@somewhere-tech/cli 0.31.21 → 0.31.22

package/dist/swpx/run-swpm.js

@@ -1,163 +0,0 @@
-/** `swpm <args...>` — the verdict gate in front of `npm`.
- *
- *  Only install-family subcommands are gated (install/i/add/ci); everything else
- *  (run, test, publish, …) passes straight through to npm untouched. For an
- *  install we batch-check the resolved tree and print the summary, then:
- *    - any BLOCKED package  → stop, exit 1, don't install.
- *    - otherwise            → run the real npm install (unverified rows warn but
- *                             don't gate every install).
- *  Couldn't verify (unreachable / unresolvable tree) → LOUD warning then fall
- *  back to npm, OR refuse under enforce. Summary goes to stderr; npm owns stdout. */
-import { parseSpec } from './registry.js';
-import { renderTree } from './render.js';
-import { bindDeps } from './run-common.js';
-import { dim, yellow } from '../lib/output.js';
-import { resolveEnforce, stripEnforceFlags, loudUnavailable, refused } from './enforce.js';
-import { VerdictUnavailable } from './verdict-client.js';
-/** npm's own install aliases (including its built-in typo aliases). */
-const INSTALL_SUBS = new Set(['install', 'i', 'in', 'ins', 'add', 'ci', 'isntall']);
-function alignVerdicts(toCheck, verdicts) {
-    const byKey = new Map(verdicts.map((v) => [`${v.package}@${v.version}`, v]));
-    // A row the service didn't return is "unknown" → surfaced as unverified, never
-    // silently counted as verified.
-    return toCheck.map((t) => byKey.get(`${t.package}@${t.version}`) ?? {
-        package: t.package,
-        version: t.version,
-        verdict: 'unverified',
-    });
-}
-export async function runSwpm(args, deps = {}) {
-    const d = bindDeps(deps);
-    const enforce = deps.enforce ?? resolveEnforce(args);
-    const clean = stripEnforceFlags(args);
-    // npm accepts config flags (and a `--` terminator) BEFORE the subcommand, so the
-    // command is the first non-flag token, not necessarily clean[0]. Keying off
-    // clean[0] let `swpm -g install evil` / `swpm -- install evil` skip the gate
-    // silently. (Residual: a value-flag whose value precedes the sub, e.g.
-    // `swpm --prefix /x install`, can still hide it — needs npm's flag schema.)
-    const subIdx = clean.findIndex((a) => !a.startsWith('-'));
-    const sub = subIdx === -1 ? undefined : clean[subIdx];
-    if (!sub || !INSTALL_SUBS.has(sub)) {
-        return { exitCode: await d.runReal('npm', clean), action: 'passthrough' };
-    }
-    // Couldn't verify the tree → LOUD, then fall back (default) or refuse (enforce).
-    const failOpen = async (rateLimited, cause, timedOut = false) => {
-        if (timedOut) {
-            d.errLog(`${yellow('⚠')} verdict pending — proceeding with npm install without waiting for a result.`);
-        }
-        else {
-            loudUnavailable(d.errLog, 'this install', rateLimited, cause);
-        }
-        if (enforce) {
-            refused(d.errLog, 'this install', 'npm');
-            return { exitCode: 1, action: 'blocked' };
-        }
-        return { exitCode: await d.runReal('npm', clean), action: 'fallback' };
-    };
-    const causeOf = (err) => (err instanceof Error ? err.message : String(err));
-    const explicit = clean.slice(subIdx + 1).filter((a) => !a.startsWith('-'));
-    let toCheck = [];
-    let directCount = 0;
-    const directPackageNames = new Set();
-    try {
-        if (explicit.length) {
-            toCheck = await Promise.all(explicit.map(async (a) => {
-                const s = parseSpec(a);
-                return { package: s.name, version: await d.resolveVersion(s.name, s.version) };
-            }));
-            directCount = toCheck.length;
-            for (const pkg of toCheck)
-                directPackageNames.add(pkg.package);
-        }
-        else {
-            const tree = d.readTree(process.cwd());
-            for (const name of tree.directNames)
-                directPackageNames.add(name);
-            if (tree.locked.length) {
-                toCheck = tree.locked;
-                const directSet = new Set(tree.directNames);
-                directCount = tree.locked.filter((l) => directSet.has(l.package)).length;
-                // A dep added to package.json AFTER the lockfile was written isn't in
-                // `locked`, but `npm install` will add it — resolve + check those too, or
-                // they'd install unchecked behind a clean "N verified" summary.
-                const lockedNames = new Set(tree.locked.map((l) => l.package));
-                const missing = tree.directNames.filter((n) => !lockedNames.has(n));
-                if (missing.length) {
-                    const extra = await Promise.all(missing.map(async (name) => ({
-                        package: name,
-                        version: await d.resolveVersion(name, tree.ranges[name]),
-                    })));
-                    toCheck = [...toCheck, ...extra];
-                    directCount += extra.length;
-                }
-            }
-            else if (tree.directNames.length) {
-                toCheck = await Promise.all(tree.directNames.map(async (name) => ({
-                    package: name,
-                    version: await d.resolveVersion(name, tree.ranges[name]),
-                })));
-                directCount = toCheck.length;
-            }
-            else {
-                d.errLog(dim('swpm: no dependencies found in package.json — running npm'));
-                return { exitCode: await d.runReal('npm', clean), action: 'passthrough' };
-            }
-        }
-    }
-    catch (err) {
-        return failOpen(false, causeOf(err));
-    }
-    let verdicts;
-    try {
-        verdicts = await d.getVerdictBatch(toCheck);
-    }
-    catch (err) {
-        return failOpen(err instanceof VerdictUnavailable && err.rateLimited, causeOf(err), err instanceof VerdictUnavailable && err.timedOut);
-    }
-    const aligned = alignVerdicts(toCheck, verdicts);
-    const pendingIndexes = aligned
-        .map((verdict, index) => ({ verdict, index }))
-        .filter(({ verdict }) => directPackageNames.has(verdict.package)
-        && verdict.verdict !== 'blocked'
-        && !verdict.summary?.trim())
-        .map(({ index }) => index);
-    const resolvedSummaryKeys = new Set();
-    if (pendingIndexes.length > 0) {
-        d.errLog(dim('Generating LLM summary…'));
-        const refreshed = await Promise.all(pendingIndexes.map(async (index) => {
-            const verdict = aligned[index];
-            try {
-                return await d.pollVerdictSummary(verdict.package, verdict.version);
-            }
-            catch {
-                return null;
-            }
-        }));
-        let unresolved = 0;
-        refreshed.forEach((verdict, resultIndex) => {
-            const alignedIndex = pendingIndexes[resultIndex];
-            if (verdict?.summary?.trim()) {
-                aligned[alignedIndex] = verdict;
-                resolvedSummaryKeys.add(`${verdict.package}@${verdict.version}`);
-            }
-            else
-                unresolved++;
-        });
-        if (unresolved > 0) {
-            d.errLog(dim(unresolved === 1
-                ? 'LLM summary timed out — continuing with raw verdict metadata.'
-                : `LLM summaries timed out for ${unresolved} packages — continuing with raw verdict metadata.`));
-        }
-    }
-    for (const l of renderTree(aligned, directCount, resolvedSummaryKeys))
-        d.errLog(l);
-    // Halt on a hard block OR any level we don't recognize as installable. Known
-    // installable levels warn but proceed (unverified/suspicious); an unrecognized
-    // or future-harsher level (e.g. "quarantined") must NOT install behind a warn.
-    const INSTALLABLE = new Set(['verified', 'unverified', 'suspicious']);
-    if (aligned.some((v) => !INSTALLABLE.has(v.verdict))) {
-        return { exitCode: 1, action: 'blocked' };
-    }
-    return { exitCode: await d.runReal('npm', clean), action: 'ran' };
-}
-//# sourceMappingURL=run-swpm.js.map

package/dist/swpx/run-swpm.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"run-swpm.js","sourceRoot":"","sources":["../../src/swpx/run-swpm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;qFASqF;AAErF,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAgB,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGzD,uEAAuE;AACvE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAYpF,SAAS,aAAa,CAAC,OAAiB,EAAE,QAAmB;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,+EAA+E;IAC/E,gCAAgC;IAChC,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI;QACxC,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,YAAqB;KAC/B,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,OAAgB,EAAE;IAC9D,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAEtC,iFAAiF;IACjF,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC5E,CAAC;IAED,iFAAiF;IACjF,MAAM,QAAQ,GAAG,KAAK,EACpB,WAAoB,EACpB,KAAc,EACd,QAAQ,GAAG,KAAK,EACM,EAAE;QACxB,IAAI,QAAQ,EAAE,CAAC;YACb,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;QACzG,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACzE,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAErF,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CACzB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;gBACvB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACjF,CAAC,CAAC,CACH,CAAC;YACF,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YAC7B,KAAK,MAAM,GAAG,IAAI,OAAO;gBAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW;gBAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACvB,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;gBACtB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC5C,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;gBACzE,sEAAsE;gBACtE,0EAA0E;gBAC1E,gEAAgE;gBAChE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;wBAC3B,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE,MAAM,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;qBACzD,CAAC,CAAC,CACJ,CAAC;oBACF,OAAO,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;oBACjC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC9B,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;gBACnC,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CACzB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;oBACpC,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,MAAM,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;iBACzD,CAAC,CAAC,CACJ,CAAC;gBACF,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC,CAAC;gBAC3E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,QAAmB,CAAC;IACxB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CACb,GAAG,YAAY,kBAAkB,IAAI,GAAG,CAAC,WAAW,EACpD,OAAO,CAAC,GAAG,CAAC,EACZ,GAAG,YAAY,kBAAkB,IAAI,GAAG,CAAC,QAAQ,CAClD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,OAAO;SAC3B,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;SAC7C,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACtB,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;WACpC,OAAO,CAAC,OAAO,KAAK,SAAS;WAC7B,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;SAC7B,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE;YACzC,MAAM,YAAY,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7B,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;gBAChC,mBAAmB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACnE,CAAC;;gBAAM,UAAU,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,CAAC,CAAC,MAAM,CAAC,GAAG,CACV,UAAU,KAAK,CAAC;gBACd,CAAC,CAAC,+DAA+D;gBACjE,CAAC,CAAC,+BAA+B,UAAU,mDAAmD,CACjG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,mBAAmB,CAAC;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEnF,6EAA6E;IAC7E,+EAA+E;IAC/E,+EAA+E;IAC/E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACpE,CAAC"}

package/dist/swpx/run-swpx.js

@@ -1,102 +0,0 @@
-/** `swpx <package> [args...]` — the verdict gate in front of `npx`.
- *
- *  resolve → verdict → act:
- *    verified           → print the green one-liner, delegate to real npx.
- *    unverified/suspicious → print the evidence block, STOP (exit 1). The user's
- *                           documented override is to run `npx` directly, per
- *                           the landing page ("your choice, not ours") — so we
- *                           deliberately do not prompt or take a --yes flag
- *                           (which would also collide with npx -y).
- *    blocked            → print the red block, hard refuse (exit 1, no run).
- *    can't resolve / verdict unreachable → fall back to npx unchecked. We are a
- *                           gate, not a wall: our outage must not stop the user.
- *
- *  All verdict messaging goes to STDERR so swpx is transparent on stdout — the
- *  executed program owns stdout. */
-import { parseSpec } from './registry.js';
-import { decide, renderVerdict } from './render.js';
-import { bindDeps } from './run-common.js';
-import { resolveEnforce, stripEnforceFlags, loudUnavailable, refused } from './enforce.js';
-import { VerdictUnavailable } from './verdict-client.js';
-import { dim } from '../lib/output.js';
-/** The value of npx's -p/--package flag, in either `--package X` / `-p X` or
- *  `--package=X` form — the package npx actually installs. Returns the first such
- *  value (multiple -p flags are rare; noted as a residual). null if absent. */
-function packageFlagValue(args) {
-    for (let i = 0; i < args.length; i++) {
-        const a = args[i];
-        if (a === '--package' || a === '-p')
-            return args[i + 1] ?? null;
-        if (a.startsWith('--package='))
-            return a.slice('--package='.length);
-        if (a.startsWith('-p='))
-            return a.slice('-p='.length);
-    }
-    return null;
-}
-export async function runSwpx(args, deps = {}) {
-    const d = bindDeps(deps);
-    const enforce = deps.enforce ?? resolveEnforce(args);
-    const passthrough = stripEnforceFlags(args);
-    // npx's -p/--package names the package that actually gets installed and run; the
-    // positional is just the binary to invoke from it (`npx -p typescript tsc`). So
-    // grade the --package value when present — otherwise `swpx --package=evil helper`
-    // would grade `helper`, print a green "verified", and let npx fetch+run `evil`.
-    // Falls back to the first non-flag arg (so `swpx -y create-next-app` still works).
-    const pkgArg = packageFlagValue(passthrough) ?? passthrough.find((a) => !a.startsWith('-'));
-    if (!pkgArg) {
-        d.errLog('Usage: swpx <package> [args...]');
-        return { exitCode: 1, action: 'stopped' };
-    }
-    const spec = parseSpec(pkgArg);
-    // Couldn't verify → LOUD warning (never silent), then fall back (default) OR
-    // refuse (enforce / fail-closed).
-    const failOpen = async (rateLimited, cause) => {
-        loudUnavailable(d.errLog, spec.name, rateLimited, cause);
-        if (enforce) {
-            refused(d.errLog, spec.name, 'npx');
-            return { exitCode: 1, action: 'blocked' };
-        }
-        return { exitCode: await d.runReal('npx', passthrough), action: 'fallback' };
-    };
-    const causeOf = (err) => (err instanceof Error ? err.message : String(err));
-    let version;
-    try {
-        version = await d.resolveVersion(spec.name, spec.version);
-    }
-    catch (err) {
-        return failOpen(false, causeOf(err));
-    }
-    let verdict;
-    try {
-        verdict = await d.getVerdict(spec.name, version);
-    }
-    catch (err) {
-        return failOpen(err instanceof VerdictUnavailable && err.rateLimited, causeOf(err));
-    }
-    if (verdict.verdict !== 'blocked' && !verdict.summary?.trim()) {
-        d.errLog(dim('Generating LLM summary…'));
-        let enriched = null;
-        try {
-            enriched = await d.pollVerdictSummary(spec.name, version);
-        }
-        catch {
-            // Summary generation is presentation-only. Keep the mechanical verdict.
-        }
-        if (enriched?.summary?.trim()) {
-            verdict = enriched;
-        }
-        else {
-            d.errLog(dim('LLM summary timed out — continuing with raw verdict metadata.'));
-        }
-    }
-    const action = decide(verdict);
-    for (const l of renderVerdict(verdict))
-        d.errLog(l);
-    if (action === 'run') {
-        return { exitCode: await d.runReal('npx', passthrough), action: 'ran' };
-    }
-    // unverified/suspicious and blocked both stop swpx; only the exit reason differs.
-    return { exitCode: 1, action: action === 'block' ? 'blocked' : 'stopped' };
-}
-//# sourceMappingURL=run-swpx.js.map

package/dist/swpx/run-swpx.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"run-swpx.js","sourceRoot":"","sources":["../../src/swpx/run-swpx.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;oCAcoC;AAEpC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAgB,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAQvC;;+EAE+E;AAC/E,SAAS,gBAAgB,CAAC,IAAc;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;QAChE,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,OAAgB,EAAE;IAC9D,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAE5C,iFAAiF;IACjF,gFAAgF;IAChF,kFAAkF;IAClF,gFAAgF;IAChF,mFAAmF;IACnF,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,CAAC,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC5C,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAE/B,6EAA6E;IAC7E,kCAAkC;IAClC,MAAM,QAAQ,GAAG,KAAK,EAAE,WAAoB,EAAE,KAAc,EAAwB,EAAE;QACpF,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC/E,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAErF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,GAAG,YAAY,kBAAkB,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9D,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACzC,IAAI,QAAQ,GAAmB,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QACD,IAAI,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YAC9B,OAAO,GAAG,QAAQ,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,kFAAkF;IAClF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC7E,CAAC"}

package/dist/swpx/spawn.js

@@ -1,30 +0,0 @@
-/** Shell out to the REAL npx / npm. swpx/swpm are wrappers, never replacements:
- *  once a verdict says "go", the genuine tool runs with the user's exact args,
- *  inheriting stdio so its output is untouched (we keep our own messaging on
- *  stderr). The child's exit code becomes ours. A launch failure (tool not on
- *  PATH) resolves to 127 rather than throwing — the caller already printed the
- *  verdict; a missing npm is the user's environment, not a swpx error. */
-import { spawn } from 'node:child_process';
-import { dim } from '../lib/output.js';
-export function runReal(cmd, args) {
-    // SWPX_DRY_RUN: show the decision + what WOULD run, without executing. Useful
-    // for "what would swpx do?" and for testing the gate end-to-end offline.
-    if (process.env.SWPX_DRY_RUN) {
-        console.error(dim(`swpx: [dry-run] would run: ${cmd} ${args.join(' ')}`));
-        return Promise.resolve(0);
-    }
-    return new Promise((resolve) => {
-        const child = spawn(cmd, args, {
-            stdio: 'inherit',
-            // On Windows npx/npm are .cmd shims that need a shell; on POSIX we spawn
-            // the binary directly (no shell → no quoting/injection surface).
-            shell: process.platform === 'win32',
-        });
-        child.on('error', (err) => {
-            console.error(dim(`swpx: failed to launch ${cmd} — ${err.message}`));
-            resolve(127);
-        });
-        child.on('exit', (code, signal) => resolve(signal ? 1 : code ?? 0));
-    });
-}
-//# sourceMappingURL=spawn.js.map

package/dist/swpx/spawn.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../src/swpx/spawn.ts"],"names":[],"mappings":"AAAA;;;;;0EAK0E;AAE1E,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,MAAM,UAAU,OAAO,CAAC,GAAkB,EAAE,IAAc;IACxD,8EAA8E;IAC9E,yEAAyE;IACzE,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,8BAA8B,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,KAAK,EAAE,SAAS;YAChB,yEAAyE;YACzE,iEAAiE;YACjE,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACpC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/swpx/tree.js

@@ -1,101 +0,0 @@
-/** Resolve a project's dependency tree for `swpm install`.
- *
- *  When a lockfile is present it IS the resolved tree — the exact versions npm
- *  would install — so we read it directly (no registry round-trips, no guessing
- *  ranges). Without a lockfile we fall back to the direct deps in package.json
- *  and let the caller resolve their ranges. Parsing is split from fs reads so
- *  the lockfile/manifest parsers are unit-tested against fixture strings. */
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-export function parsePackageJsonDeps(pkgJson) {
-    let obj;
-    try {
-        obj = JSON.parse(pkgJson);
-    }
-    catch {
-        return { directNames: [], ranges: {} };
-    }
-    const ranges = {};
-    const o = obj;
-    for (const field of ['dependencies', 'devDependencies', 'optionalDependencies']) {
-        const d = o?.[field];
-        if (d && typeof d === 'object') {
-            for (const [k, v] of Object.entries(d)) {
-                if (typeof v === 'string')
-                    ranges[k] = v;
-            }
-        }
-    }
-    return { directNames: Object.keys(ranges), ranges };
-}
-/** Extract every concrete package@version from a package-lock.json /
- *  npm-shrinkwrap.json string. Handles lockfile v2/v3 (`packages` keyed by
- *  node_modules paths) and the older v1 (`dependencies` tree). Deduped. */
-export function parseLockfile(lock) {
-    let obj;
-    try {
-        obj = JSON.parse(lock);
-    }
-    catch {
-        return [];
-    }
-    const out = [];
-    const seen = new Set();
-    const add = (name, version) => {
-        if (!name || typeof version !== 'string')
-            return;
-        const id = `${name}@${version}`;
-        if (seen.has(id))
-            return;
-        seen.add(id);
-        out.push({ package: name, version });
-    };
-    const packages = obj.packages;
-    if (packages && typeof packages === 'object') {
-        for (const [key, val] of Object.entries(packages)) {
-            if (!key)
-                continue; // "" is the root project
-            const idx = key.lastIndexOf('node_modules/');
-            if (idx === -1)
-                continue;
-            if (val?.link)
-                continue; // workspace symlink, not a real install
-            add(key.slice(idx + 'node_modules/'.length), val?.version);
-        }
-        return out;
-    }
-    // lockfile v1: recursive `dependencies` tree.
-    const walk = (deps) => {
-        if (!deps || typeof deps !== 'object')
-            return;
-        for (const [name, info] of Object.entries(deps)) {
-            add(name, info?.version);
-            walk(info?.dependencies);
-        }
-    };
-    walk(obj.dependencies);
-    return out;
-}
-/** Read package.json + the first lockfile we find in `dir`. Missing files yield
- *  an empty-ish tree rather than throwing — the caller decides what to do with
- *  no deps. */
-export function readTree(dir) {
-    let directNames = [];
-    let ranges = {};
-    const pkgPath = join(dir, 'package.json');
-    if (existsSync(pkgPath)) {
-        const parsed = parsePackageJsonDeps(readFileSync(pkgPath, 'utf-8'));
-        directNames = parsed.directNames;
-        ranges = parsed.ranges;
-    }
-    let locked = [];
-    for (const lockName of ['package-lock.json', 'npm-shrinkwrap.json']) {
-        const lockPath = join(dir, lockName);
-        if (existsSync(lockPath)) {
-            locked = parseLockfile(readFileSync(lockPath, 'utf-8'));
-            break;
-        }
-    }
-    return { directNames, ranges, locked };
-}
-//# sourceMappingURL=tree.js.map

package/dist/swpx/tree.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tree.js","sourceRoot":"","sources":["../../src/swpx/tree.ts"],"names":[],"mappings":"AAAA;;;;;;6EAM6E;AAE7E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAgBjC,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAIlD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;gBAClE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED;;2EAE2E;AAC3E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAgB,EAAE,EAAE;QAC7C,IAAI,CAAC,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO;QACjD,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO;QACzB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,GAAG,CAAC,QAA4E,CAAC;IAClG,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,GAAG;gBAAE,SAAS,CAAC,yBAAyB;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YAC7C,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,SAAS;YACzB,IAAI,GAAG,EAAE,IAAI;gBAAE,SAAS,CAAC,wCAAwC;YACjE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,8CAA8C;IAC9C,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,EAAE;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAoE,CAAC,EAAE,CAAC;YAChH,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACzB,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;eAEe;AACf,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,IAAI,WAAW,GAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,GAA2B,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACjC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,aAAa,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YACxD,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC"}

package/dist/swpx/types.js

@@ -1,14 +0,0 @@
-/** Shared types for the swpx / swpm verdict layer.
- *
- *  The verdict API lives on the `npm` platform project (npm.somewhere.tech),
- *  NOT the /v1 control plane. It is unauthenticated (free, no login) — the CLI
- *  hits it with a plain fetch, independent of `somewhere login`. See
- *  verdict-client.ts.
- *
- *  The `Verdict` shape mirrors the D1 `verdicts` row (tsk_f30faf55) plus the
- *  live MAL advisory check, which is NOT cached (a version can be retroactively
- *  flagged). The `--json` output is a stable PROJECTION of this (toJsonVerdict)
- *  — that projection is the public contract shown on npm.somewhere.tech, so it
- *  is intentionally narrower than the internal row. */
-export {};
-//# sourceMappingURL=types.js.map

package/dist/swpx/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/swpx/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;uDAWuD"}

package/dist/swpx/verdict-client.js

@@ -1,165 +0,0 @@
-/** Client for the verdict API hosted on the `npm` platform project.
- *
- *  This is NOT the /v1 control plane and NOT the runner — it's the public,
- *  unauthenticated verdict service at npm.somewhere.tech (FAQ: "Free, no
- *  login"). So this client deliberately does not touch ApiClient or the stored
- *  developer key. Override the host for staging/tests via SWPX_VERDICT_URL.
- *
- *  Reachability is a product guarantee, inverted: if the verdict API is down,
- *  the user must still get normal npm behaviour ("a gate, not a wall"). So every
- *  failure here raises VerdictUnavailable and the command layer falls back to
- *  the real npx/npm. We never block on our own outage. */
-const VERDICT_BASE = process.env.SWPX_VERDICT_URL?.replace(/\/$/, '') || 'https://npm.somewhere.tech';
-/** Budget for one verdict lookup. It sits in front of every `npx`, so it must
- *  fail to fallback rather than stall — but 4s was too tight for the COLD path
- *  (fresh DNS/TLS from the client + a cold worker + a first-time uncached compute),
- *  which spuriously tripped the fail-open banner on the very first call while every
- *  warm call after was instant. 15s comfortably covers a cold uncached lookup;
- *  override with SWPX_VERDICT_TIMEOUT_MS (e.g. lower it for strict fail-fast in CI). */
-export const verdictTimeoutMs = Number(process.env.SWPX_VERDICT_TIMEOUT_MS) || 15_000;
-/** Summary generation is best-effort, but a missing narrative must never leave
- *  the user staring at a blank decision screen forever. Keep one overall budget
- *  across every enrich poll; env overrides make staging and tests tunable. */
-const SUMMARY_POLL_TIMEOUT_MS = Number(process.env.SWPX_SUMMARY_TIMEOUT_MS) || 20_000;
-const SUMMARY_POLL_INTERVAL_MS = Number(process.env.SWPX_SUMMARY_POLL_INTERVAL_MS) || 1_500;
-const defaultFetch = (url, init) => fetch(url, init);
-/** Raised whenever the verdict couldn't be obtained — network error, timeout,
- *  non-2xx, or unparseable body. The command layer treats it as "fall back to
- *  the real tool", never as "block". */
-export class VerdictUnavailable extends Error {
-    /** True when the service answered 429 — a throttle, not an outage/tampering. */
-    rateLimited;
-    /** True when the client deadline elapsed before the service answered. */
-    timedOut;
-    constructor(message, rateLimited = false, timedOut = false) {
-        super(message);
-        this.name = 'VerdictUnavailable';
-        this.rateLimited = rateLimited;
-        this.timedOut = timedOut;
-    }
-}
-/** Accept either a bare verdict object or a `{ ok, data }` envelope. */
-function unwrap(body) {
-    if (body && typeof body === 'object' && 'ok' in body) {
-        const env = body;
-        if (env.ok === true)
-            return env.data;
-        throw new VerdictUnavailable(env.message || env.error || 'verdict API returned ok:false');
-    }
-    return body;
-}
-function timeoutSignal(timeoutMs = verdictTimeoutMs) {
-    try {
-        return AbortSignal.timeout(timeoutMs);
-    }
-    catch {
-        return undefined; // very old runtime — let the request run without our timeout
-    }
-}
-async function requestVerdict(name, version, fetchImpl, enrich, timeoutMs = verdictTimeoutMs) {
-    const suffix = enrich ? '?enrich=1' : '';
-    const url = `${VERDICT_BASE}/api/verdict/${encodeURIComponent(name)}/${encodeURIComponent(version)}${suffix}`;
-    let res;
-    try {
-        res = await fetchImpl(url, {
-            headers: {
-                Accept: 'application/json',
-                ...(enrich ? { 'Cache-Control': 'no-cache' } : {}),
-            },
-            signal: timeoutSignal(timeoutMs),
-        });
-    }
-    catch (err) {
-        const timedOut = err instanceof Error && (err.name === 'TimeoutError' || err.name === 'AbortError');
-        throw new VerdictUnavailable(err instanceof Error ? err.message : String(err), false, timedOut);
-    }
-    if (!res.ok)
-        throw new VerdictUnavailable(`verdict API returned ${res.status}`, res.status === 429);
-    let body;
-    try {
-        body = await res.json();
-    }
-    catch {
-        throw new VerdictUnavailable('verdict API returned a non-JSON body');
-    }
-    const v = unwrap(body);
-    if (!v || typeof v !== 'object' || typeof v.verdict !== 'string') {
-        throw new VerdictUnavailable('verdict API returned an unexpected shape');
-    }
-    // Trust the caller's resolved coordinates over whatever the row echoes back.
-    return { ...v, package: name, version };
-}
-/** Look up one package@version. Throws VerdictUnavailable on any failure. */
-export async function getVerdict(name, version, fetchImpl = defaultFetch) {
-    return requestVerdict(name, version, fetchImpl, false);
-}
-/** Ask the verdict backend to enrich a mechanical verdict, then keep polling
- *  until its LLM narrative appears or the single overall budget expires.
- *  Returns null on timeout/unavailability so callers can continue with the raw
- *  verdict and metadata; summary generation never changes fail-open behavior. */
-export async function pollVerdictSummary(name, version, fetchImpl = defaultFetch, options = {}) {
-    const timeoutMs = Math.max(1, options.timeoutMs ?? SUMMARY_POLL_TIMEOUT_MS);
-    const intervalMs = Math.max(1, options.intervalMs ?? SUMMARY_POLL_INTERVAL_MS);
-    const now = options.now ?? Date.now;
-    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-    const deadline = now() + timeoutMs;
-    while (now() < deadline) {
-        const remaining = Math.max(1, deadline - now());
-        try {
-            const verdict = await requestVerdict(name, version, fetchImpl, true, Math.min(verdictTimeoutMs, remaining));
-            if (typeof verdict.summary === 'string' && verdict.summary.trim())
-                return verdict;
-        }
-        catch (err) {
-            // A throttle will not clear inside this short budget. Other transient
-            // failures get another attempt, still bounded by the same deadline.
-            if (err instanceof VerdictUnavailable && err.rateLimited)
-                return null;
-        }
-        const waitMs = Math.min(intervalMs, Math.max(0, deadline - now()));
-        if (waitMs > 0)
-            await sleep(waitMs);
-    }
-    return null;
-}
-/** Batch-check a resolved tree. Throws VerdictUnavailable on any failure so the
- *  caller can fall back to a plain `npm install`. The returned array is aligned
- *  to the input order; any row the service omits is dropped (caller treats a
- *  missing row as "unknown", not "verified"). */
-export async function getVerdictBatch(pkgs, fetchImpl = defaultFetch) {
-    if (pkgs.length === 0)
-        return [];
-    const url = `${VERDICT_BASE}/api/verdict/batch`;
-    let res;
-    try {
-        res = await fetchImpl(url, {
-            method: 'POST',
-            headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
-            body: JSON.stringify({ packages: pkgs }),
-            signal: timeoutSignal(),
-        });
-    }
-    catch (err) {
-        const timedOut = err instanceof Error && (err.name === 'TimeoutError' || err.name === 'AbortError');
-        throw new VerdictUnavailable(err instanceof Error ? err.message : String(err), false, timedOut);
-    }
-    if (!res.ok)
-        throw new VerdictUnavailable(`verdict API returned ${res.status}`, res.status === 429);
-    let body;
-    try {
-        body = await res.json();
-    }
-    catch {
-        throw new VerdictUnavailable('verdict API returned a non-JSON body');
-    }
-    const data = unwrap(body);
-    const results = Array.isArray(data)
-        ? data
-        : data?.results;
-    if (!Array.isArray(results)) {
-        throw new VerdictUnavailable('verdict API batch returned an unexpected shape');
-    }
-    return results.filter((v) => !!v && typeof v === 'object' && typeof v.verdict === 'string');
-}
-export const verdictBaseUrl = VERDICT_BASE;
-//# sourceMappingURL=verdict-client.js.map

package/dist/swpx/verdict-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verdict-client.js","sourceRoot":"","sources":["../../src/swpx/verdict-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;0DAU0D;AAK1D,MAAM,YAAY,GAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,4BAA4B,CAAC;AAEnF;;;;;wFAKwF;AACxF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC;AAEtF;;8EAE8E;AAC9E,MAAM,uBAAuB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC;AACtF,MAAM,wBAAwB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,KAAK,CAAC;AAE5F,MAAM,YAAY,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAC5C,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAsC,CAAC;AAEvE;;wCAEwC;AACxC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,gFAAgF;IACvE,WAAW,CAAU;IAC9B,yEAAyE;IAChE,QAAQ,CAAU;IAC3B,YAAY,OAAe,EAAE,WAAW,GAAG,KAAK,EAAE,QAAQ,GAAG,KAAK;QAChE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,wEAAwE;AACxE,SAAS,MAAM,CAAC,IAAa;IAC3B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAA0E,CAAC;QACvF,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,IAAI,+BAA+B,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,SAAS,GAAG,gBAAgB;IACjD,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,6DAA6D;IACjF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAY,EACZ,OAAe,EACf,SAAoB,EACpB,MAAe,EACf,SAAS,GAAG,gBAAgB;IAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,YAAY,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC;IAC9G,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACzB,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD;YACD,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;QACpG,MAAM,IAAI,kBAAkB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IACpG,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAwB,CAAC;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAa,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9E,MAAM,IAAI,kBAAkB,CAAC,0CAA0C,CAAC,CAAC;IAC3E,CAAC;IACD,6EAA6E;IAC7E,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,OAAe,EACf,YAAuB,YAAY;IAEnC,OAAO,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC;AASD;;;iFAGiF;AACjF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,OAAe,EACf,YAAuB,YAAY,EACnC,UAA8B,EAAE;IAEhC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,IAAI,wBAAwB,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC;IAEnC,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAClC,IAAI,EACJ,OAAO,EACP,SAAS,EACT,IAAI,EACJ,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CACtC,CAAC;YACF,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE;gBAAE,OAAO,OAAO,CAAC;QACpF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,oEAAoE;YACpE,IAAI,GAAG,YAAY,kBAAkB,IAAI,GAAG,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC;QACxE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACnE,IAAI,MAAM,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;iDAGiD;AACjD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAiD,EACjD,YAAuB,YAAY;IAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,GAAG,YAAY,oBAAoB,CAAC;IAChD,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACzB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACxC,MAAM,EAAE,aAAa,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;QACpG,MAAM,IAAI,kBAAkB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IACpG,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,CAAC,CAAC,IAAI;QACN,CAAC,CAAE,IAA8B,EAAE,OAAO,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC,gDAAgD,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAa,CAAC,OAAO,KAAK,QAAQ,CAChG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC"}