@reneturcios/npmpreflight 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rene Turcios
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,151 @@
-# Temporary Holding Version
+# npmpreflight
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Audit a package directory before `npm publish`, while a bad publish is
+still cheap to undo.
+
+npmpreflight resolves the file set your package would actually ship,
+scans the shipped files for secret patterns, totals the size, and checks
+`package.json` for the fields and entry points a publish depends on. It
+answers the questions that are embarrassing to discover after a release:
+is a credential sitting in a shipped file, does the `bin` target exist
+in the tarball, is the license field set, and is a scoped package about
+to publish as restricted.
+
+## Install
+
+Run it without installing:
+
+```sh
+npx @reneturcios/npmpreflight check .
+```
+
+Or install it globally:
+
+```sh
+npm install -g @reneturcios/npmpreflight
+npmpreflight check .
+```
+
+Requires Node 20 or newer.
+
+## CLI usage
+
+```sh
+npmpreflight check [path] [--json]
+npmpreflight mcp
+npmpreflight --version
+```
+
+- `check [path]` audits the package directory at `path` (default: the
+  current directory) and prints a human readable report. Add `--json`
+  for the machine readable report.
+- `mcp` starts the MCP server over stdio (see below).
+- `--version` prints the version.
+
+Exit codes: `0` when the verdict is READY, `1` for any other verdict,
+`2` for a usage error or an unreadable or invalid `package.json`, and
+`141` when the reader closed the output pipe early.
+
+Example output:
+
+```text
+npmpreflight check .: FIX-FIRST
+  files: 4, bytes: 603, findings: 2 (high: 2, medium: 0, low: 0, info: 0)
+  summary: 4 shipped file(s), 603 byte(s), 2 finding(s) (2 high, 0 medium, 0 low, 0 info). High-severity findings must be fixed before publishing.
+  [HIGH] SECRET-LEAK src/index.js:2 Shipped file matches the secret pattern private-key-block. Remove the credential from the package and rotate it if it was ever real. (evidence: private-key-block)
+  [HIGH] SECRET-LEAK src/index.js:3 Shipped file matches the secret pattern github-pat-classic. Remove the credential from the package and rotate it if it was ever real. (evidence: github-pat-classic)
+FIX-FIRST: resolve the high-severity findings before publishing.
+```
+
+Findings never include the matched secret text. The evidence for a
+secret finding is the pattern id only, plus the file and line, so a
+report is safe to paste into an issue or a CI log.
+
+## MCP
+
+The same audit is available as an MCP tool over stdio:
+
+- Tool: `preflight_package`
+- Input: `path`, the package directory to check
+- Output: the JSON report, identical to `check --json`
+
+Start it with `npmpreflight mcp`, or configure an MCP client to run
+`npx @reneturcios/npmpreflight mcp`. The server is also published as an
+OCI image and listed in `server.json` under the name
+`io.github.CloudCorpRecords/npmpreflight`.
+
+## Checks
+
+| Rule | Severity | What it flags |
+| --- | --- | --- |
+| MISSING-FIELD | high | `package.json` is missing one of `name`, `version`, `license`, or `description` (one finding per missing field). |
+| BIN-MISSING | high | A `bin` path in `package.json` is not in the shipped file set. |
+| MAIN-MISSING | high | The `main` entry point is not in the shipped file set. |
+| SECRET-LEAK | high | A shipped text file matches a secret pattern: a private key block header, an AWS access key id shape (`AKIA` plus 16 characters), a classic GitHub token shape (`ghp_` plus 36 or more characters), a fine grained GitHub token shape (`github_pat_` prefix), an `sk-` API key shape, or a generic `api_key` style assignment with a long quoted value. Evidence is the pattern id only. |
+| OVERSIZE | medium | Total shipped size over 10 MiB, or any single shipped file over 1 MiB (one finding per oversize file). |
+| SCOPED-NO-PUBLISHCONFIG | medium | The package name is scoped (starts with `@`) and `publishConfig.access` is not `public`. |
+| NO-README | low | No README file is in the shipped set. |
+| NO-ENGINES | info | `package.json` declares no `engines` range. |
+
+Every report counts the shipped files and their total bytes, plus the
+finding totals by severity.
+
+## Verdict
+
+- `READY` when there are no high severity findings. Medium, low, and
+  info findings are reported but do not block the verdict.
+- `FIX-FIRST` when at least one high severity finding exists.
+
+## How the shipped file set is resolved
+
+- If `package.json` has a `files` array, those paths are included:
+  files are added directly and directories are walked recursively.
+  `package.json`, `README`, and `LICENSE` are always included when
+  present, whether or not they are listed, matching npm.
+- If there is no `files` array, everything in the directory is included
+  except `node_modules`, `.git`, and paths matched by `.npmignore`
+  when one is present. The always included files above are still
+  included even if an ignore rule would match them.
+- The walk is capped at 5000 shipped files. When the cap is reached
+  the report records it in its counts (`truncated: 1`, with
+  `filesSeen` and `maxFiles`) and the render notes that the remaining
+  files were not scanned.
+
+## Limits
+
+Read these before trusting a clean verdict:
+
+- The file set is a static resolution, not a byte-exact `npm pack`.
+  npm applies more rules (its own always excluded files, lifecycle
+  generated files, and publish time behaviour) that a static pass does
+  not reproduce. Treat npmpreflight as a preflight check, then confirm
+  a release with `npm pack --dry-run`.
+- `.npmignore` support is a simple subset: blank lines, `#` comments,
+  plain lines (a file name at any depth, or an exact relative path),
+  and directory patterns ending in `/`. Globs, negations, and
+  character classes in `.npmignore` are not supported and such lines
+  will not match the way npm would match them.
+- `files` entries support literal files, literal directories, simple
+  `*` and `**` globs, and `!` negations of those. Anything more exotic
+  is resolved literally and may differ from npm.
+- Secret scanning reads text files only. A file whose scanned head
+  contains a NUL byte is treated as binary and skipped. Only the first
+  512 KiB of each file is scanned, so a secret past that offset in a
+  large file will not be found. Patterns are shapes, not proof: a
+  match can be a test fixture or an example, and a real credential in
+  an unrecognized shape will not match.
+- Symlinks are not followed and are not shipped.
+- Output is deterministic: findings are sorted, counts are stable,
+  and no timestamps are emitted.
+
+## Development
+
+```sh
+npm install
+npm run build
+npm test
+```
+
+## License
+
+MIT

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+/**
+ * npmpreflight CLI.
+ *
+ *   npmpreflight check [target] [--json]
+ *   npmpreflight mcp
+ *   npmpreflight --version
+ *
+ * Exit codes: 0 when the verdict is READY, 1 for any other verdict,
+ * 2 usage error, 141 when the reader closed the output pipe early
+ * (the shell-visible equivalent of death by SIGPIPE). The emit contract
+ * follows FACTORY-NOTES.md: one flush-aware write, exitCode never
+ * process.exit on report paths.
+ */
+import { runCheck, renderReport, CLEAN_VERDICT, VERSION } from "./core.js";
+function exitBrokenPipe() {
+    process.exit(141);
+}
+process.stdout.on("error", (err) => {
+    if (err.code === "EPIPE")
+        exitBrokenPipe();
+    throw err;
+});
+async function emit(text, code) {
+    process.exitCode = code;
+    await new Promise((resolve, reject) => {
+        process.stdout.write(`${text}\n`, (err) => {
+            if (!err) {
+                resolve();
+                return;
+            }
+            if (err.code === "EPIPE")
+                exitBrokenPipe();
+            reject(err);
+        });
+    });
+}
+function usage() {
+    console.error(`Usage:
+  npmpreflight check [target] [--json]
+  npmpreflight mcp
+  npmpreflight --version`);
+    process.exit(2);
+}
+async function main() {
+    const [cmd, ...rest] = process.argv.slice(2);
+    if (cmd === "--version" || cmd === "-v" || cmd === "version") {
+        console.log(VERSION);
+        return;
+    }
+    if (cmd === "mcp") {
+        await import("./mcp.js");
+        return;
+    }
+    if (cmd !== "check")
+        usage();
+    const target = rest.find((a) => !a.startsWith("--")) ?? ".";
+    try {
+        const report = runCheck(target);
+        const text = rest.includes("--json") ? JSON.stringify(report, null, 2) : renderReport(report);
+        await emit(text, report.verdict === CLEAN_VERDICT ? 0 : 1);
+    }
+    catch (err) {
+        console.error(`error: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 2;
+    }
+}
+void main();
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE3E,SAAS,cAAc;IACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;IACxD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,cAAc,EAAE,CAAC;IAC3C,MAAM,GAAG,CAAC;AACZ,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAAY;IAC5C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IACxB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;YACxC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO;gBAAE,cAAc,EAAE,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,CAAC,KAAK,CAAC;;;yBAGS,CAAC,CAAC;IACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,OAAO;QAAE,KAAK,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9F,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,IAAI,EAAE,CAAC"}

package/dist/core.d.ts

@@ -0,0 +1,10 @@
+import type { Report } from "./types.js";
+export declare const VERSION = "0.1.0";
+export declare const CLEAN_VERDICT = "READY";
+export declare const FIX_VERDICT = "FIX-FIRST";
+export declare const MAX_FILES = 5000;
+export declare const MAX_SCAN_BYTES: number;
+export declare const MAX_FILE_BYTES: number;
+export declare const MAX_TOTAL_BYTES: number;
+export declare function runCheck(target: string): Report;
+export declare function renderReport(report: Report): string;

package/dist/core.js

@@ -0,0 +1,580 @@
+/**
+ * npmpreflight core: audit a package directory before npm publish.
+ *
+ * The shipped file set is resolved statically: the files field when one
+ * is present (literal files, directories walked recursively, and a
+ * simple glob subset), otherwise everything in the directory except
+ * node_modules, .git, and paths matched by a simple .npmignore subset.
+ * package.json, README, and LICENSE are always included when present,
+ * matching npm behaviour. This is a static approximation of npm pack,
+ * not a byte-exact reproduction of it.
+ *
+ * Secret scanning never records the matched text. A finding carries the
+ * rule id, the file, the line, and the pattern id as its only evidence.
+ */
+import { existsSync, openSync, readSync, closeSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+export const VERSION = "0.1.0";
+export const CLEAN_VERDICT = "READY";
+export const FIX_VERDICT = "FIX-FIRST";
+export const MAX_FILES = 5000;
+export const MAX_SCAN_BYTES = 512 * 1024;
+export const MAX_FILE_BYTES = 1024 * 1024;
+export const MAX_TOTAL_BYTES = 10 * 1024 * 1024;
+const SEVERITY_ORDER = { high: 0, medium: 1, low: 2, info: 3 };
+const REQUIRED_FIELDS = ["name", "version", "license", "description"];
+const ALWAYS_INCLUDED_RE = /^(?:package\.json|readme(?:\.[^/]*)?|licen[cs]e(?:\.[^/]*)?)$/i;
+/* ------------------------------------------------------------------ */
+/* Small helpers                                                       */
+/* ------------------------------------------------------------------ */
+function stripDotSlash(p) {
+    let out = p.trim();
+    while (out.startsWith("./"))
+        out = out.slice(2);
+    return out.replace(/^\/+/, "");
+}
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isPresent(v) {
+    if (v === undefined || v === null)
+        return false;
+    if (typeof v === "string")
+        return v.trim().length > 0;
+    if (isRecord(v))
+        return Object.keys(v).length > 0;
+    return true;
+}
+/**
+ * Parse the supported .npmignore subset: blank lines and # comments are
+ * skipped, plain lines match a file name at any depth or an exact
+ * relative path, and lines ending in / match a directory. Globs,
+ * negations, and character classes are not supported.
+ */
+function parseNpmignore(root) {
+    const path = join(root, ".npmignore");
+    if (!existsSync(path))
+        return [];
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch {
+        return [];
+    }
+    const rules = [];
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const cleaned = line.replace(/^\/+/, "");
+        const isDir = cleaned.endsWith("/");
+        const pattern = isDir ? cleaned.replace(/\/+$/, "") : cleaned;
+        if (!pattern)
+            continue;
+        rules.push({ pattern, isDir, hasSlash: pattern.includes("/") });
+    }
+    return rules;
+}
+function matchesIgnore(rel, rules) {
+    const segments = rel.split("/");
+    for (const rule of rules) {
+        if (rule.isDir) {
+            if (rule.hasSlash) {
+                if (rel === rule.pattern || rel.startsWith(`${rule.pattern}/`))
+                    return true;
+            }
+            else if (segments.includes(rule.pattern)) {
+                return true;
+            }
+            continue;
+        }
+        if (rule.hasSlash) {
+            if (rel === rule.pattern || rel.startsWith(`${rule.pattern}/`))
+                return true;
+        }
+        else if (basename(rel) === rule.pattern) {
+            return true;
+        }
+    }
+    return false;
+}
+/* ------------------------------------------------------------------ */
+/* Simple glob subset for files entries                                */
+/* ------------------------------------------------------------------ */
+function globToRegExp(glob) {
+    let out = "^";
+    let i = 0;
+    while (i < glob.length) {
+        const ch = glob[i];
+        if (ch === "*") {
+            if (glob[i + 1] === "*") {
+                if (glob[i + 2] === "/") {
+                    out += "(?:.*/)?";
+                    i += 3;
+                }
+                else {
+                    out += ".*";
+                    i += 2;
+                }
+            }
+            else {
+                out += "[^/]*";
+                i += 1;
+            }
+        }
+        else if (ch === "?") {
+            out += "[^/]";
+            i += 1;
+        }
+        else {
+            out += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+            i += 1;
+        }
+    }
+    out += "$";
+    return new RegExp(out);
+}
+class Collector {
+    byRel = new Map();
+    seen = new Set();
+    truncated = false;
+    get filesSeen() {
+        return this.seen.size;
+    }
+    get files() {
+        return [...this.byRel.values()].sort((a, b) => (a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0));
+    }
+    has(rel) {
+        return this.byRel.has(rel);
+    }
+    remove(rel) {
+        this.byRel.delete(rel);
+    }
+    removeUnder(dirRel) {
+        for (const rel of [...this.byRel.keys()]) {
+            if (rel === dirRel || rel.startsWith(`${dirRel}/`))
+                this.byRel.delete(rel);
+        }
+    }
+    /** Count a distinct candidate file, then ship it unless the cap hit. */
+    consider(rel, abs) {
+        if (this.seen.has(rel))
+            return;
+        this.seen.add(rel);
+        if (this.byRel.size >= MAX_FILES) {
+            this.truncated = true;
+            return;
+        }
+        let size = 0;
+        try {
+            size = statSync(abs).size;
+        }
+        catch {
+            return;
+        }
+        this.byRel.set(rel, { rel, abs, size });
+    }
+    /** Walk a directory recursively in sorted order. */
+    walk(dirAbs, dirRel, opts = {}) {
+        let entries;
+        try {
+            entries = readdirSync(dirAbs, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+        for (const entry of entries) {
+            if (entry.name === "node_modules" || entry.name === ".git")
+                continue;
+            const abs = join(dirAbs, entry.name);
+            const rel = dirRel ? `${dirRel}/${entry.name}` : entry.name;
+            if (entry.isDirectory()) {
+                this.walk(abs, rel, opts);
+            }
+            else if (entry.isFile()) {
+                const always = dirRel === "" && ALWAYS_INCLUDED_RE.test(entry.name);
+                if (!always && opts.ignore && matchesIgnore(rel, opts.ignore))
+                    continue;
+                this.consider(rel, abs);
+            }
+            // Symlinks and special files are not followed or shipped.
+        }
+    }
+}
+function collectShipped(root, pkg) {
+    const collector = new Collector();
+    const filesField = Array.isArray(pkg["files"]) ? pkg["files"] : undefined;
+    if (filesField) {
+        for (const rawEntry of filesField) {
+            if (typeof rawEntry !== "string")
+                continue;
+            let entry = stripDotSlash(rawEntry);
+            if (!entry)
+                continue;
+            const negated = entry.startsWith("!");
+            if (negated)
+                entry = stripDotSlash(entry.slice(1));
+            if (!entry)
+                continue;
+            if (entry.includes("*") || entry.includes("?")) {
+                const re = globToRegExp(entry);
+                if (negated) {
+                    for (const f of collector.files) {
+                        if (re.test(f.rel))
+                            collector.remove(f.rel);
+                    }
+                }
+                else {
+                    // Walk the whole tree once per glob entry, matching paths.
+                    const before = new Set(collector.files.map((f) => f.rel));
+                    const walker = new Collector();
+                    walker.walk(root, "");
+                    for (const f of walker.files) {
+                        if (re.test(f.rel))
+                            collector.consider(f.rel, f.abs);
+                    }
+                    void before;
+                }
+                continue;
+            }
+            const clean = entry.replace(/\/+$/, "");
+            const abs = join(root, clean);
+            if (negated) {
+                collector.remove(clean);
+                collector.removeUnder(clean);
+                continue;
+            }
+            let st;
+            try {
+                st = statSync(abs);
+            }
+            catch {
+                continue;
+            }
+            if (st.isDirectory()) {
+                collector.walk(abs, clean);
+            }
+            else if (st.isFile()) {
+                collector.consider(clean, abs);
+            }
+        }
+    }
+    else {
+        const ignore = parseNpmignore(root);
+        collector.walk(root, "", { ignore });
+    }
+    // Always included, even when the files field or .npmignore omits them.
+    let rootEntries = [];
+    try {
+        rootEntries = readdirSync(root).sort();
+    }
+    catch {
+        rootEntries = [];
+    }
+    for (const name of rootEntries) {
+        if (!ALWAYS_INCLUDED_RE.test(name))
+            continue;
+        const abs = join(root, name);
+        try {
+            if (statSync(abs).isFile())
+                collector.consider(name, abs);
+        }
+        catch {
+            continue;
+        }
+    }
+    return { files: collector.files, filesSeen: collector.filesSeen, truncated: collector.truncated };
+}
+const SECRET_PATTERNS = [
+    { id: "private-key-block", make: () => /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g },
+    { id: "aws-access-key-id", make: () => /\bAKIA[0-9A-Z]{16}\b/g },
+    { id: "github-pat-classic", make: () => /\bghp_[A-Za-z0-9]{36,}\b/g },
+    { id: "github-pat-fine-grained", make: () => /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g },
+    { id: "api-key-sk", make: () => /\bsk-(?:proj-|ant-)?[A-Za-z0-9_-]{20,}\b/g },
+];
+const GENERIC_ASSIGNMENT = {
+    id: "generic-api-key-assignment",
+    make: () => /(?:\bapi[_-]?key\b|\bapikey\b|\bsecret[_-]?key\b|\baccess[_-]?token\b|\bauth[_-]?token\b)\s*[:=]\s*["'][^"'\r\n\s]{16,}["']/gi,
+};
+/** Read at most MAX_SCAN_BYTES from the head of a file. */
+function readHead(abs, size) {
+    const cap = Math.min(size, MAX_SCAN_BYTES);
+    if (cap <= 0)
+        return Buffer.alloc(0);
+    const buf = Buffer.alloc(cap);
+    let fd;
+    try {
+        fd = openSync(abs, "r");
+    }
+    catch {
+        return Buffer.alloc(0);
+    }
+    try {
+        readSync(fd, buf, 0, cap, 0);
+    }
+    catch {
+        return Buffer.alloc(0);
+    }
+    finally {
+        closeSync(fd);
+    }
+    return buf;
+}
+function lineOf(text, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < text.length; i++) {
+        if (text[i] === "\n")
+            line += 1;
+    }
+    return line;
+}
+function scanFile(file, findings) {
+    const head = readHead(file.abs, file.size);
+    if (head.length === 0)
+        return;
+    if (head.includes(0))
+        return; // Binary file: not scanned as text.
+    const text = head.toString("utf8");
+    const seen = new Set();
+    const specificLines = new Set();
+    for (const pattern of SECRET_PATTERNS) {
+        const re = pattern.make();
+        for (const match of text.matchAll(re)) {
+            const line = lineOf(text, match.index ?? 0);
+            specificLines.add(line);
+            const key = `${pattern.id}:${line}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            findings.push({
+                rule: "SECRET-LEAK",
+                severity: "high",
+                file: file.rel,
+                line,
+                message: `Shipped file matches the secret pattern ${pattern.id}. Remove the credential from the package and rotate it if it was ever real.`,
+                evidence: pattern.id,
+            });
+        }
+    }
+    // A generic assignment on a line already flagged by a specific
+    // pattern would only duplicate the same leak, so it is skipped there.
+    const genericRe = GENERIC_ASSIGNMENT.make();
+    for (const match of text.matchAll(genericRe)) {
+        const line = lineOf(text, match.index ?? 0);
+        if (specificLines.has(line))
+            continue;
+        const key = `${GENERIC_ASSIGNMENT.id}:${line}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        findings.push({
+            rule: "SECRET-LEAK",
+            severity: "high",
+            file: file.rel,
+            line,
+            message: `Shipped file matches the secret pattern ${GENERIC_ASSIGNMENT.id}. Remove the credential from the package and rotate it if it was ever real.`,
+            evidence: GENERIC_ASSIGNMENT.id,
+        });
+    }
+}
+/* ------------------------------------------------------------------ */
+/* Main check                                                          */
+/* ------------------------------------------------------------------ */
+export function runCheck(target) {
+    const root = resolve(target);
+    const pkgPath = join(root, "package.json");
+    let pkgText;
+    try {
+        pkgText = readFileSync(pkgPath, "utf8");
+    }
+    catch {
+        // A target that is itself a package.json file is accepted too.
+        try {
+            if (basename(root) === "package.json") {
+                return runCheck(dirname(root));
+            }
+        }
+        catch {
+            // Fall through to the clear error below.
+        }
+        throw new Error(`package.json not found at ${pkgPath}: ${target} is not a package directory with a readable package.json`);
+    }
+    let pkg;
+    try {
+        const parsed = JSON.parse(pkgText);
+        if (!isRecord(parsed))
+            throw new Error("top level is not an object");
+        pkg = parsed;
+    }
+    catch (err) {
+        throw new Error(`package.json at ${pkgPath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const { files, filesSeen, truncated } = collectShipped(root, pkg);
+    const shippedRels = new Set(files.map((f) => f.rel));
+    const totalBytes = files.reduce((sum, f) => sum + f.size, 0);
+    const findings = [];
+    // Required fields.
+    for (const field of REQUIRED_FIELDS) {
+        if (!isPresent(pkg[field])) {
+            findings.push({
+                rule: "MISSING-FIELD",
+                severity: "high",
+                file: "package.json",
+                message: `package.json is missing the ${field} field. npm publish needs it, and registries and tooling read it as the package identity.`,
+                evidence: field,
+            });
+        }
+    }
+    // Bin targets must be in the shipped set.
+    const binPaths = [];
+    const bin = pkg["bin"];
+    if (typeof bin === "string")
+        binPaths.push(bin);
+    else if (isRecord(bin)) {
+        for (const v of Object.values(bin))
+            if (typeof v === "string")
+                binPaths.push(v);
+    }
+    for (const binPath of [...binPaths].sort()) {
+        const rel = stripDotSlash(binPath);
+        if (!shippedRels.has(rel)) {
+            findings.push({
+                rule: "BIN-MISSING",
+                severity: "high",
+                file: "package.json",
+                message: `bin target ${rel} is not in the shipped file set. The published package would install a command that does not exist.`,
+                evidence: rel,
+            });
+        }
+    }
+    // The main entry point must be in the shipped set.
+    if (typeof pkg["main"] === "string" && pkg["main"].trim()) {
+        const rel = stripDotSlash(pkg["main"]);
+        if (!shippedRels.has(rel)) {
+            findings.push({
+                rule: "MAIN-MISSING",
+                severity: "high",
+                file: "package.json",
+                message: `main entry ${rel} is not in the shipped file set. Consumers would fail to load the published package.`,
+                evidence: rel,
+            });
+        }
+    }
+    // Secret scan over the shipped set.
+    for (const file of files)
+        scanFile(file, findings);
+    // Size checks.
+    for (const file of files) {
+        if (file.size > MAX_FILE_BYTES) {
+            findings.push({
+                rule: "OVERSIZE",
+                severity: "medium",
+                file: file.rel,
+                message: `Shipped file is ${file.size} bytes, over the ${MAX_FILE_BYTES} byte per-file limit. Large payloads usually belong in a release asset, not the npm tarball.`,
+                evidence: `${file.size} bytes`,
+            });
+        }
+    }
+    if (totalBytes > MAX_TOTAL_BYTES) {
+        findings.push({
+            rule: "OVERSIZE",
+            severity: "medium",
+            message: `Total shipped size is ${totalBytes} bytes, over the ${MAX_TOTAL_BYTES} byte limit. Trim the files field or split the payload out of the package.`,
+            evidence: `${totalBytes} bytes`,
+        });
+    }
+    // Scoped packages need an explicit public publishConfig.
+    const name = typeof pkg["name"] === "string" ? pkg["name"] : "";
+    if (name.startsWith("@")) {
+        const pc = isRecord(pkg["publishConfig"]) ? pkg["publishConfig"] : undefined;
+        if (pc?.["access"] !== "public") {
+            findings.push({
+                rule: "SCOPED-NO-PUBLISHCONFIG",
+                severity: "medium",
+                file: "package.json",
+                message: `Scoped package ${name} does not set publishConfig.access to public. A first publish would default to restricted access and fail or stay private.`,
+                evidence: name,
+            });
+        }
+    }
+    // README presence.
+    const hasReadme = files.some((f) => /^readme(?:\.[^/]*)?$/i.test(basename(f.rel)));
+    if (!hasReadme) {
+        findings.push({
+            rule: "NO-README",
+            severity: "low",
+            message: "No README file is in the shipped set. The registry page and the installed package would have no usage documentation.",
+        });
+    }
+    // Engines declaration.
+    if (!isPresent(pkg["engines"])) {
+        findings.push({
+            rule: "NO-ENGINES",
+            severity: "info",
+            file: "package.json",
+            message: "package.json declares no engines range. Consumers and CI cannot tell which Node versions the package supports.",
+        });
+    }
+    findings.sort((a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity] ||
+        (a.file ?? "").localeCompare(b.file ?? "") ||
+        (a.line ?? 0) - (b.line ?? 0) ||
+        (a.rule < b.rule ? -1 : a.rule > b.rule ? 1 : 0) ||
+        (a.message < b.message ? -1 : a.message > b.message ? 1 : 0));
+    const bySeverity = { high: 0, medium: 0, low: 0, info: 0 };
+    for (const f of findings)
+        bySeverity[f.severity] += 1;
+    const verdict = bySeverity.high > 0 ? FIX_VERDICT : CLEAN_VERDICT;
+    const counts = {
+        files: files.length,
+        bytes: totalBytes,
+        findings: findings.length,
+        high: bySeverity.high,
+        medium: bySeverity.medium,
+        low: bySeverity.low,
+        info: bySeverity.info,
+        filesSeen,
+        truncated: truncated ? 1 : 0,
+        maxFiles: MAX_FILES,
+        maxScanBytes: MAX_SCAN_BYTES,
+    };
+    const summary = `${files.length} shipped file(s), ${totalBytes} byte(s), ${findings.length} finding(s) ` +
+        `(${bySeverity.high} high, ${bySeverity.medium} medium, ${bySeverity.low} low, ${bySeverity.info} info). ` +
+        (verdict === CLEAN_VERDICT ? "No high-severity findings." : "High-severity findings must be fixed before publishing.");
+    return {
+        tool: "npmpreflight",
+        version: VERSION,
+        target,
+        verdict,
+        counts,
+        findings,
+        summary,
+    };
+}
+/* ------------------------------------------------------------------ */
+/* Rendering                                                           */
+/* ------------------------------------------------------------------ */
+export function renderReport(report) {
+    const out = [];
+    out.push(`npmpreflight check ${report.target}: ${report.verdict}`);
+    out.push(`  files: ${report.counts["files"] ?? 0}, bytes: ${report.counts["bytes"] ?? 0}, findings: ${report.counts["findings"] ?? 0} ` +
+        `(high: ${report.counts["high"] ?? 0}, medium: ${report.counts["medium"] ?? 0}, low: ${report.counts["low"] ?? 0}, info: ${report.counts["info"] ?? 0})`);
+    out.push(`  summary: ${report.summary}`);
+    if ((report.counts["truncated"] ?? 0) > 0) {
+        out.push(`  note: shipped file set cap reached: ${report.counts["filesSeen"] ?? 0} file(s) seen, only the first ${report.counts["maxFiles"] ?? MAX_FILES} (sorted by path within each directory) were shipped and scanned. The remaining files were NOT scanned.`);
+    }
+    for (const f of report.findings) {
+        const where = f.file ? (f.line ? `${f.file}:${f.line}` : f.file) : "package";
+        const evidence = f.evidence ? ` (evidence: ${f.evidence})` : "";
+        out.push(`  [${f.severity.toUpperCase()}] ${f.rule} ${where} ${f.message}${evidence}`);
+    }
+    if (report.verdict === CLEAN_VERDICT) {
+        out.push("READY: no high-severity findings in the shipped file set.");
+    }
+    else {
+        out.push("FIX-FIRST: resolve the high-severity findings before publishing.");
+    }
+    return out.join("\n");
+}
+//# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAG7D,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAC/B,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AAEvC,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC;AAC9B,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhD,MAAM,cAAc,GAA6B,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAEzF,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,CAAU,CAAC;AAE/E,MAAM,kBAAkB,GAAG,gEAAgE,CAAC;AAE5F,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC;AAYD;;;;;GAKG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,KAAmB;IACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,IAAI,GAAG,KAAK,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC9E,CAAC;iBAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,KAAK,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9E,CAAC;aAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC7B,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,GAAG,IAAI,UAAU,CAAC;oBAClB,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;qBAAM,CAAC;oBACN,GAAG,IAAI,IAAI,CAAC;oBACZ,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,OAAO,CAAC;gBACf,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;QACH,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,GAAG,IAAI,MAAM,CAAC;YACd,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC;IACD,GAAG,IAAI,GAAG,CAAC;IACX,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAkBD,MAAM,SAAS;IACL,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvC,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,SAAS,GAAG,KAAK,CAAC;IAElB,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,IAAI,KAAK;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,QAAQ,CAAC,GAAW,EAAE,GAAW;QAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,oDAAoD;IACpD,IAAI,CAAC,MAAc,EAAE,MAAc,EAAE,OAAkC,EAAE;QACvE,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YACrE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5D,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACpE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACxE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1B,CAAC;YACD,0DAA0D;QAC5D,CAAC;IACH,CAAC;CACF;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,GAA4B;IAChE,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,OAAO,CAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzF,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YAC3C,IAAI,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,OAAO;gBAAE,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC/B,IAAI,OAAO,EAAE,CAAC;oBACZ,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;wBAChC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;4BAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC9C,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,2DAA2D;oBAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC1D,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACtB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;wBAC7B,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;4BAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;oBACvD,CAAC;oBACD,KAAK,MAAM,CAAC;gBACd,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxB,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC7B,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrB,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7B,CAAC;iBAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvB,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,uEAAuE;IACvE,IAAI,WAAW,GAAa,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;gBAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;AACpG,CAAC;AAWD,MAAM,eAAe,GAAoB;IACvC,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,8DAA8D,EAAE;IACvG,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,uBAAuB,EAAE;IAChE,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,2BAA2B,EAAE;IACrE,EAAE,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,mCAAmC,EAAE;IAClF,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,2CAA2C,EAAE;CAC9E,CAAC;AAEF,MAAM,kBAAkB,GAAkB;IACxC,EAAE,EAAE,4BAA4B;IAChC,IAAI,EAAE,GAAG,EAAE,CACT,+HAA+H;CAClI,CAAC;AAEF,2DAA2D;AAC3D,SAAS,QAAQ,CAAC,GAAW,EAAE,IAAY;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC3C,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,CAAC;QACH,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa;IACzC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,IAAiB,EAAE,QAAmB;IACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,oCAAoC;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;YAC5C,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,IAAI,CAAC,GAAG;gBACd,IAAI;gBACJ,OAAO,EAAE,2CAA2C,OAAO,CAAC,EAAE,6EAA6E;gBAC3I,QAAQ,EAAE,OAAO,CAAC,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,sEAAsE;IACtE,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QAC5C,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,MAAM,GAAG,GAAG,GAAG,kBAAkB,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,IAAI,CAAC,GAAG;YACd,IAAI;YACJ,OAAO,EAAE,2CAA2C,kBAAkB,CAAC,EAAE,6EAA6E;YACtJ,QAAQ,EAAE,kBAAkB,CAAC,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAE3C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,cAAc,EAAE,CAAC;gBACtC,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,KAAK,MAAM,0DAA0D,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACrE,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,mBAAmB;IACnB,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,+BAA+B,KAAK,2FAA2F;gBACxI,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC3C,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,cAAc,GAAG,qGAAqG;gBAC/H,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,cAAc,GAAG,sFAAsF;gBAChH,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEnD,eAAe;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,IAAI,CAAC,GAAG;gBACd,OAAO,EAAE,mBAAmB,IAAI,CAAC,IAAI,oBAAoB,cAAc,8FAA8F;gBACrK,QAAQ,EAAE,GAAG,IAAI,CAAC,IAAI,QAAQ;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,yBAAyB,UAAU,oBAAoB,eAAe,4EAA4E;YAC3J,QAAQ,EAAE,GAAG,UAAU,QAAQ;SAChC,CAAC,CAAC;IACL,CAAC;IAED,yDAAyD;IACzD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB;gBAC/B,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,kBAAkB,IAAI,4HAA4H;gBAC3J,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,sHAAsH;SAChI,CAAC,CAAC;IACL,CAAC;IAED,uBAAuB;IACvB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,gHAAgH;SAC1H,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvD,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAE,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3C,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/D,CAAC;IAEF,MAAM,UAAU,GAA6B,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACrF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;IAClE,MAAM,MAAM,GAA2B;QACrC,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,cAAc;KAC7B,CAAC;IACF,MAAM,OAAO,GACX,GAAG,KAAK,CAAC,MAAM,qBAAqB,UAAU,aAAa,QAAQ,CAAC,MAAM,cAAc;QACxF,IAAI,UAAU,CAAC,IAAI,UAAU,UAAU,CAAC,MAAM,YAAY,UAAU,CAAC,GAAG,SAAS,UAAU,CAAC,IAAI,UAAU;QAC1G,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,yDAAyD,CAAC,CAAC;IAEzH,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,OAAO;QAChB,MAAM;QACN,OAAO;QACP,MAAM;QACN,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,GAAG,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,GAAG,CAAC,IAAI,CACN,YAAY,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG;QAC5H,UAAU,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAC3J,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,CACN,yCAAyC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,SAAS,yGAAyG,CACzP,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { runCheck, renderReport, CLEAN_VERDICT, VERSION } from "./core.js";
+export type { Finding, Report, Severity } from "./types.js";

package/dist/index.js

@@ -0,0 +1,2 @@
+export { runCheck, renderReport, CLEAN_VERDICT, VERSION } from "./core.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC"}

package/dist/mcp.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/mcp.js

@@ -0,0 +1,19 @@
+/**
+ * npmpreflight MCP server. Tool: preflight_package.
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { runCheck, VERSION } from "./core.js";
+const server = new McpServer({ name: "npmpreflight", version: VERSION });
+server.tool("preflight_package", "Audit a package directory before publishing: resolves the shipped file set from the files field and ignore rules, scans shipped files for secret patterns (private keys, token shapes), totals the size, and checks package.json for required fields, a bin target that exists, license, and publishConfig on scoped names. Verdict READY or FIX-FIRST with evidence.", {
+    path: z.string().describe("Target path to check"),
+}, async ({ path }) => {
+    const report = runCheck(path);
+    return { content: [{ type: "text", text: JSON.stringify(report, null, 2) }] };
+});
+async function main() {
+    await server.connect(new StdioServerTransport());
+}
+void main();
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAEzE,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,uWAAuW,EACvW;IACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;CAClD,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;IACjB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC,CACF,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,IAAI,EAAE,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,18 @@
+export type Severity = "info" | "low" | "medium" | "high";
+export interface Finding {
+    rule: string;
+    severity: Severity;
+    file?: string;
+    line?: number;
+    message: string;
+    evidence?: string;
+}
+export interface Report {
+    tool: string;
+    version: string;
+    target: string;
+    verdict: string;
+    counts: Record<string, number>;
+    findings: Finding[];
+    summary: string;
+}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,41 @@
 {
+  "bin": {
+    "npmpreflight": "dist/cli.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1",
+    "zod": "^3"
+  },
+  "description": "Pre-publish npm package auditor: what npm pack would ship, total size, secret-pattern leak scan over the shipped file set, and missing or risky package.json fields, checked before you publish instead of after.",
+  "devDependencies": {
+    "@types/node": "^20",
+    "tsx": "^4",
+    "typescript": "^5"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    "dist",
+    "server.json"
+  ],
+  "homepage": "https://github.com/CloudCorpRecords/npmpreflight#readme",
+  "license": "MIT",
+  "mcpName": "io.github.CloudCorpRecords/npmpreflight",
   "name": "@reneturcios/npmpreflight",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/CloudCorpRecords/npmpreflight.git"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx src/cli.ts",
+    "test": "tsx --test test/*.test.ts"
+  },
+  "type": "module",
+  "version": "0.1.0"
+}

package/server.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "description": "Pre-publish npm pack auditor: shipped files, size, secret-pattern leaks, missing fields.",
+  "name": "io.github.CloudCorpRecords/npmpreflight",
+  "packages": [
+    {
+      "identifier": "@reneturcios/npmpreflight",
+      "packageArguments": [
+        {
+          "type": "positional",
+          "value": "mcp"
+        }
+      ],
+      "registryBaseUrl": "https://registry.npmjs.org",
+      "registryType": "npm",
+      "runtimeHint": "npx",
+      "transport": {
+        "type": "stdio"
+      },
+      "version": "0.1.0"
+    },
+    {
+      "identifier": "ghcr.io/cloudcorprecords/npmpreflight:0.1.0",
+      "packageArguments": [
+        {
+          "type": "positional",
+          "value": "mcp"
+        }
+      ],
+      "registryType": "oci",
+      "runtimeArguments": [
+        {
+          "name": "--rm",
+          "type": "named"
+        },
+        {
+          "name": "-i",
+          "type": "named"
+        }
+      ],
+      "runtimeHint": "docker",
+      "transport": {
+        "type": "stdio"
+      }
+    }
+  ],
+  "repository": {
+    "source": "github",
+    "url": "https://github.com/CloudCorpRecords/npmpreflight"
+  },
+  "version": "0.1.0"
+}