@npm-safe/core-dsh 1.0.5

package/dist/llm/llm-config.js

@@ -0,0 +1,188 @@
+/**
+ * LLM provider configuration persistence and runtime resolution.
+ *
+ * {@link LlmConfigManager} reads/writes the `~/.npm-safe/llm.json` file. The
+ * configuration is optional: when no API key is configured and no supported
+ * environment variable is present, LLM scanning is silently disabled and the
+ * rest of the engine keeps working normally.
+ *
+ * API keys are stored in plain text at the configured path. The file is created
+ * with `0o600` permissions when possible (best effort on Windows).
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createLlmProvider, LlmProviderType } from './provider.js';
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_MAX_INPUT_CHARS = 12_000;
+const DEFAULT_MAX_TOKENS = 4096;
+const ENV_KEY_MAP = {
+    [LlmProviderType.OpenAi]: 'OPENAI_API_KEY',
+    [LlmProviderType.Gemini]: 'GEMINI_API_KEY',
+    [LlmProviderType.Anthropic]: 'ANTHROPIC_API_KEY',
+};
+const ENV_BASE_URL_MAP = {
+    [LlmProviderType.OpenAi]: 'OPENAI_BASE_URL',
+    [LlmProviderType.Gemini]: 'GEMINI_BASE_URL',
+    [LlmProviderType.Anthropic]: 'ANTHROPIC_BASE_URL',
+};
+const ENV_MODEL_MAP = {
+    [LlmProviderType.OpenAi]: 'OPENAI_MODEL',
+    [LlmProviderType.Gemini]: 'GEMINI_MODEL',
+    [LlmProviderType.Anthropic]: 'ANTHROPIC_MODEL',
+};
+/** Returns the default path for the LLM configuration file. */
+export function getDefaultLlmConfigPath() {
+    return path.join(os.homedir(), '.npm-safe', 'llm.json');
+}
+/** Masks an API key for display: keeps the first 4 and last 4 characters. */
+function maskApiKey(key) {
+    if (!key)
+        return undefined;
+    if (key.length <= 8)
+        return '*'.repeat(key.length);
+    return `${key.slice(0, 4)}${'*'.repeat(key.length - 8)}${key.slice(-4)}`;
+}
+/**
+ * Loads, mutates, and persists LLM provider configuration.
+ *
+ * Thread-safe per instance; concurrent instances may race on the file, which is
+ * acceptable for a single-user desktop tool.
+ */
+export class LlmConfigManager {
+    filePath;
+    config;
+    constructor(filePath) {
+        this.filePath = filePath ?? getDefaultLlmConfigPath();
+        this.config = this.load();
+    }
+    /** Load (or initialize) the config file. */
+    load() {
+        try {
+            const raw = fs.readFileSync(this.filePath, 'utf8');
+            const parsed = JSON.parse(raw);
+            return this.normalize(parsed);
+        }
+        catch {
+            return this.normalize({});
+        }
+    }
+    /** Persist the current configuration to disk. */
+    save() {
+        try {
+            fs.mkdirSync(path.dirname(this.filePath), { recursive: true });
+            fs.writeFileSync(this.filePath, JSON.stringify(this.config, null, 2));
+            try {
+                fs.chmodSync(this.filePath, 0o600);
+            }
+            catch {
+                // Ignore platforms/filesystems where chmod is unsupported.
+            }
+        }
+        catch {
+            // Best-effort persistence; in-memory config remains valid.
+        }
+    }
+    /** Normalize a partial config into a full config with defaults. */
+    normalize(input) {
+        const provider = input.provider && Object.values(LlmProviderType).includes(input.provider)
+            ? input.provider
+            : LlmProviderType.OpenAi;
+        return {
+            enabled: input.enabled ?? false,
+            provider,
+            apiKey: input.apiKey,
+            baseUrl: input.baseUrl,
+            model: input.model,
+            timeoutMs: input.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+            maxInputChars: input.maxInputChars ?? DEFAULT_MAX_INPUT_CHARS,
+            maxTokens: input.maxTokens ?? DEFAULT_MAX_TOKENS,
+        };
+    }
+    /** Returns the current persisted config, including the raw API key. */
+    getConfig() {
+        return this.config;
+    }
+    /** Returns a masked status view suitable for display. */
+    getStatus() {
+        const resolved = this.resolveApiKey();
+        return {
+            enabled: this.config.enabled,
+            provider: this.config.provider,
+            configured: !!resolved,
+            model: this.resolveModel(),
+            baseUrl: this.resolveBaseUrl(),
+            apiKey: maskApiKey(resolved),
+            maxTokens: this.config.maxTokens,
+            maxInputChars: this.config.maxInputChars,
+        };
+    }
+    /** Update the persisted config. */
+    setConfig(update) {
+        const nextApiKey = update.apiKey !== undefined ? update.apiKey : this.config.apiKey;
+        const next = {
+            enabled: update.enabled ?? this.config.enabled,
+            provider: update.provider && Object.values(LlmProviderType).includes(update.provider)
+                ? update.provider
+                : this.config.provider,
+            apiKey: nextApiKey,
+            baseUrl: update.baseUrl !== undefined ? update.baseUrl : this.config.baseUrl,
+            model: update.model !== undefined ? update.model : this.config.model,
+            timeoutMs: update.timeoutMs ?? this.config.timeoutMs,
+            maxInputChars: update.maxInputChars ?? this.config.maxInputChars,
+            maxTokens: update.maxTokens ?? this.config.maxTokens,
+        };
+        this.config = next;
+        this.save();
+    }
+    /**
+     * Resolve the effective API key, preferring the persisted config and falling
+     * back to a provider-specific environment variable.
+     */
+    resolveApiKey() {
+        if (this.config.apiKey && this.config.apiKey.trim().length > 0) {
+            return this.config.apiKey.trim();
+        }
+        const envKey = ENV_KEY_MAP[this.config.provider];
+        return process.env[envKey]?.trim() || undefined;
+    }
+    /** Resolve the effective base URL. */
+    resolveBaseUrl() {
+        return this.config.baseUrl?.trim() || process.env[ENV_BASE_URL_MAP[this.config.provider]]?.trim() || undefined;
+    }
+    /** Resolve the effective model. */
+    resolveModel() {
+        return this.config.model?.trim() || process.env[ENV_MODEL_MAP[this.config.provider]]?.trim() || undefined;
+    }
+    /**
+     * Create a configured {@link LlmScanProvider} if LLM scanning is enabled and
+     * an API key is available; otherwise return `undefined`.
+     */
+    createProvider() {
+        const apiKey = this.resolveApiKey();
+        if (!this.config.enabled || !apiKey)
+            return undefined;
+        const options = {
+            provider: this.config.provider,
+            apiKey,
+            baseUrl: this.resolveBaseUrl(),
+            model: this.resolveModel(),
+            timeoutMs: this.config.timeoutMs,
+            maxInputChars: this.config.maxInputChars,
+            maxTokens: this.config.maxTokens,
+        };
+        return createLlmProvider(options);
+    }
+    /**
+     * Test whether the current configuration can connect to the provider.
+     *
+     * Returns `false` when the provider is not configured or disabled.
+     */
+    async testConnection() {
+        const provider = this.createProvider();
+        if (!provider)
+            return false;
+        return provider.testConnection();
+    }
+}
+//# sourceMappingURL=llm-config.js.map

package/dist/llm/llm-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-config.js","sourceRoot":"","sources":["../../src/llm/llm-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGnE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,MAAM,WAAW,GAA8C;IAC7D,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,gBAAgB;IAC1C,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,gBAAgB;IAC1C,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,mBAAmB;CACjD,CAAC;AAEF,MAAM,gBAAgB,GAA8C;IAClE,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,iBAAiB;IAC3C,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,iBAAiB;IAC3C,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,oBAAoB;CAClD,CAAC;AAEF,MAAM,aAAa,GAA8C;IAC/D,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,cAAc;IACxC,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,cAAc;IACxC,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,iBAAiB;CAC/C,CAAC;AA0CF,+DAA+D;AAC/D,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAC1D,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IACV,QAAQ,CAAS;IAC1B,MAAM,CAAY;IAE1B,YAAY,QAAiB;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,uBAAuB,EAAE,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,4CAA4C;IACpC,IAAI;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;YACrD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,iDAAiD;IACzC,IAAI;QACV,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC;IAED,mEAAmE;IAC3D,SAAS,CAAC,KAAyB;QACzC,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;YACvE,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK;YAC/B,QAAQ;YACR,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,kBAAkB;YAChD,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,uBAAuB;YAC7D,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,kBAAkB;SACjD,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,yDAAyD;IACzD,SAAS;QACP,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,UAAU,EAAE,CAAC,CAAC,QAAQ;YACtB,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE;YAC1B,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE;YAC9B,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC;YAC5B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;SACzC,CAAC;IACJ,CAAC;IAED,mCAAmC;IACnC,SAAS,CAAC,MAA0B;QAClC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACpF,MAAM,IAAI,GAAc;YACtB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;YAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACnF,CAAC,CAAC,MAAM,CAAC,QAAQ;gBACjB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;YACxB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5E,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;YACpE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS;YACpD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa;YAChE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS;SACrD,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,aAAa;QACnB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAClD,CAAC;IAED,sCAAsC;IAC9B,cAAc;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACjH,CAAC;IAED,mCAAmC;IAC3B,YAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC5G,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAEtD,MAAM,OAAO,GAAuB;YAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE;YAC9B,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE;YAC1B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACxC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;SACjC,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,QAAQ,CAAC,cAAc,EAAE,CAAC;IACnC,CAAC;CACF"}

package/dist/llm/parse.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Shared parse/validation helpers for LLM scan providers.
+ *
+ * This module extracts the JSON-parsing, finding-validation, and report-
+ * assembly helpers that are common to every OpenAI-compatible LLM provider
+ * (OpenAI, Gemini, Anthropic, …) so each provider can reuse them instead of
+ * duplicating logic.
+ */
+import { FindingCategory, Severity, type LlmScanReport, type ScanFinding } from "../scanner/types.js";
+/**
+ * Error thrown when an LLM provider request or response is invalid.
+ */
+export declare class LlmProviderError extends Error {
+    readonly statusCode?: number | undefined;
+    constructor(message: string, statusCode?: number | undefined);
+}
+/**
+ * System prompt instructing the model to act as an npm package security
+ * analyst and return a JSON object with a fixed shape.
+ */
+export declare const SYSTEM_PROMPT = "You are an npm package security analyst. Analyze the supplied package metadata and README for semantic risks that static rules may miss. Return only a JSON object with this exact shape:\n{\"summary\":\"string\",\"functionalMatch\":true,\"suspiciousScore\":0,\"findings\":[{\"ruleId\":\"llm-...\",\"ruleName\":\"string\",\"severity\":\"low|medium|high|critical\",\"message\":\"string\",\"recommendation\":\"string\",\"category\":\"informational|known-malicious|suspicious-dependency|sensitive-exposure|code-obfuscation|binary-download|install-script|typosquatting|homograph-attack|registry-mismatch\"}]}\nsuspiciousScore is 0-100, where higher means more suspicious. Do not invent evidence that is not present in the input. Use an empty findings array when no concern is found.";
+/**
+ * Parse a raw LLM response string into a JSON object.
+ *
+ * Strips ```json fences, parses the content, and rejects non-object values
+ * (arrays, primitives, or invalid JSON) by throwing {@link LlmProviderError}.
+ *
+ * @param content - Raw text returned by the LLM.
+ * @returns The parsed JSON object.
+ * @throws {LlmProviderError} When the content is not a valid JSON object.
+ */
+export declare function parseJsonObject(content: string): Record<string, unknown>;
+/**
+ * Parse an unknown value into a list of validated scan findings.
+ *
+ * Non-array inputs yield an empty array. Items that are not objects or that
+ * lack a `message` field are dropped. Each surviving item is mapped to a
+ * {@link ScanFinding} with normalized severity and category.
+ *
+ * @param value - The `findings` field of a parsed LLM response.
+ * @returns A readonly array of validated findings.
+ */
+export declare function parseFindings(value: unknown): readonly ScanFinding[];
+/**
+ * Coerce an unknown value into a {@link Severity}, defaulting to Medium.
+ *
+ * @param value - The `severity` field of a finding.
+ * @returns The validated severity, or `Severity.Medium` if invalid.
+ */
+export declare function readSeverity(value: unknown): Severity;
+/**
+ * Coerce an unknown value into a {@link FindingCategory}, defaulting to
+ * Informational.
+ *
+ * @param value - The `category` field of a finding.
+ * @returns The validated category, or `FindingCategory.Informational` if invalid.
+ */
+export declare function readCategory(value: unknown): FindingCategory;
+/**
+ * Return the value if it is a string, otherwise `undefined`.
+ *
+ * @param value - An arbitrary unknown value.
+ * @returns The string value, or `undefined`.
+ */
+export declare function readOptionalString(value: unknown): string | undefined;
+/**
+ * Return the value if it is a boolean, otherwise `undefined`.
+ *
+ * @param value - An arbitrary unknown value.
+ * @returns The boolean value, or `undefined`.
+ */
+export declare function readOptionalBoolean(value: unknown): boolean | undefined;
+/**
+ * Return the value if it is a finite number, otherwise `undefined`.
+ *
+ * @param value - An arbitrary unknown value.
+ * @returns The finite number, or `undefined`.
+ */
+export declare function readOptionalNumber(value: unknown): number | undefined;
+/**
+ * Clamp a numeric score to the 0-100 range, rounding to the nearest integer.
+ *
+ * @param value - The raw numeric score.
+ * @returns The clamped integer score between 0 and 100.
+ */
+export declare function clampScore(value: number): number;
+/**
+ * Assemble the final {@link LlmScanReport} from a parsed LLM JSON object.
+ *
+ * @param parsed - The JSON object returned by {@link parseJsonObject}.
+ * @param scannedAt - ISO 8601 timestamp marking when the scan ran.
+ * @returns A populated LLM scan report with `enabled: true`.
+ */
+export declare function buildReport(parsed: Record<string, unknown>, scannedAt: string): LlmScanReport;
+//# sourceMappingURL=parse.d.ts.map

package/dist/llm/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/llm/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,eAAe,EACf,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAE7B;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;aACI,UAAU,CAAC,EAAE,MAAM;gBAApD,OAAO,EAAE,MAAM,EAAkB,UAAU,CAAC,EAAE,MAAM,YAAA;CAIjE;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,6wBAEmJ,CAAC;AAE9K;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAaxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,WAAW,EAAE,CAgBpE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAKrD;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAI5D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAEvE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAErE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,SAAS,EAAE,MAAM,GAChB,aAAa,CASf"}

package/dist/llm/parse.js

@@ -0,0 +1,158 @@
+/**
+ * Shared parse/validation helpers for LLM scan providers.
+ *
+ * This module extracts the JSON-parsing, finding-validation, and report-
+ * assembly helpers that are common to every OpenAI-compatible LLM provider
+ * (OpenAI, Gemini, Anthropic, …) so each provider can reuse them instead of
+ * duplicating logic.
+ */
+import { FindingCategory, Severity, } from "../scanner/types.js";
+/**
+ * Error thrown when an LLM provider request or response is invalid.
+ */
+export class LlmProviderError extends Error {
+    statusCode;
+    constructor(message, statusCode) {
+        super(message);
+        this.statusCode = statusCode;
+        this.name = "LlmProviderError";
+    }
+}
+/**
+ * System prompt instructing the model to act as an npm package security
+ * analyst and return a JSON object with a fixed shape.
+ */
+export const SYSTEM_PROMPT = `You are an npm package security analyst. Analyze the supplied package metadata and README for semantic risks that static rules may miss. Return only a JSON object with this exact shape:
+{"summary":"string","functionalMatch":true,"suspiciousScore":0,"findings":[{"ruleId":"llm-...","ruleName":"string","severity":"low|medium|high|critical","message":"string","recommendation":"string","category":"informational|known-malicious|suspicious-dependency|sensitive-exposure|code-obfuscation|binary-download|install-script|typosquatting|homograph-attack|registry-mismatch"}]}
+suspiciousScore is 0-100, where higher means more suspicious. Do not invent evidence that is not present in the input. Use an empty findings array when no concern is found.`;
+/**
+ * Parse a raw LLM response string into a JSON object.
+ *
+ * Strips ```json fences, parses the content, and rejects non-object values
+ * (arrays, primitives, or invalid JSON) by throwing {@link LlmProviderError}.
+ *
+ * @param content - Raw text returned by the LLM.
+ * @returns The parsed JSON object.
+ * @throws {LlmProviderError} When the content is not a valid JSON object.
+ */
+export function parseJsonObject(content) {
+    const normalized = content.trim().replace(/^```json\s*/i, "").replace(/```$/, "").trim();
+    try {
+        const parsed = JSON.parse(normalized);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("expected a JSON object");
+        }
+        return parsed;
+    }
+    catch (error) {
+        throw new LlmProviderError(`LLM returned invalid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/**
+ * Parse an unknown value into a list of validated scan findings.
+ *
+ * Non-array inputs yield an empty array. Items that are not objects or that
+ * lack a `message` field are dropped. Each surviving item is mapped to a
+ * {@link ScanFinding} with normalized severity and category.
+ *
+ * @param value - The `findings` field of a parsed LLM response.
+ * @returns A readonly array of validated findings.
+ */
+export function parseFindings(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.flatMap((item, index) => {
+        if (!item || typeof item !== "object")
+            return [];
+        const finding = item;
+        const message = readOptionalString(finding.message);
+        if (!message)
+            return [];
+        return [{
+                ruleId: readOptionalString(finding.ruleId) ?? `llm-finding-${index + 1}`,
+                ruleName: readOptionalString(finding.ruleName) ?? "LLM security finding",
+                severity: readSeverity(finding.severity),
+                message,
+                recommendation: readOptionalString(finding.recommendation),
+                category: readCategory(finding.category),
+            }];
+    });
+}
+/**
+ * Coerce an unknown value into a {@link Severity}, defaulting to Medium.
+ *
+ * @param value - The `severity` field of a finding.
+ * @returns The validated severity, or `Severity.Medium` if invalid.
+ */
+export function readSeverity(value) {
+    return value === Severity.Critical || value === Severity.High ||
+        value === Severity.Medium || value === Severity.Low
+        ? value
+        : Severity.Medium;
+}
+/**
+ * Coerce an unknown value into a {@link FindingCategory}, defaulting to
+ * Informational.
+ *
+ * @param value - The `category` field of a finding.
+ * @returns The validated category, or `FindingCategory.Informational` if invalid.
+ */
+export function readCategory(value) {
+    return Object.values(FindingCategory).includes(value)
+        ? value
+        : FindingCategory.Informational;
+}
+/**
+ * Return the value if it is a string, otherwise `undefined`.
+ *
+ * @param value - An arbitrary unknown value.
+ * @returns The string value, or `undefined`.
+ */
+export function readOptionalString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+/**
+ * Return the value if it is a boolean, otherwise `undefined`.
+ *
+ * @param value - An arbitrary unknown value.
+ * @returns The boolean value, or `undefined`.
+ */
+export function readOptionalBoolean(value) {
+    return typeof value === "boolean" ? value : undefined;
+}
+/**
+ * Return the value if it is a finite number, otherwise `undefined`.
+ *
+ * @param value - An arbitrary unknown value.
+ * @returns The finite number, or `undefined`.
+ */
+export function readOptionalNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+/**
+ * Clamp a numeric score to the 0-100 range, rounding to the nearest integer.
+ *
+ * @param value - The raw numeric score.
+ * @returns The clamped integer score between 0 and 100.
+ */
+export function clampScore(value) {
+    return Math.max(0, Math.min(100, Math.round(value)));
+}
+/**
+ * Assemble the final {@link LlmScanReport} from a parsed LLM JSON object.
+ *
+ * @param parsed - The JSON object returned by {@link parseJsonObject}.
+ * @param scannedAt - ISO 8601 timestamp marking when the scan ran.
+ * @returns A populated LLM scan report with `enabled: true`.
+ */
+export function buildReport(parsed, scannedAt) {
+    return {
+        enabled: true,
+        summary: readOptionalString(parsed.summary),
+        functionalMatch: readOptionalBoolean(parsed.functionalMatch),
+        suspiciousScore: clampScore(readOptionalNumber(parsed.suspiciousScore) ?? 0),
+        findings: parseFindings(parsed.findings),
+        scannedAt,
+    };
+}
+//# sourceMappingURL=parse.js.map

package/dist/llm/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../src/llm/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,eAAe,EACf,QAAQ,GAGT,MAAM,qBAAqB,CAAC;AAE7B;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACI;IAA7C,YAAY,OAAe,EAAkB,UAAmB;QAC9D,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,eAAU,GAAV,UAAU,CAAS;QAE9D,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;;6KAEgJ,CAAC;AAE9K;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAY,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,gBAAgB,CACxB,8BAA8B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,IAA+B,CAAC;QAChD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC;gBACN,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,eAAe,KAAK,GAAG,CAAC,EAAE;gBACxE,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,sBAAsB;gBACxE,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACxC,OAAO;gBACP,cAAc,EAAE,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC1D,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;aACzC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,KAAK,QAAQ,CAAC,QAAQ,IAAI,KAAK,KAAK,QAAQ,CAAC,IAAI;QAC3D,KAAK,KAAK,QAAQ,CAAC,MAAM,IAAI,KAAK,KAAK,QAAQ,CAAC,GAAG;QACnD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAwB,CAAC;QACtE,CAAC,CAAC,KAAwB;QAC1B,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,MAA+B,EAC/B,SAAiB;IAEjB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,mBAAmB,CAAC,MAAM,CAAC,eAAe,CAAC;QAC5D,eAAe,EAAE,UAAU,CAAC,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC5E,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC;QACxC,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/llm/provider.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Multi-provider LLM scan core.
+ *
+ * This module hosts the unified {@link LlmProviderOptions} interface, the
+ * {@link LlmProviderType} enum, and the {@link createLlmProvider} factory
+ * that dispatches to a concrete provider implementation. The OpenAI-
+ * compatible provider ({@link OpenAICompatibleLlmProvider}) lives here as
+ * the reference implementation; Gemini and Anthropic providers live in
+ * sibling modules and are wired up through the factory.
+ *
+ * Shared parsing/validation helpers and the {@link LlmProviderError} class
+ * are imported from {@link ./parse.js} so every provider reuses the same
+ * logic instead of duplicating it.
+ */
+import type { LlmScanReport } from "../scanner/types.js";
+export { LlmProviderError } from "./parse.js";
+export { GeminiLlmProvider } from "./gemini.js";
+export { AnthropicLlmProvider } from "./anthropic.js";
+/**
+ * Input passed to an LLM scan provider.
+ */
+export interface LlmScanInput {
+    readonly packageName: string;
+    readonly version: string;
+    readonly description: string;
+    readonly readme: string;
+    readonly packageJson?: Record<string, unknown>;
+    /**
+     * Optional external abort signal. When supplied, the provider combines it
+     * with its own timeout controller via `AbortSignal.any` so an abort during
+     * an in-flight scan settles the promise promptly with an `AbortError`
+     * `DOMException` (cooperative cancellation).
+     */
+    readonly signal?: AbortSignal;
+}
+/**
+ * Contract every LLM scan provider implements.
+ */
+export interface LlmScanProvider {
+    scan(input: LlmScanInput): Promise<LlmScanReport>;
+    testConnection(): Promise<boolean>;
+}
+/**
+ * Supported LLM provider backends.
+ */
+export declare enum LlmProviderType {
+    OpenAi = "openai",
+    Gemini = "gemini",
+    Anthropic = "anthropic"
+}
+/**
+ * Unified options accepted by {@link createLlmProvider} and every concrete
+ * provider constructor. Fields not relevant to a given backend are ignored
+ * by that backend.
+ */
+export interface LlmProviderOptions {
+    /** Backend to instantiate. @default {@link LlmProviderType.OpenAi} */
+    readonly provider?: LlmProviderType;
+    /** API key. Falls back to a backend-specific env var when omitted. */
+    readonly apiKey?: string;
+    /** Base URL of the LLM API endpoint. */
+    readonly baseUrl?: string;
+    /** Model identifier to use for completions. */
+    readonly model?: string;
+    /** Request timeout in milliseconds. @default 30000 */
+    readonly timeoutMs?: number;
+    /** Maximum README characters to send to the model. @default 12000 */
+    readonly maxInputChars?: number;
+    /** Maximum response tokens. @default 4096 */
+    readonly maxTokens?: number;
+}
+/**
+ * Deprecated alias for {@link LlmProviderOptions}.
+ * @deprecated Use {@link LlmProviderOptions} instead.
+ */
+export type OpenAICompatibleLlmOptions = LlmProviderOptions;
+/**
+ * Construct an {@link LlmScanProvider} for the backend selected via
+ * {@link LlmProviderOptions.provider}. Defaults to the OpenAI-compatible
+ * provider.
+ *
+ * @param options - Provider configuration. When omitted, an OpenAI-
+ * compatible provider is constructed with environment-derived defaults.
+ * @returns A concrete {@link LlmScanProvider} instance.
+ */
+export declare function createLlmProvider(options?: LlmProviderOptions): LlmScanProvider;
+/**
+ * OpenAI-compatible chat completions LLM scan provider.
+ *
+ * Talks to any endpoint that implements the `/chat/completions` surface
+ * (OpenAI, Azure OpenAI, local LM Studio / Ollama OpenAI shims, etc.).
+ */
+export declare class OpenAICompatibleLlmProvider implements LlmScanProvider {
+    private readonly apiKey?;
+    private readonly baseUrl;
+    private readonly model;
+    private readonly timeoutMs;
+    private readonly maxInputChars;
+    private readonly maxTokens;
+    /**
+     * @param options - Provider configuration. Env-var fallbacks:
+     *   `apiKey` defaults to `process.env.OPENAI_API_KEY`.
+     */
+    constructor(options?: LlmProviderOptions);
+    /** @inheritdoc */
+    scan(input: LlmScanInput): Promise<LlmScanReport>;
+    /** @inheritdoc */
+    testConnection(): Promise<boolean>;
+    /**
+     * Issue a POST to `/chat/completions` with timeout and error normalization.
+     *
+     * @param body - The JSON request body.
+     * @param signal - Optional external abort signal combined with the owned
+     *   timeout controller via `AbortSignal.any`. An external abort propagates
+     *   as `DOMException('The operation was aborted.', 'AbortError')`.
+     * @returns The `choices[0].message.content` string from the response.
+     * @throws {LlmProviderError} On network, timeout, HTTP, or shape errors.
+     * @throws {DOMException} With name `AbortError` when `signal` is aborted.
+     */
+    private request;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/llm/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/llm/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAazD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,SAAS,cAAc;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,wCAAwC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAQ5D;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,eAAe,CAS/E;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,YAAW,eAAe;IACjE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC;;;OAGG;gBACS,OAAO,GAAE,kBAAuB;IAS5C,kBAAkB;IACZ,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IAoCvD,kBAAkB;IACZ,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IAUxC;;;;;;;;;;OAUG;YACW,OAAO;CAoDtB"}