascript" ||
157
+ !isRecord(decoded.value.runtime.engines) ||
158
+ !isRecord(decoded.value.install) ||
159
+ decoded.value.install.format !== "npm-tarball" ||
160
+ !isRecord(decoded.value.source)) {
161
+ return parseFailure("love_manifest_missing_required_profile");
162
+ }
163
+ const engines = Object.entries(decoded.value.runtime.engines);
164
+ if (engines.length > 32 ||
165
+ engines.some(([engine, constraint]) => !/^[a-z0-9][a-z0-9._-]*$/.test(engine) ||
166
+ readBoundedString(constraint, 200) === null)) {
167
+ return parseFailure("love_manifest_invalid_runtime");
168
+ }
169
+ const installSpecifier = parseAbsoluteHttpUrl(decoded.value.install.specifier);
170
+ const repository = readBoundedString(decoded.value.source.repository, 2_048);
171
+ const revision = readBoundedString(decoded.value.source.revision, 500);
172
+ let repositoryUrl = null;
173
+ try {
174
+ repositoryUrl = repository ? new URL(repository) : null;
175
+ }
176
+ catch {
177
+ repositoryUrl = null;
178
+ }
179
+ if (!installSpecifier ||
180
+ !repositoryUrl ||
181
+ /\s/.test(repository ?? "") ||
182
+ !revision ||
183
+ !validSourcePath(decoded.value.source.path)) {
184
+ return parseFailure("love_manifest_invalid_install_or_source");
185
+ }
186
+ const artifact = decoded.value.artifact;
187
+ const filename = readBoundedString(artifact.filename, 128);
188
+ const sha256 = readBoundedString(artifact.sha256, 64);
189
+ const size = artifact.size;
190
+ if (artifact.format !== "npm-tarball" ||
191
+ !filename ||
192
+ filename === "." ||
193
+ filename === ".." ||
194
+ !/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(filename) ||
195
+ !filename.endsWith(".tgz") ||
196
+ artifact.media_type !== "application/gzip" ||
197
+ !sha256 ||
198
+ !/^[0-9a-f]{64}$/.test(sha256) ||
199
+ !Number.isSafeInteger(size) ||
200
+ typeof size !== "number" ||
201
+ size <= 0 ||
202
+ size > 512 * 1024 * 1024) {
203
+ return parseFailure("love_manifest_invalid_artifact");
204
+ }
205
+ if (!Array.isArray(artifact.mirrors) || artifact.mirrors.length === 0) {
206
+ return parseFailure("love_manifest_missing_mirrors");
207
+ }
208
+ if (artifact.mirrors.length > 16) {
209
+ return parseFailure("love_manifest_mirror_limit");
210
+ }
211
+ const mirrors = [];
212
+ const canonicalMirrors = new Set();
213
+ for (const mirror of artifact.mirrors) {
214
+ if (!isRecord(mirror))
215
+ return parseFailure("love_manifest_invalid_mirror");
216
+ const url = parseAbsoluteHttpUrl(mirror.url);
217
+ if (!url || canonicalMirrors.has(url)) {
218
+ return parseFailure("love_manifest_invalid_mirror");
219
+ }
220
+ canonicalMirrors.add(url);
221
+ mirrors.push(url);
222
+ }
223
+ if (!canonicalMirrors.has(installSpecifier)) {
224
+ return parseFailure("love_manifest_install_not_mirror");
225
+ }
226
+ let dependencySelfContained = null;
227
+ if (decoded.value.dependency_resolution !== undefined) {
228
+ if (!isRecord(decoded.value.dependency_resolution) ||
229
+ decoded.value.dependency_resolution.mode !== "package_manifest" ||
230
+ typeof decoded.value.dependency_resolution.self_contained !== "boolean") {
231
+ return parseFailure("love_manifest_invalid_dependency_resolution");
232
+ }
233
+ dependencySelfContained =
234
+ decoded.value.dependency_resolution.self_contained;
235
+ }
236
+ return {
237
+ ok: true,
238
+ value: {
239
+ name,
240
+ version,
241
+ artifact: { filename, sha256, size, mirrors },
242
+ dependency_self_contained: dependencySelfContained,
243
+ },
244
+ warnings: [],
245
+ };
246
+ }
247
+ //# sourceMappingURL=love.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"love.js","sourceRoot":"","sources":["../../src/parsers/love.ts"],"names":[],"mappings":"AACA,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,iBAAiB,GAElB,MAAM,aAAa,CAAC;AAYrB,MAAM,UAAU,kBAAkB,CAChC,IAAgB,EAChB,MAAuB;IAEvB,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,OAAO,YAAY,CAAC,2BAA2B,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACjD,OAAO,YAAY,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ;QAAE,OAAO,YAAY,CAAC,8BAA8B,CAAC,CAAC;IAEnE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,SAAS,GAAsC,IAAI,CAAC;IACxD,IAAI,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACtD,OAAO,YAAY,CAAC,4BAA4B,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CACtD,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CACxD,CAAC;YACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC7C,CAAC;iBAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;gBAChC,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;gBACtE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,SAAS,GAAG;wBACV,YAAY,EAAE,WAAW;wBACzB,SAAS,EACP,OAAO,SAAS,EAAE,SAAS,KAAK,SAAS;4BACvC,CAAC,CAAC,SAAS,CAAC,SAAS;4BACrB,CAAC,CAAC,IAAI;qBACX,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC;YACpD,aAAa,EAAE,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC;YAClE,UAAU,EAAE,SAAS;SACtB;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAMD,MAAM,UAAU,kBAAkB,CAChC,IAAgB,EAChB,MAAuB,EACvB,WAAmB,EACnB,OAAe;IAEf,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC,uBAAuB,CAAC,CAAC;IAC3E,IACE,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,iBAAiB;QAC5C,OAAO,CAAC,KAAK,CAAC,aAAa,KAAK,eAAe,EAC/C,CAAC;QACD,OAAO,YAAY,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,YAAY,CAAC,6BAA6B,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACxC,OAAO,YAAY,CAAC,0BAA0B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAC5C,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CACzD,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC,wBAAwB,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,wBAAwB,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,OAAO,YAAY,CAAC,6BAA6B,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC,0BAA0B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAC9C,CAAC,KAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,CACjE,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC,wBAAwB,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,wBAAwB,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,WAAW;QAAE,OAAO,YAAY,CAAC,2BAA2B,CAAC,CAAC;IACnE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE;QACpC,QAAQ,EAAE,CAAC,2BAA2B,CAAC;KACxC,CAAC;AACJ,CAAC;AAcD,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;YACvD,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,IAAI,EACR,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC,KAAK,CACnB,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAgB,EAChB,MAAuB,EACvB,YAAoB,EACpB,eAAuB;IAEvB,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC,0BAA0B,CAAC,CAAC;IAC9E,IACE,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,iBAAiB;QAC5C,OAAO,CAAC,KAAK,CAAC,aAAa,KAAK,kBAAkB,EAClD,CAAC;QACD,OAAO,YAAY,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9D,IACE,CAAC,IAAI;QACL,CAAC,OAAO;QACR,CAAC,gBAAgB,CAAC,IAAI,CAAC;QACvB,CAAC,aAAa,CAAC,OAAO,CAAC;QACvB,IAAI,KAAK,YAAY;QACrB,OAAO,KAAK,eAAe,EAC3B,CAAC;QACD,OAAO,YAAY,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,YAAY,CAAC,gCAAgC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CACrD,OAAO,CAAC,KAAK,EACb,SAAS,CACV,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IACtC,IACE,CAAC,WAAW;QACZ,CAAC,UAAU;QACX,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;QAC/D,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY;QAC3C,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACxC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa;QAC9C,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAC/B,CAAC;QACD,OAAO,YAAY,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,IACE,OAAO,CAAC,MAAM,GAAG,EAAE;QACnB,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,CACvB,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC;YACtC,iBAAiB,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,IAAI,CAC9C,EACD,CAAC;QACD,OAAO,YAAY,CAAC,+BAA+B,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,gBAAgB,GAAG,oBAAoB,CAC3C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAChC,CAAC;IACF,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACvE,IAAI,aAAa,GAAe,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;IACD,IACE,CAAC,gBAAgB;QACjB,CAAC,aAAa;QACd,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3B,CAAC,QAAQ;QACT,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAC3C,CAAC;QACD,OAAO,YAAY,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;IACxC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IACE,QAAQ,CAAC,MAAM,KAAK,aAAa;QACjC,CAAC,QAAQ;QACT,QAAQ,KAAK,GAAG;QAChB,QAAQ,KAAK,IAAI;QACjB,CAAC,+BAA+B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC/C,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC1B,QAAQ,CAAC,UAAU,KAAK,kBAAkB;QAC1C,CAAC,MAAM;QACP,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9B,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;QAC3B,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,IAAI,CAAC;QACT,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,EACxB,CAAC;QACD,OAAO,YAAY,CAAC,gCAAgC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,YAAY,CAAC,+BAA+B,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,YAAY,CAAC,8BAA8B,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,YAAY,CAAC,8BAA8B,CAAC,CAAC;QACtD,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC5C,OAAO,YAAY,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,uBAAuB,GAAmB,IAAI,CAAC;IACnD,IAAI,OAAO,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACtD,IACE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC;YAC9C,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,KAAK,kBAAkB;YAC/D,OAAO,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,cAAc,KAAK,SAAS,EACvE,CAAC;YACD,OAAO,YAAY,CAAC,6CAA6C,CAAC,CAAC;QACrE,CAAC;QACD,uBAAuB;YACrB,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,cAAc,CAAC;IACvD,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,IAAI;YACJ,OAAO;YACP,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE;YAC7C,yBAAyB,EAAE,uBAAuB;SACnD;QACD,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC"}
@@ -0,0 +1,13 @@
1
+ import type { TelescopeLimits } from "../types.js";
2
+ import { type ParseResult } from "./common.js";
3
+ export interface ParsedPathways {
4
+ sdk_version: string;
5
+ npm: {
6
+ package: string;
7
+ authority: boolean | null;
8
+ dist_tags: string | null;
9
+ verification_boundary_present: boolean;
10
+ } | null;
11
+ }
12
+ export declare function parsePathways(body: Uint8Array, limits: TelescopeLimits): ParseResult<ParsedPathways>;
13
+ //# sourceMappingURL=pathways.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"pathways.d.ts","sourceRoot":"","sources":["../../src/parsers/pathways.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAOL,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE;QACH,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;QAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,6BAA6B,EAAE,OAAO,CAAC;KACxC,GAAG,IAAI,CAAC;CACV;AAED,wBAAgB,aAAa,CAC3B,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,eAAe,GACtB,WAAW,CAAC,cAAc,CAAC,CA6C7B"}
@@ -0,0 +1,47 @@
1
+ import { isExactSemver, isNpmPackageName, isRecord, parseFailure, parseJsonBody, readBoundedString, } from "./common.js";
2
+ export function parsePathways(body, limits) {
3
+ const decoded = parseJsonBody(body, limits);
4
+ if (!decoded.ok)
5
+ return decoded;
6
+ const root = decoded.value;
7
+ if (!isRecord(root) || !isRecord(root.first_success)) {
8
+ return parseFailure("pathways_missing_first_success");
9
+ }
10
+ const firstSuccess = root.first_success;
11
+ if (!isRecord(firstSuccess.tutorial)) {
12
+ return parseFailure("pathways_missing_tutorial");
13
+ }
14
+ const sdkVersion = readBoundedString(firstSuccess.tutorial.sdk_version, 128);
15
+ if (!sdkVersion || !isExactSemver(sdkVersion)) {
16
+ return parseFailure("pathways_invalid_sdk_version");
17
+ }
18
+ const warnings = [];
19
+ let npm = null;
20
+ if (isRecord(firstSuccess.package_discovery)) {
21
+ const candidate = firstSuccess.package_discovery.optional_npm;
22
+ if (candidate !== undefined) {
23
+ if (!isRecord(candidate)) {
24
+ warnings.push("pathways_invalid_optional_npm");
25
+ }
26
+ else {
27
+ const packageName = readBoundedString(candidate.package, 214);
28
+ if (!packageName || !isNpmPackageName(packageName)) {
29
+ warnings.push("pathways_invalid_npm_package");
30
+ }
31
+ else {
32
+ npm = {
33
+ package: packageName,
34
+ authority: typeof candidate.authority === "boolean"
35
+ ? candidate.authority
36
+ : null,
37
+ dist_tags: readBoundedString(candidate.dist_tags, 256),
38
+ verification_boundary_present: readBoundedString(candidate.verification_boundary, 4_096) !==
39
+ null,
40
+ };
41
+ }
42
+ }
43
+ }
44
+ }
45
+ return { ok: true, value: { sdk_version: sdkVersion, npm }, warnings };
46
+ }
47
+ //# sourceMappingURL=pathways.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"pathways.js","sourceRoot":"","sources":["../../src/parsers/pathways.ts"],"names":[],"mappings":"AACA,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,iBAAiB,GAElB,MAAM,aAAa,CAAC;AAYrB,MAAM,UAAU,aAAa,CAC3B,IAAgB,EAChB,MAAuB;IAEvB,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACrD,OAAO,YAAY,CAAC,gCAAgC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,OAAO,YAAY,CAAC,2BAA2B,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC7E,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,OAAO,YAAY,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,GAAG,GAA0B,IAAI,CAAC;IACtC,IAAI,QAAQ,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,CAAC,YAAY,CAAC;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBAC9D,IAAI,CAAC,WAAW,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;oBACnD,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;gBAChD,CAAC;qBAAM,CAAC;oBACN,GAAG,GAAG;wBACJ,OAAO,EAAE,WAAW;wBACpB,SAAS,EACP,OAAO,SAAS,CAAC,SAAS,KAAK,SAAS;4BACtC,CAAC,CAAC,SAAS,CAAC,SAAS;4BACrB,CAAC,CAAC,IAAI;wBACV,SAAS,EAAE,iBAAiB,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC;wBACtD,6BAA6B,EAC3B,iBAAiB,CAAC,SAAS,CAAC,qBAAqB,EAAE,KAAK,CAAC;4BACzD,IAAI;qBACP,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC;AACzE,CAAC"}
@@ -0,0 +1,14 @@
1
+ import type { ParsedLoveManifest } from "./parsers/love.js";
2
+ import type { ActionPlan, ProbeId } from "./types.js";
3
+ export declare function shellQuote(value: string): string;
4
+ export declare function buildNpmAction(input: {
5
+ package_name: string;
6
+ version: string;
7
+ evidence_ids: ProbeId[];
8
+ }): ActionPlan;
9
+ export declare function buildLoveActions(input: {
10
+ manifest: ParsedLoveManifest;
11
+ mirror_url: string;
12
+ evidence_ids: ProbeId[];
13
+ }): ActionPlan[];
14
+ //# sourceMappingURL=plans.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"plans.d.ts","sourceRoot":"","sources":["../src/plans.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAqBtD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGhD;AAiBD,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,OAAO,EAAE,CAAC;CACzB,GAAG,UAAU,CAsBb;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,OAAO,EAAE,CAAC;CACzB,GAAG,UAAU,EAAE,CA0Ef"}
package/dist/plans.js ADDED
@@ -0,0 +1,131 @@
1
+ const DOWNLOAD_PROGRAM = [
2
+ "import { randomUUID } from 'node:crypto';",
3
+ "import { link,open,unlink } from 'node:fs/promises';",
4
+ "const [url,file,sizeText]=process.argv.slice(1);",
5
+ "const expected=Number(sizeText);",
6
+ "const temporary=file+'.part-'+randomUUID();let handle;let created=false;",
7
+ "try{",
8
+ "const parsed=new URL(url);if(parsed.protocol!=='https:'||parsed.username||parsed.password||parsed.port||parsed.search||parsed.hash||parsed.href!==url)throw new Error();",
9
+ "handle=await open(temporary,'wx',0o600);created=true;",
10
+ "const response=await fetch(url,{redirect:'manual',credentials:'omit',headers:{'accept-encoding':'identity'},signal:AbortSignal.timeout(120000)});",
11
+ "if(response.status!==200||!response.body||response.url!==url)throw new Error();",
12
+ "const encoding=response.headers.get('content-encoding');if(encoding&&encoding.toLowerCase()!=='identity')throw new Error();",
13
+ "const length=response.headers.get('content-length');if(length!==null&&Number(length)!==expected)throw new Error();",
14
+ "let total=0;for await(const chunk of response.body){total+=chunk.length;if(total>expected)throw new Error();let offset=0;while(offset<chunk.length){const written=await handle.write(chunk,offset);if(written.bytesWritten<=0)throw new Error();offset+=written.bytesWritten;}}",
15
+ "if(total!==expected)throw new Error();await handle.sync();await handle.close();handle=undefined;await link(temporary,file);await unlink(temporary).catch(()=>{});created=false;",
16
+ "console.log('downloaded '+file);",
17
+ "}catch{if(handle)await handle.close().catch(()=>{});if(created)await unlink(temporary).catch(()=>{});console.error('download failed');process.exit(1);}",
18
+ ].join("");
19
+ export function shellQuote(value) {
20
+ if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value))
21
+ return value;
22
+ return `'${value.replace(/'/g, `'"'"'`)}'`;
23
+ }
24
+ function action(input) {
25
+ return {
26
+ ...input,
27
+ display: [input.executable, ...input.argv].map(shellQuote).join(" "),
28
+ display_shell: "posix",
29
+ automatic: false,
30
+ requires_explicit_consent: true,
31
+ };
32
+ }
33
+ export function buildNpmAction(input) {
34
+ return action({
35
+ id: "npm_install",
36
+ kind: "npm_convenience",
37
+ executable: "npm",
38
+ argv: [
39
+ "install",
40
+ "--ignore-scripts",
41
+ "--no-audit",
42
+ "--no-fund",
43
+ "--save-exact",
44
+ `${input.package_name}@${input.version}`,
45
+ ],
46
+ evidence_ids: input.evidence_ids,
47
+ boundary_codes: [
48
+ "npm_declared_non_authoritative",
49
+ "npm_skips_independent_love_size_sha256_check",
50
+ "package_manager_may_use_configured_registry_credentials",
51
+ "lifecycle_scripts_disabled_but_imported_code_remains_untrusted",
52
+ "command_not_executed",
53
+ ],
54
+ });
55
+ }
56
+ export function buildLoveActions(input) {
57
+ const { filename, size, sha256 } = input.manifest.artifact;
58
+ return [
59
+ action({
60
+ id: "love_download",
61
+ kind: "love_verified_install",
62
+ executable: "node",
63
+ argv: [
64
+ "--input-type=module",
65
+ "--eval",
66
+ DOWNLOAD_PROGRAM,
67
+ input.mirror_url,
68
+ filename,
69
+ String(size),
70
+ ],
71
+ evidence_ids: input.evidence_ids,
72
+ boundary_codes: [
73
+ "download_locator_is_not_content_identity",
74
+ "redirects_not_followed",
75
+ "generated_network_deadline_120_seconds",
76
+ "generated_command_does_not_repeat_dns_preflight_or_pin_an_address",
77
+ "complete_bytes_are_atomically_published_without_overwriting_destination",
78
+ "run_in_a_caller_controlled_directory",
79
+ "command_not_executed",
80
+ ],
81
+ }),
82
+ action({
83
+ id: "love_verify",
84
+ kind: "love_verified_install",
85
+ executable: "agenttool-telescope",
86
+ argv: [
87
+ "verify-package",
88
+ filename,
89
+ "--size",
90
+ String(size),
91
+ "--sha256",
92
+ sha256,
93
+ "--name",
94
+ input.manifest.name,
95
+ "--version",
96
+ input.manifest.version,
97
+ ],
98
+ evidence_ids: input.evidence_ids,
99
+ boundary_codes: [
100
+ "checks_exact_local_file_size_and_sha256",
101
+ "checks_bounded_tar_layout_and_embedded_package_identity",
102
+ "telescope_cli_must_be_on_path",
103
+ "manifest_digest_does_not_authenticate_publisher",
104
+ "command_not_executed",
105
+ ],
106
+ }),
107
+ action({
108
+ id: "love_install",
109
+ kind: "love_verified_install",
110
+ executable: "npm",
111
+ argv: [
112
+ "install",
113
+ "--ignore-scripts",
114
+ "--no-audit",
115
+ "--no-fund",
116
+ `./${filename}`,
117
+ ],
118
+ evidence_ids: input.evidence_ids,
119
+ boundary_codes: [
120
+ "install_only_after_local_verification",
121
+ "protect_or_reverify_the_file_across_the_verify_install_boundary",
122
+ "declared_dependencies_may_use_configured_registry_or_cache",
123
+ "package_manager_may_use_configured_registry_credentials",
124
+ "lifecycle_scripts_disabled_but_imported_code_remains_untrusted",
125
+ "runtime_engine_compatibility_not_evaluated",
126
+ "command_not_executed",
127
+ ],
128
+ }),
129
+ ];
130
+ }
131
+ //# sourceMappingURL=plans.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"plans.js","sourceRoot":"","sources":["../src/plans.ts"],"names":[],"mappings":"AAGA,MAAM,gBAAgB,GAAG;IACvB,2CAA2C;IAC3C,sDAAsD;IACtD,kDAAkD;IAClD,kCAAkC;IAClC,0EAA0E;IAC1E,MAAM;IACN,0KAA0K;IAC1K,uDAAuD;IACvD,mJAAmJ;IACnJ,iFAAiF;IACjF,6HAA6H;IAC7H,oHAAoH;IACpH,iRAAiR;IACjR,iLAAiL;IACjL,kCAAkC;IAClC,yJAAyJ;CAC1J,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEX,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,MAAM,CACb,KAGC;IAED,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACpE,aAAa,EAAE,OAAO;QACtB,SAAS,EAAE,KAAK;QAChB,yBAAyB,EAAE,IAAI;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAI9B;IACC,OAAO,MAAM,CAAC;QACZ,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,iBAAiB;QACvB,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACJ,SAAS;YACT,kBAAkB;YAClB,YAAY;YACZ,WAAW;YACX,cAAc;YACd,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,OAAO,EAAE;SACzC;QACD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE;YACd,gCAAgC;YAChC,8CAA8C;YAC9C,yDAAyD;YACzD,gEAAgE;YAChE,sBAAsB;SACvB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAIhC;IACC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC3D,OAAO;QACL,MAAM,CAAC;YACL,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,uBAAuB;YAC7B,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE;gBACJ,qBAAqB;gBACrB,QAAQ;gBACR,gBAAgB;gBAChB,KAAK,CAAC,UAAU;gBAChB,QAAQ;gBACR,MAAM,CAAC,IAAI,CAAC;aACb;YACD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,cAAc,EAAE;gBACd,0CAA0C;gBAC1C,wBAAwB;gBACxB,wCAAwC;gBACxC,mEAAmE;gBACnE,yEAAyE;gBACzE,sCAAsC;gBACtC,sBAAsB;aACvB;SACF,CAAC;QACF,MAAM,CAAC;YACL,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,uBAAuB;YAC7B,UAAU,EAAE,qBAAqB;YACjC,IAAI,EAAE;gBACJ,gBAAgB;gBAChB,QAAQ;gBACR,QAAQ;gBACR,MAAM,CAAC,IAAI,CAAC;gBACZ,UAAU;gBACV,MAAM;gBACN,QAAQ;gBACR,KAAK,CAAC,QAAQ,CAAC,IAAI;gBACnB,WAAW;gBACX,KAAK,CAAC,QAAQ,CAAC,OAAO;aACvB;YACD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,cAAc,EAAE;gBACd,yCAAyC;gBACzC,yDAAyD;gBACzD,+BAA+B;gBAC/B,iDAAiD;gBACjD,sBAAsB;aACvB;SACF,CAAC;QACF,MAAM,CAAC;YACL,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,uBAAuB;YAC7B,UAAU,EAAE,KAAK;YACjB,IAAI,EAAE;gBACJ,SAAS;gBACT,kBAAkB;gBAClB,YAAY;gBACZ,WAAW;gBACX,KAAK,QAAQ,EAAE;aAChB;YACD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,cAAc,EAAE;gBACd,uCAAuC;gBACvC,iEAAiE;gBACjE,4DAA4D;gBAC5D,yDAAyD;gBACzD,gEAAgE;gBAChE,4CAA4C;gBAC5C,sBAAsB;aACvB;SACF,CAAC;KACH,CAAC;AACJ,CAAC"}
package/dist/scan.d.ts ADDED
@@ -0,0 +1,3 @@
1
+ import type { TelescopeOptions, TelescopeReport } from "./types.js";
2
+ export declare function inspectTarget(input: string, options?: TelescopeOptions): Promise<TelescopeReport>;
3
+ //# sourceMappingURL=scan.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAWV,gBAAgB,EAChB,eAAe,EAChB,MAAM,YAAY,CAAC;AAsXpB,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CA+8B1B"}