@somewhere-tech/cli 0.14.0 → 0.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/swpx/check.js +7 -3
- package/dist/swpx/check.js.map +1 -1
- package/dist/swpx/enforce.js +52 -0
- package/dist/swpx/enforce.js.map +1 -0
- package/dist/swpx/run-common.js.map +1 -1
- package/dist/swpx/run-swpm.js +29 -21
- package/dist/swpx/run-swpm.js.map +1 -1
- package/dist/swpx/run-swpx.js +21 -10
- package/dist/swpx/run-swpx.js.map +1 -1
- package/dist/swpx/verdict-client.js +6 -3
- package/dist/swpx/verdict-client.js.map +1 -1
- package/package.json +1 -1
package/dist/swpx/check.js
CHANGED
|
@@ -9,7 +9,8 @@
|
|
|
9
9
|
import { parseSpec } from './registry.js';
|
|
10
10
|
import { renderSingle, toJsonVerdict } from './render.js';
|
|
11
11
|
import { bindDeps, msg } from './run-common.js';
|
|
12
|
-
import {
|
|
12
|
+
import { VerdictUnavailable } from './verdict-client.js';
|
|
13
|
+
import { yellow } from '../lib/output.js';
|
|
13
14
|
function exitForLevel(level) {
|
|
14
15
|
if (level === 'verified')
|
|
15
16
|
return 0;
|
|
@@ -36,8 +37,11 @@ export async function runCheck(specArg, opts = {}, deps = {}) {
|
|
|
36
37
|
try {
|
|
37
38
|
verdict = await d.getVerdict(spec.name, version);
|
|
38
39
|
}
|
|
39
|
-
catch {
|
|
40
|
-
|
|
40
|
+
catch (err) {
|
|
41
|
+
const rl = err instanceof VerdictUnavailable && err.rateLimited;
|
|
42
|
+
d.errLog(rl
|
|
43
|
+
? `${yellow('⚠')} Rate limited — couldn't check ${spec.name}. Wait a moment and retry.`
|
|
44
|
+
: `${yellow('⚠')} Could not verify ${spec.name}@${version} — the verdict service was unreachable.`);
|
|
41
45
|
return 3;
|
|
42
46
|
}
|
|
43
47
|
if (opts.json) {
|
package/dist/swpx/check.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/swpx/check.ts"],"names":[],"mappings":"AAAA;;;;;;;uEAOuE;AAEvE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAgB,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/swpx/check.ts"],"names":[],"mappings":"AAAA;;;;;;;uEAOuE;AAEvE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAgB,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,SAAS,YAAY,CAAC,KAAmB;IACvC,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC,CAAC,0BAA0B;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAA2B,EAC3B,OAA2B,EAAE,EAC7B,OAAgB,EAAE;IAElB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,CAAC,CAAC,MAAM,CAAC,qDAAqD,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEhC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,CAAC,CAAC,MAAM,CAAC,qBAAqB,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,GAAG,YAAY,kBAAkB,IAAI,GAAG,CAAC,WAAW,CAAC;QAChE,CAAC,CAAC,MAAM,CACN,EAAE;YACA,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,IAAI,CAAC,IAAI,4BAA4B;YACvF,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,IAAI,CAAC,IAAI,IAAI,OAAO,yCAAyC,CACrG,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC"}
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
/** Fail-open policy for swpx / swpm.
|
|
2
|
+
*
|
|
3
|
+
* Default is fail-OPEN (the verdict service being down must never break a
|
|
4
|
+
* build) — but never SILENTLY: when we can't verify, we print a loud warning so
|
|
5
|
+
* the developer always knows the check didn't run (a blocked check can be an
|
|
6
|
+
* attacker hiding malware, not just an outage). `enforce` flips it to
|
|
7
|
+
* fail-CLOSED for CI / security-conscious users. Precedence:
|
|
8
|
+
* --enforce / --no-enforce > SWPX_ENFORCE env > config.enforce > false */
|
|
9
|
+
import { loadConfig } from '../lib/config.js';
|
|
10
|
+
import { red, yellow, dim } from '../lib/output.js';
|
|
11
|
+
const OWN_FLAGS = new Set(['--enforce', '--no-enforce']);
|
|
12
|
+
/** Strip our own flags so they're never forwarded to npx/npm. */
|
|
13
|
+
export function stripEnforceFlags(args) {
|
|
14
|
+
return args.filter((a) => !OWN_FLAGS.has(a));
|
|
15
|
+
}
|
|
16
|
+
export function resolveEnforce(args) {
|
|
17
|
+
if (args.includes('--no-enforce'))
|
|
18
|
+
return false;
|
|
19
|
+
if (args.includes('--enforce'))
|
|
20
|
+
return true;
|
|
21
|
+
const env = process.env.SWPX_ENFORCE;
|
|
22
|
+
if (env === '1' || env === 'true')
|
|
23
|
+
return true;
|
|
24
|
+
if (env === '0' || env === 'false')
|
|
25
|
+
return false;
|
|
26
|
+
try {
|
|
27
|
+
return loadConfig()?.enforce === true;
|
|
28
|
+
}
|
|
29
|
+
catch {
|
|
30
|
+
return false;
|
|
31
|
+
}
|
|
32
|
+
}
|
|
33
|
+
/** The LOUD "couldn't verify" block — printed to stderr, never silent. */
|
|
34
|
+
export function loudUnavailable(emit, pkg, rateLimited) {
|
|
35
|
+
emit('');
|
|
36
|
+
if (rateLimited) {
|
|
37
|
+
emit(`${yellow('⚠')} Rate limited checking ${pkg} — the verdict service is throttling.`);
|
|
38
|
+
emit(` ${dim('Wait a moment and retry.')}`);
|
|
39
|
+
}
|
|
40
|
+
else {
|
|
41
|
+
emit(`${red('⚠')} COULD NOT VERIFY ${pkg} — the verdict service was unreachable.`);
|
|
42
|
+
emit(` ${dim('Running UNCHECKED (like plain npx/npm). Usually an outage — but a blocked')}`);
|
|
43
|
+
emit(` ${dim("check can also be malware hiding. If you didn't expect this, stop and retry.")}`);
|
|
44
|
+
}
|
|
45
|
+
emit('');
|
|
46
|
+
}
|
|
47
|
+
/** Message when refusing to proceed under enforce (fail-closed). */
|
|
48
|
+
export function refused(emit, pkg, tool) {
|
|
49
|
+
emit(`${red('✖')} Refusing: could not verify ${pkg} and enforce is on.`);
|
|
50
|
+
emit(` ${dim(`Run real \`${tool}\` yourself to override, or set --no-enforce.`)}`);
|
|
51
|
+
}
|
|
52
|
+
//# sourceMappingURL=enforce.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"enforce.js","sourceRoot":"","sources":["../../src/swpx/enforce.ts"],"names":[],"mappings":"AAAA;;;;;;;mFAOmF;AAEnF,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AAEzD,iEAAiE;AACjE,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC9C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAc;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACrC,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,UAAU,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,eAAe,CAAC,IAAyB,EAAE,GAAW,EAAE,WAAoB;IAC1F,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,GAAG,uCAAuC,CAAC,CAAC;QACzF,IAAI,CAAC,KAAK,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,sBAAsB,GAAG,yCAAyC,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,GAAG,CAAC,2EAA2E,CAAC,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,MAAM,GAAG,CAAC,8EAA8E,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,CAAC;AACX,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,OAAO,CAAC,IAAyB,EAAE,GAAW,EAAE,IAAmB;IACjF,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,+BAA+B,GAAG,qBAAqB,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,GAAG,CAAC,cAAc,IAAI,+CAA+C,CAAC,EAAE,CAAC,CAAC;AACtF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"run-common.js","sourceRoot":"","sources":["../../src/swpx/run-common.ts"],"names":[],"mappings":"AAAA;;;;;0DAK0D;AAE1D,OAAO,EAAE,cAAc,IAAI,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,UAAU,IAAI,cAAc,EAAE,eAAe,IAAI,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC3G,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAqB,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"run-common.js","sourceRoot":"","sources":["../../src/swpx/run-common.ts"],"names":[],"mappings":"AAAA;;;;;0DAK0D;AAE1D,OAAO,EAAE,cAAc,IAAI,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,UAAU,IAAI,cAAc,EAAE,eAAe,IAAI,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC3G,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAqB,MAAM,WAAW,CAAC;AA4BxE,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,OAAO;QACL,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3E,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,WAAW;QACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,YAAY;QACvC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC"}
|
package/dist/swpx/run-swpm.js
CHANGED
|
@@ -4,21 +4,22 @@
|
|
|
4
4
|
* (run, test, publish, …) passes straight through to npm untouched. For an
|
|
5
5
|
* install we batch-check the resolved tree and print the summary, then:
|
|
6
6
|
* - any BLOCKED package → stop, exit 1, don't install.
|
|
7
|
-
* - otherwise → run the real npm install (unverified rows
|
|
8
|
-
*
|
|
9
|
-
*
|
|
10
|
-
*
|
|
11
|
-
* unchecked (a gate, not a wall). Summary goes to stderr; npm owns stdout. */
|
|
7
|
+
* - otherwise → run the real npm install (unverified rows warn but
|
|
8
|
+
* don't gate every install).
|
|
9
|
+
* Couldn't verify (unreachable / unresolvable tree) → LOUD warning then fall
|
|
10
|
+
* back to npm, OR refuse under enforce. Summary goes to stderr; npm owns stdout. */
|
|
12
11
|
import { parseSpec } from './registry.js';
|
|
13
12
|
import { renderTree } from './render.js';
|
|
14
|
-
import { bindDeps
|
|
13
|
+
import { bindDeps } from './run-common.js';
|
|
15
14
|
import { dim } from '../lib/output.js';
|
|
15
|
+
import { resolveEnforce, stripEnforceFlags, loudUnavailable, refused } from './enforce.js';
|
|
16
|
+
import { VerdictUnavailable } from './verdict-client.js';
|
|
16
17
|
/** npm's own install aliases (including its built-in typo aliases). */
|
|
17
18
|
const INSTALL_SUBS = new Set(['install', 'i', 'in', 'ins', 'add', 'ci', 'isntall']);
|
|
18
19
|
function alignVerdicts(toCheck, verdicts) {
|
|
19
20
|
const byKey = new Map(verdicts.map((v) => [`${v.package}@${v.version}`, v]));
|
|
20
|
-
// A row the service didn't return is "unknown"
|
|
21
|
-
//
|
|
21
|
+
// A row the service didn't return is "unknown" → surfaced as unverified, never
|
|
22
|
+
// silently counted as verified.
|
|
22
23
|
return toCheck.map((t) => byKey.get(`${t.package}@${t.version}`) ?? {
|
|
23
24
|
package: t.package,
|
|
24
25
|
version: t.version,
|
|
@@ -27,16 +28,26 @@ function alignVerdicts(toCheck, verdicts) {
|
|
|
27
28
|
}
|
|
28
29
|
export async function runSwpm(args, deps = {}) {
|
|
29
30
|
const d = bindDeps(deps);
|
|
30
|
-
const
|
|
31
|
+
const enforce = deps.enforce ?? resolveEnforce(args);
|
|
32
|
+
const clean = stripEnforceFlags(args);
|
|
33
|
+
const sub = clean[0];
|
|
31
34
|
if (!sub || !INSTALL_SUBS.has(sub)) {
|
|
32
|
-
return { exitCode: await d.runReal('npm',
|
|
35
|
+
return { exitCode: await d.runReal('npm', clean), action: 'passthrough' };
|
|
33
36
|
}
|
|
34
|
-
|
|
37
|
+
// Couldn't verify the tree → LOUD, then fall back (default) or refuse (enforce).
|
|
38
|
+
const failOpen = async (rateLimited) => {
|
|
39
|
+
loudUnavailable(d.errLog, 'this install', rateLimited);
|
|
40
|
+
if (enforce) {
|
|
41
|
+
refused(d.errLog, 'this install', 'npm');
|
|
42
|
+
return { exitCode: 1, action: 'blocked' };
|
|
43
|
+
}
|
|
44
|
+
return { exitCode: await d.runReal('npm', clean), action: 'fallback' };
|
|
45
|
+
};
|
|
46
|
+
const explicit = clean.slice(1).filter((a) => !a.startsWith('-'));
|
|
35
47
|
let toCheck = [];
|
|
36
48
|
let directCount = 0;
|
|
37
49
|
try {
|
|
38
50
|
if (explicit.length) {
|
|
39
|
-
// `swpm install foo bar@2` — check exactly what was named.
|
|
40
51
|
toCheck = await Promise.all(explicit.map(async (a) => {
|
|
41
52
|
const s = parseSpec(a);
|
|
42
53
|
return { package: s.name, version: await d.resolveVersion(s.name, s.version) };
|
|
@@ -44,7 +55,6 @@ export async function runSwpm(args, deps = {}) {
|
|
|
44
55
|
directCount = toCheck.length;
|
|
45
56
|
}
|
|
46
57
|
else {
|
|
47
|
-
// `swpm install` — check the project's resolved tree.
|
|
48
58
|
const tree = d.readTree(process.cwd());
|
|
49
59
|
if (tree.locked.length) {
|
|
50
60
|
toCheck = tree.locked;
|
|
@@ -60,21 +70,19 @@ export async function runSwpm(args, deps = {}) {
|
|
|
60
70
|
}
|
|
61
71
|
else {
|
|
62
72
|
d.errLog(dim('swpm: no dependencies found in package.json — running npm'));
|
|
63
|
-
return { exitCode: await d.runReal('npm',
|
|
73
|
+
return { exitCode: await d.runReal('npm', clean), action: 'passthrough' };
|
|
64
74
|
}
|
|
65
75
|
}
|
|
66
76
|
}
|
|
67
|
-
catch
|
|
68
|
-
|
|
69
|
-
return { exitCode: await d.runReal('npm', args), action: 'fallback' };
|
|
77
|
+
catch {
|
|
78
|
+
return failOpen(false);
|
|
70
79
|
}
|
|
71
80
|
let verdicts;
|
|
72
81
|
try {
|
|
73
82
|
verdicts = await d.getVerdictBatch(toCheck);
|
|
74
83
|
}
|
|
75
|
-
catch {
|
|
76
|
-
|
|
77
|
-
return { exitCode: await d.runReal('npm', args), action: 'fallback' };
|
|
84
|
+
catch (err) {
|
|
85
|
+
return failOpen(err instanceof VerdictUnavailable && err.rateLimited);
|
|
78
86
|
}
|
|
79
87
|
const aligned = alignVerdicts(toCheck, verdicts);
|
|
80
88
|
for (const l of renderTree(aligned, directCount))
|
|
@@ -82,6 +90,6 @@ export async function runSwpm(args, deps = {}) {
|
|
|
82
90
|
if (aligned.some((v) => v.verdict === 'blocked')) {
|
|
83
91
|
return { exitCode: 1, action: 'blocked' };
|
|
84
92
|
}
|
|
85
|
-
return { exitCode: await d.runReal('npm',
|
|
93
|
+
return { exitCode: await d.runReal('npm', clean), action: 'ran' };
|
|
86
94
|
}
|
|
87
95
|
//# sourceMappingURL=run-swpm.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"run-swpm.js","sourceRoot":"","sources":["../../src/swpx/run-swpm.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"run-swpm.js","sourceRoot":"","sources":["../../src/swpx/run-swpm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;qFASqF;AAErF,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAgB,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGzD,uEAAuE;AACvE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAYpF,SAAS,aAAa,CAAC,OAAiB,EAAE,QAAmB;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,+EAA+E;IAC/E,gCAAgC;IAChC,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI;QACxC,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,YAAqB;KAC/B,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,OAAgB,EAAE;IAC9D,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC5E,CAAC;IAED,iFAAiF;IACjF,MAAM,QAAQ,GAAG,KAAK,EAAE,WAAoB,EAAwB,EAAE;QACpE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QACvD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACzE,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CACzB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;gBACvB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACjF,CAAC,CAAC,CACH,CAAC;YACF,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACvB,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;gBACtB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC5C,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3E,CAAC;iBAAM,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;gBACnC,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CACzB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;oBACpC,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,MAAM,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;iBACzD,CAAC,CAAC,CACJ,CAAC;gBACF,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC,CAAC;gBAC3E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,QAAmB,CAAC;IACxB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,GAAG,YAAY,kBAAkB,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAE9D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACpE,CAAC"}
|
package/dist/swpx/run-swpx.js
CHANGED
|
@@ -15,38 +15,49 @@
|
|
|
15
15
|
* executed program owns stdout. */
|
|
16
16
|
import { parseSpec } from './registry.js';
|
|
17
17
|
import { decide, renderVerdict } from './render.js';
|
|
18
|
-
import { bindDeps
|
|
19
|
-
import {
|
|
18
|
+
import { bindDeps } from './run-common.js';
|
|
19
|
+
import { resolveEnforce, stripEnforceFlags, loudUnavailable, refused } from './enforce.js';
|
|
20
|
+
import { VerdictUnavailable } from './verdict-client.js';
|
|
20
21
|
export async function runSwpx(args, deps = {}) {
|
|
21
22
|
const d = bindDeps(deps);
|
|
23
|
+
const enforce = deps.enforce ?? resolveEnforce(args);
|
|
24
|
+
const passthrough = stripEnforceFlags(args);
|
|
22
25
|
// The package is the first non-flag arg, so `swpx -y create-next-app` works.
|
|
23
|
-
const pkgArg =
|
|
26
|
+
const pkgArg = passthrough.find((a) => !a.startsWith('-'));
|
|
24
27
|
if (!pkgArg) {
|
|
25
28
|
d.errLog('Usage: swpx <package> [args...]');
|
|
26
29
|
return { exitCode: 1, action: 'stopped' };
|
|
27
30
|
}
|
|
28
31
|
const spec = parseSpec(pkgArg);
|
|
32
|
+
// Couldn't verify → LOUD warning (never silent), then fall back (default) OR
|
|
33
|
+
// refuse (enforce / fail-closed).
|
|
34
|
+
const failOpen = async (rateLimited) => {
|
|
35
|
+
loudUnavailable(d.errLog, spec.name, rateLimited);
|
|
36
|
+
if (enforce) {
|
|
37
|
+
refused(d.errLog, spec.name, 'npx');
|
|
38
|
+
return { exitCode: 1, action: 'blocked' };
|
|
39
|
+
}
|
|
40
|
+
return { exitCode: await d.runReal('npx', passthrough), action: 'fallback' };
|
|
41
|
+
};
|
|
29
42
|
let version;
|
|
30
43
|
try {
|
|
31
44
|
version = await d.resolveVersion(spec.name, spec.version);
|
|
32
45
|
}
|
|
33
|
-
catch
|
|
34
|
-
|
|
35
|
-
return { exitCode: await d.runReal('npx', args), action: 'fallback' };
|
|
46
|
+
catch {
|
|
47
|
+
return failOpen(false);
|
|
36
48
|
}
|
|
37
49
|
let verdict;
|
|
38
50
|
try {
|
|
39
51
|
verdict = await d.getVerdict(spec.name, version);
|
|
40
52
|
}
|
|
41
|
-
catch {
|
|
42
|
-
|
|
43
|
-
return { exitCode: await d.runReal('npx', args), action: 'fallback' };
|
|
53
|
+
catch (err) {
|
|
54
|
+
return failOpen(err instanceof VerdictUnavailable && err.rateLimited);
|
|
44
55
|
}
|
|
45
56
|
const action = decide(verdict);
|
|
46
57
|
for (const l of renderVerdict(verdict))
|
|
47
58
|
d.errLog(l);
|
|
48
59
|
if (action === 'run') {
|
|
49
|
-
return { exitCode: await d.runReal('npx',
|
|
60
|
+
return { exitCode: await d.runReal('npx', passthrough), action: 'ran' };
|
|
50
61
|
}
|
|
51
62
|
// unverified/suspicious and blocked both stop swpx; only the exit reason differs.
|
|
52
63
|
return { exitCode: 1, action: action === 'block' ? 'blocked' : 'stopped' };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"run-swpx.js","sourceRoot":"","sources":["../../src/swpx/run-swpx.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;oCAcoC;AAEpC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,QAAQ,
|
|
1
|
+
{"version":3,"file":"run-swpx.js","sourceRoot":"","sources":["../../src/swpx/run-swpx.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;oCAcoC;AAEpC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAgB,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAOzD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,OAAgB,EAAE;IAC9D,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAE5C,6EAA6E;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,CAAC,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC5C,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAE/B,6EAA6E;IAC7E,kCAAkC;IAClC,MAAM,QAAQ,GAAG,KAAK,EAAE,WAAoB,EAAwB,EAAE;QACpE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC/E,CAAC,CAAC;IAEF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,GAAG,YAAY,kBAAkB,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,kFAAkF;IAClF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC7E,CAAC"}
|
|
@@ -18,9 +18,12 @@ const defaultFetch = (url, init) => fetch(url, init);
|
|
|
18
18
|
* non-2xx, or unparseable body. The command layer treats it as "fall back to
|
|
19
19
|
* the real tool", never as "block". */
|
|
20
20
|
export class VerdictUnavailable extends Error {
|
|
21
|
-
|
|
21
|
+
/** True when the service answered 429 — a throttle, not an outage/tampering. */
|
|
22
|
+
rateLimited;
|
|
23
|
+
constructor(message, rateLimited = false) {
|
|
22
24
|
super(message);
|
|
23
25
|
this.name = 'VerdictUnavailable';
|
|
26
|
+
this.rateLimited = rateLimited;
|
|
24
27
|
}
|
|
25
28
|
}
|
|
26
29
|
/** Accept either a bare verdict object or a `{ ok, data }` envelope. */
|
|
@@ -52,7 +55,7 @@ export async function getVerdict(name, version, fetchImpl = defaultFetch) {
|
|
|
52
55
|
throw new VerdictUnavailable(err instanceof Error ? err.message : String(err));
|
|
53
56
|
}
|
|
54
57
|
if (!res.ok)
|
|
55
|
-
throw new VerdictUnavailable(`verdict API returned ${res.status}
|
|
58
|
+
throw new VerdictUnavailable(`verdict API returned ${res.status}`, res.status === 429);
|
|
56
59
|
let body;
|
|
57
60
|
try {
|
|
58
61
|
body = await res.json();
|
|
@@ -88,7 +91,7 @@ export async function getVerdictBatch(pkgs, fetchImpl = defaultFetch) {
|
|
|
88
91
|
throw new VerdictUnavailable(err instanceof Error ? err.message : String(err));
|
|
89
92
|
}
|
|
90
93
|
if (!res.ok)
|
|
91
|
-
throw new VerdictUnavailable(`verdict API returned ${res.status}
|
|
94
|
+
throw new VerdictUnavailable(`verdict API returned ${res.status}`, res.status === 429);
|
|
92
95
|
let body;
|
|
93
96
|
try {
|
|
94
97
|
body = await res.json();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verdict-client.js","sourceRoot":"","sources":["../../src/swpx/verdict-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;0DAU0D;AAK1D,MAAM,YAAY,GAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,4BAA4B,CAAC;AAEnF;6EAC6E;AAC7E,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC;AAE/E,MAAM,YAAY,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAC5C,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAsC,CAAC;AAEvE;;wCAEwC;AACxC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;
|
|
1
|
+
{"version":3,"file":"verdict-client.js","sourceRoot":"","sources":["../../src/swpx/verdict-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;0DAU0D;AAK1D,MAAM,YAAY,GAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,4BAA4B,CAAC;AAEnF;6EAC6E;AAC7E,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC;AAE/E,MAAM,YAAY,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAC5C,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAsC,CAAC;AAEvE;;wCAEwC;AACxC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,gFAAgF;IACvE,WAAW,CAAU;IAC9B,YAAY,OAAe,EAAE,WAAW,GAAG,KAAK;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAED,wEAAwE;AACxE,SAAS,MAAM,CAAC,IAAa;IAC3B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAA0E,CAAC;QACvF,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,IAAI,+BAA+B,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,6DAA6D;IACjF,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,OAAe,EACf,YAAuB,YAAY;IAEnC,MAAM,GAAG,GAAG,GAAG,YAAY,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IACrG,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IACpG,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAwB,CAAC;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAa,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9E,MAAM,IAAI,kBAAkB,CAAC,0CAA0C,CAAC,CAAC;IAC3E,CAAC;IACD,6EAA6E;IAC7E,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED;;;iDAGiD;AACjD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAiD,EACjD,YAAuB,YAAY;IAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,GAAG,YAAY,oBAAoB,CAAC;IAChD,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACzB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACxC,MAAM,EAAE,aAAa,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IACpG,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,CAAC,CAAC,IAAI;QACN,CAAC,CAAE,IAA8B,EAAE,OAAO,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC,gDAAgD,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAa,CAAC,OAAO,KAAK,QAAQ,CAChG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC"}
|