@svp-labs/talos 0.0.0 → 0.1.0

package/dist/checks/supply/exotic.js

@@ -0,0 +1,36 @@
+import { hasLockfile } from './deps.js';
+import { lockfiles, readLockfile } from './lockfiles/index.js';
+const KINDS = {
+    git: 'a git repository',
+    url: 'a tarball or URL',
+};
+/** A dependency from git or a URL, anywhere in a lockfile's tree. */
+function exoticFindings(path, locked) {
+    return locked.flatMap((entry) => {
+        const source = entry.source;
+        if (source.kind !== 'git' && source.kind !== 'url')
+            return [];
+        return [
+            {
+                rule: 'supply/exotic-source',
+                key: `${entry.name} ${source.from}`,
+                message: `${entry.name} ${entry.version} in ${path} comes from ${KINDS[source.kind]} ` +
+                    `(${source.from}), not a registry; depend on a published release instead.`,
+            },
+        ];
+    });
+}
+export function exoticCheck() {
+    return {
+        id: 'supply/exotic',
+        tier: 'head',
+        scope: 'repo',
+        title: 'no git or tarball dependency anywhere in the tree',
+        applies: hasLockfile,
+        run: async (ctx) => {
+            const found = await Promise.all(lockfiles(ctx.facts).map(async (path) => exoticFindings(path, await readLockfile(ctx.root, path))));
+            return found.flat();
+        },
+    };
+}
+//# sourceMappingURL=exotic.js.map

package/dist/checks/supply/exotic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exotic.js","sourceRoot":"","sources":["../../../src/checks/supply/exotic.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAe,SAAS,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAI5E,MAAM,KAAK,GAA4C;IACrD,GAAG,EAAE,kBAAkB;IACvB,GAAG,EAAE,kBAAkB;CACxB,CAAC;AAEF,qEAAqE;AACrE,SAAS,cAAc,CAAC,IAAY,EAAE,MAAyB;IAC7D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAa,EAAE;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5B,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,EAAE,CAAC;QAC9D,OAAO;YACL;gBACE,IAAI,EAAE,sBAAsB;gBAC5B,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;gBACnC,OAAO,EACL,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,OAAO,IAAI,eAAe,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;oBAC7E,IAAI,MAAM,CAAC,IAAI,2DAA2D;aAC7E;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,mDAAmD;QAC1D,OAAO,EAAE,WAAW;QACpB,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACtC,cAAc,CAAC,IAAI,EAAE,MAAM,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CACzD,CACF,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/supply/expired.js

@@ -0,0 +1,72 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { beyond, expired, MAX_ALLOW_DAYS } from './dates.js';
+import { CONFIG_FILE } from '../../config/load.js';
+import { APPLIES, skip } from '../../core/check.js';
+function entries(config) {
+    const { allow, exceptions } = config.supply_chain;
+    return [
+        ...Object.entries(allow).map(([name, entry]) => ({ list: 'allow', name, entry })),
+        ...Object.entries(exceptions).map(([name, entry]) => ({
+            list: 'exceptions',
+            name,
+            entry,
+        })),
+    ];
+}
+/** The line of `talos.yml` that names the entry, so the finding points at it. */
+export function entryLine(text, name) {
+    const index = text
+        .split(/\r?\n/)
+        .findIndex((line) => line.includes(`"${name}"`) ||
+        line.includes(`'${name}'`) ||
+        line.trimStart().startsWith(`${name}:`));
+    return index < 0 ? undefined : index + 1;
+}
+/** What an entry's dates say is wrong with it, if anything. */
+export function judgeEntry(item, now) {
+    const { list, name, entry } = item;
+    if (expired(entry, now)) {
+        const what = list === 'allow' ? 'young release' : 'advisory';
+        return {
+            rule: 'supply/expired',
+            key: `${list} ${name}`,
+            policy: 'always',
+            message: `The supply_chain.${list} entry for ${name} expired on ${entry.expires}; fix the ${what} or renew the entry with a new reason.`,
+        };
+    }
+    if (list === 'allow' && beyond(entry, now, MAX_ALLOW_DAYS)) {
+        return {
+            rule: 'supply/allow-too-long',
+            key: `allow ${name}`,
+            message: `The supply_chain.allow entry for ${name} runs to ${entry.expires}; a young release may be allowed for ${MAX_ALLOW_DAYS} days at most.`,
+        };
+    }
+    return undefined;
+}
+/**
+ * `supply_chain` entries past their expiry, which fail every change until they go, and allow
+ * entries that reach further than a week.
+ */
+export function expiredCheck(deps) {
+    return {
+        id: 'supply/expired',
+        tier: 'head',
+        scope: 'repo',
+        title: 'supply_chain allow and exception entries within their expiry',
+        applies: (ctx) => entries(ctx.config).length > 0 ? APPLIES : skip('talos.yml has no supply_chain entries'),
+        run: async (ctx) => {
+            const now = deps.now();
+            const text = await readFile(join(ctx.root, CONFIG_FILE), 'utf8').catch(() => '');
+            return entries(ctx.config).flatMap((item) => {
+                const found = judgeEntry(item, now);
+                if (found === undefined)
+                    return [];
+                const line = entryLine(text, item.name);
+                const location = line === undefined ? undefined : { file: CONFIG_FILE, line };
+                return [location === undefined ? found : { ...found, location }];
+            });
+        },
+    };
+}
+//# sourceMappingURL=expired.js.map

package/dist/checks/supply/expired.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expired.js","sourceRoot":"","sources":["../../../src/checks/supply/expired.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE7D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,OAAO,EAAc,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAShE,SAAS,OAAO,CAAC,MAAmB;IAClC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;IAClD,OAAO;QACL,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAS,EAAE,CAAC,CAAC;YAC3D,IAAI,EAAE,YAAY;YAClB,IAAI;YACJ,KAAK;SACN,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY;IAClD,MAAM,KAAK,GAAG,IAAI;SACf,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CACR,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC;QAC1B,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAC1C,CAAC;IACJ,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,UAAU,CAAC,IAAW,EAAE,GAAS;IAC/C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACnC,IAAI,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,GAAG,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE;YACtB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,oBAAoB,IAAI,cAAc,IAAI,eAAe,KAAK,CAAC,OAAO,aAAa,IAAI,wCAAwC;SACzI,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;QAC3D,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,GAAG,EAAE,SAAS,IAAI,EAAE;YACpB,OAAO,EAAE,oCAAoC,IAAI,YAAY,KAAK,CAAC,OAAO,wCAAwC,cAAc,gBAAgB;SACjJ,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAA6B;IACxD,OAAO;QACL,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,8DAA8D;QACrE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC;QAC1F,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACjF,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAa,EAAE;gBACrD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACpC,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxC,MAAM,QAAQ,GACZ,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;gBAC/D,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/supply/fetcher.js

@@ -0,0 +1,52 @@
+import { EngineError } from '../../core/check.js';
+const TIMEOUT_MS = 60_000;
+/**
+ * The network. Node's `fetch` uses `HTTPS_PROXY` only when `NODE_USE_ENV_PROXY=1` is set, as it
+ * must be behind a proxy.
+ */
+export const httpFetcher = async (request) => {
+    const response = await fetch(request.url, {
+        method: request.method ?? 'GET',
+        headers: {
+            accept: 'application/json',
+            'user-agent': 'talos-supply-check (https://github.com/SVP-Labs/Talos)',
+            ...(request.body === undefined ? {} : { 'content-type': 'application/json' }),
+        },
+        ...(request.body === undefined ? {} : { body: request.body }),
+        signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+    return { status: response.status, body: await response.text() };
+};
+/**
+ * A 200 answer's body, or `undefined` when the registry has no such package (404). Anything else
+ * leaves Talos unable to judge: an engine error.
+ */
+export async function getText(fetcher, request, what) {
+    let response;
+    try {
+        response = await fetcher(request);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new EngineError(`${what} could not be reached: ${reason}`);
+    }
+    if (response.status === 404)
+        return undefined;
+    if (response.status !== 200)
+        throw new EngineError(`${what} answered HTTP ${response.status}`);
+    return response.body;
+}
+/** `getText`, read as JSON. */
+export async function getJson(fetcher, request, what) {
+    const body = await getText(fetcher, request, what);
+    if (body === undefined)
+        return undefined;
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new EngineError(`${what} answered with something other than JSON`);
+    }
+}
+export { inPool } from '../../core/pool.js';
+//# sourceMappingURL=fetcher.js.map

package/dist/checks/supply/fetcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetcher.js","sourceRoot":"","sources":["../../../src/checks/supply/fetcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAa,MAAM,qBAAqB,CAAC;AAiB7D,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAY,KAAK,EAAE,OAAO,EAAE,EAAE;IACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;QAC/B,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,wDAAwD;YACtE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;SAC9E;QACD,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;KACxC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AAClE,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAgB,EAChB,OAAoB,EACpB,IAAY;IAEZ,IAAI,QAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,0BAA0B,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,kBAAkB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,+BAA+B;AAC/B,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAgB,EAChB,OAAoB,EACpB,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,0CAA0C,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/checks/supply/index.js

@@ -0,0 +1,21 @@
+import { LIVE } from './deps.js';
+import { exoticCheck } from './exotic.js';
+import { expiredCheck } from './expired.js';
+import { provenanceCheck } from './provenance.js';
+import { releaseAgeCheck } from './release-age.js';
+import { settingsCheck } from './settings.js';
+/** The supply-chain checks, reaching the registries and the clock through `deps`. */
+export function supplyChecks(deps) {
+    return [
+        releaseAgeCheck(deps),
+        exoticCheck(),
+        provenanceCheck(deps),
+        settingsCheck(),
+        expiredCheck(deps),
+    ];
+}
+export const supplyPack = {
+    name: 'supply',
+    checks: supplyChecks(LIVE),
+};
+//# sourceMappingURL=index.js.map

package/dist/checks/supply/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/checks/supply/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAI9C,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,OAAO;QACL,eAAe,CAAC,IAAI,CAAC;QACrB,WAAW,EAAE;QACb,eAAe,CAAC,IAAI,CAAC;QACrB,aAAa,EAAE;QACf,YAAY,CAAC,IAAI,CAAC;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAS;IAC9B,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;CAC3B,CAAC"}

package/dist/checks/supply/judged.js

@@ -0,0 +1,55 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { baseText, changeTo } from './base.js';
+import { lockfiles, parseLockfile } from './lockfiles/index.js';
+const NOTHING_REPLACED = new Map();
+const identity = (locked) => `${locked.ecosystem}:${locked.name}@${locked.version}`;
+/** A version npm installs in several places is judged once. */
+function unique(locked) {
+    const seen = new Map();
+    for (const entry of locked)
+        if (!seen.has(identity(entry)))
+            seen.set(identity(entry), entry);
+    return [...seen.values()];
+}
+/** The versions of each package base had and head dropped: what head's versions replace. */
+export function replacedVersions(head, base) {
+    const kept = new Set(head.map(identity));
+    const replaced = new Map();
+    for (const locked of base.filter((b) => !kept.has(identity(b)))) {
+        replaced.set(locked.name, [...(replaced.get(locked.name) ?? []), locked.version]);
+    }
+    return replaced;
+}
+/**
+ * Which locked versions a side judges. Alone, every one. In a comparison, head judges what it
+ * added and base nothing, so a finding is new exactly when the change added the version; when
+ * the diff can't rebuild the base lockfile, both sides judge everything and the comparison
+ * sorts it out.
+ */
+export function judge(side, path, text) {
+    const locked = unique(parseLockfile(path, text));
+    const all = { path, judged: locked, replaced: NOTHING_REPLACED };
+    if (side.side === 'alone' || side.changes === undefined)
+        return all;
+    const change = changeTo(side.changes, path);
+    if (change === undefined)
+        return { path, judged: [], replaced: NOTHING_REPLACED };
+    const base = baseText(text, change);
+    if (!base.known)
+        return all;
+    if (side.side === 'base')
+        return { path, judged: [], replaced: NOTHING_REPLACED };
+    const before = base.text === undefined ? [] : parseLockfile(path, base.text);
+    const had = new Set(before.map(identity));
+    return {
+        path,
+        judged: locked.filter((l) => !had.has(identity(l))),
+        replaced: replacedVersions(locked, before),
+    };
+}
+/** Every tracked lockfile, judged once per run and shared by the checks that read them. */
+export async function judgedLockfiles(ctx) {
+    return ctx.memo('supply/judged-lockfiles', async () => Promise.all(lockfiles(ctx.facts).map(async (path) => judge(ctx, path, await readFile(join(ctx.root, path), 'utf8')))));
+}
+//# sourceMappingURL=judged.js.map

package/dist/checks/supply/judged.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"judged.js","sourceRoot":"","sources":["../../../src/checks/supply/judged.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAe,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAW7E,MAAM,gBAAgB,GAA2C,IAAI,GAAG,EAAE,CAAC;AAE3E,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;AAEpG,+DAA+D;AAC/D,SAAS,MAAM,CAAC,MAAyB;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAC9B,IAAuB,EACvB,IAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC7C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAID;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,IAAU,EAAE,IAAY,EAAE,IAAY;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IACjE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1C,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,QAAQ,EAAE,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAiB;IACrD,OAAO,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE,CACpD,OAAO,CAAC,GAAG,CACT,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACtC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAC/D,CACF,CACF,CAAC;AACJ,CAAC"}

package/dist/checks/supply/lockfiles/cargo.js

@@ -0,0 +1,34 @@
+import { parse } from 'smol-toml';
+import { z } from 'zod';
+import { fromGit, fromUrl, LOCAL, PUBLIC_REGISTRY } from './locked.js';
+const CRATES_IO = new Set([
+    'registry+https://github.com/rust-lang/crates.io-index',
+    'sparse+https://index.crates.io/',
+]);
+const lockfile = z.looseObject({
+    package: z
+        .array(z.looseObject({ name: z.string(), version: z.string(), source: z.string().optional() }))
+        .default([]),
+});
+/** A package without `source` is a workspace member or a path dependency. */
+function sourceOf(source) {
+    if (source === undefined || source.startsWith('path+'))
+        return LOCAL;
+    if (CRATES_IO.has(source))
+        return PUBLIC_REGISTRY;
+    if (/^(?:registry|sparse)\+/.test(source))
+        return { kind: 'registry', public: false };
+    if (source.startsWith('git+'))
+        return fromGit(source.slice('git+'.length));
+    return fromUrl(source);
+}
+/** `Cargo.lock`: each `[[package]]` with its `source`. */
+export function parseCargoLock(text) {
+    return lockfile.parse(parse(text)).package.map((found) => ({
+        ecosystem: 'crates',
+        name: found.name,
+        version: found.version,
+        source: sourceOf(found.source),
+    }));
+}
+//# sourceMappingURL=cargo.js.map

package/dist/checks/supply/lockfiles/cargo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cargo.js","sourceRoot":"","sources":["../../../../src/checks/supply/lockfiles/cargo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAe,eAAe,EAAe,MAAM,aAAa,CAAC;AAEjG,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,uDAAuD;IACvD,iCAAiC;CAClC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC;IAC7B,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SAC9F,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAEH,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,MAA0B;IAC1C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,eAAe,CAAC;IAClD,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACtF,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;KAC/B,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/checks/supply/lockfiles/composer.js

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+import { fromGit, fromUrl, LOCAL, PUBLIC_REGISTRY } from './locked.js';
+const location = z.looseObject({ type: z.string().default(''), url: z.string().default('') });
+const entry = z.looseObject({
+    name: z.string(),
+    version: z.string(),
+    source: location.optional(),
+    dist: location.optional(),
+    'notification-url': z.string().optional(),
+    license: z.array(z.string()).optional(),
+});
+const lockfile = z.looseObject({
+    packages: z.array(entry).default([]),
+    'packages-dev': z.array(entry).default([]),
+});
+/**
+ * Packagist's packages carry its download notification URL; a `dev-` version is a branch
+ * checkout even from Packagist. Anything else came from a VCS, a URL or a path repository.
+ */
+function sourceOf(found) {
+    if (found.dist?.type === 'path')
+        return LOCAL;
+    const fromPackagist = found['notification-url']?.includes('packagist.org') === true;
+    if (fromPackagist && !found.version.startsWith('dev-'))
+        return PUBLIC_REGISTRY;
+    if (found.source !== undefined && found.source.url !== '')
+        return fromGit(found.source.url);
+    return fromUrl(found.dist?.url ?? found.name);
+}
+/** `composer.lock`: `packages` and `packages-dev`. */
+export function parseComposerLock(text) {
+    const parsed = lockfile.parse(JSON.parse(text));
+    return [...parsed.packages, ...parsed['packages-dev']].map((found) => ({
+        ecosystem: 'packagist',
+        name: found.name,
+        version: found.version,
+        source: sourceOf(found),
+        ...(found.license === undefined ? {} : { licences: found.license }),
+    }));
+}
+//# sourceMappingURL=composer.js.map

package/dist/checks/supply/lockfiles/composer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composer.js","sourceRoot":"","sources":["../../../../src/checks/supply/lockfiles/composer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAe,eAAe,EAAe,MAAM,aAAa,CAAC;AAEjG,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAE9F,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE;IACzB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAC;AAIH;;;GAGG;AACH,SAAS,QAAQ,CAAC,KAAY;IAC5B,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,aAAa,GAAG,KAAK,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,eAAe,CAAC,KAAK,IAAI,CAAC;IACpF,IAAI,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,eAAe,CAAC;IAC/E,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,EAAE;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrE,SAAS,EAAE,WAAW;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACpE,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/checks/supply/lockfiles/index.js

@@ -0,0 +1,51 @@
+import { readFile } from 'node:fs/promises';
+import { join, posix } from 'node:path';
+import { parseCargoLock } from './cargo.js';
+import { parseComposerLock } from './composer.js';
+import { unreadable } from './locked.js';
+import { parseNpmLock } from './npm.js';
+import { parsePnpmLock } from './pnpm.js';
+import { parsePoetryLock, parseUvLock } from './python.js';
+import { parseYarnLock } from './yarn.js';
+export { isPublic, spec } from './locked.js';
+/** Each lockfile Talos reads, by file name, and how. */
+const PARSERS = {
+    'pnpm-lock.yaml': parsePnpmLock,
+    'package-lock.json': parseNpmLock,
+    'npm-shrinkwrap.json': parseNpmLock,
+    'yarn.lock': parseYarnLock,
+    'uv.lock': parseUvLock,
+    'poetry.lock': parsePoetryLock,
+    'composer.lock': parseComposerLock,
+    'Cargo.lock': parseCargoLock,
+};
+export const LOCKFILE_NAMES = Object.keys(PARSERS);
+/** The tracked lockfiles Talos reads, repository-relative, sorted. */
+export function lockfiles(facts) {
+    return facts
+        .matching(...LOCKFILE_NAMES.map((name) => `**/${name}`))
+        .sort((a, b) => a.localeCompare(b));
+}
+/** Reads a lockfile's text; throws `EngineError` when it isn't the format its name says. */
+export function parseLockfile(path, text) {
+    const parser = PARSERS[posix.basename(path)];
+    if (parser === undefined)
+        return [];
+    try {
+        return parser(text);
+    }
+    catch (error) {
+        throw unreadable(path, error);
+    }
+}
+export async function readLockfile(root, path) {
+    let text;
+    try {
+        text = await readFile(join(root, path), 'utf8');
+    }
+    catch (error) {
+        throw unreadable(path, error);
+    }
+    return parseLockfile(path, text);
+}
+//# sourceMappingURL=index.js.map

package/dist/checks/supply/lockfiles/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/checks/supply/lockfiles/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAe,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAI1C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAE7C,wDAAwD;AACxD,MAAM,OAAO,GAAyD;IACpE,gBAAgB,EAAE,aAAa;IAC/B,mBAAmB,EAAE,YAAY;IACjC,qBAAqB,EAAE,YAAY;IACnC,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,aAAa,EAAE,eAAe;IAC9B,eAAe,EAAE,iBAAiB;IAClC,YAAY,EAAE,cAAc;CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAsB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAEtE,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,KAAgB;IACxC,OAAO,KAAK;SACT,QAAQ,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;SACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAY;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IAC3D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/checks/supply/lockfiles/locked.js

@@ -0,0 +1,69 @@
+import { z } from 'zod';
+import { EngineError } from '../../../core/check.js';
+export const PUBLIC_REGISTRY = { kind: 'registry', public: true };
+export const LOCAL = { kind: 'local' };
+const ARCHIVE = /\.(?:tgz|tar|tar\.gz|tar\.bz2|tar\.xz|zip|whl|crate)$/i;
+/** The text before the first of `marks`, or all of it. */
+export function before(text, marks) {
+    const cut = marks.map((mark) => text.indexOf(mark)).filter((index) => index >= 0);
+    return cut.length === 0 ? text : text.slice(0, Math.min(...cut));
+}
+/** Whether a path or URL names an archive rather than a directory. */
+function isArchive(path) {
+    return ARCHIVE.test(before(path, ['?', '#']));
+}
+/** A URL without its credentials or query, safe to put in a finding. */
+export function shownSource(from) {
+    return from.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/@\s]*@/i, '$1').replace(/\?[^#]*/, '');
+}
+export function fromGit(from) {
+    return { kind: 'git', from: shownSource(from) };
+}
+export function fromUrl(from) {
+    return { kind: 'url', from: shownSource(from) };
+}
+/** A local file dependency: an archive is a tarball dependency, a directory is the project's. */
+export function fromFile(path) {
+    return isArchive(path) ? fromUrl(path) : LOCAL;
+}
+const NPM_HOSTS = new Set(['registry.npmjs.org', 'registry.yarnpkg.com']);
+/**
+ * How npm, Yarn and pnpm record where a version was downloaded from: a registry tarball
+ * (`…/<name>/-/<base>-<version>.tgz`), a git URL, a local path, or any other URL.
+ */
+export function npmSource(name, version, resolved) {
+    if (/^(?:git\+|git:|git@|github:|gitlab:|bitbucket:)/.test(resolved))
+        return fromGit(resolved);
+    if (resolved.startsWith('file:'))
+        return fromFile(resolved.slice('file:'.length));
+    let url;
+    try {
+        url = new URL(resolved);
+    }
+    catch {
+        return fromUrl(resolved);
+    }
+    const base = name.slice(name.lastIndexOf('/') + 1);
+    const path = decodeURIComponent(url.pathname);
+    if (path.endsWith(`/${name}/-/${base}-${version}.tgz`)) {
+        return { kind: 'registry', public: NPM_HOSTS.has(url.hostname) };
+    }
+    return fromUrl(resolved);
+}
+/** `name@version` with a scoped name's leading `@` kept: `@scope/pkg@1.0.0`. */
+export function splitSpec(spec) {
+    const at = spec.indexOf('@', 1);
+    return at < 0 ? { name: spec, rest: '' } : { name: spec.slice(0, at), rest: spec.slice(at + 1) };
+}
+/** A lockfile Talos can't read is an engine error: the package manager would refuse it too. */
+export function unreadable(path, error) {
+    const text = error instanceof z.ZodError ? z.prettifyError(error) : String(error);
+    const reason = text.split('\n').find((line) => line.trim() !== '') ?? 'unknown format';
+    return new EngineError(`${path} could not be read as a lockfile: ${reason.trim()}`);
+}
+export const isPublic = (locked) => locked.source.kind === 'registry' && locked.source.public;
+/** `name@version`, the form `supply_chain.allow` keys take. */
+export function spec(locked) {
+    return `${locked.name}@${locked.version}`;
+}
+//# sourceMappingURL=locked.js.map

package/dist/checks/supply/lockfiles/locked.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"locked.js","sourceRoot":"","sources":["../../../../src/checks/supply/lockfiles/locked.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAuBrD,MAAM,CAAC,MAAM,eAAe,GAAW,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1E,MAAM,CAAC,MAAM,KAAK,GAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAE/C,MAAM,OAAO,GAAG,wDAAwD,CAAC;AAEzE,0DAA0D;AAC1D,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAwB;IAC3D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IAClF,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,sEAAsE;AACtE,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,qCAAqC,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAE1E;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,OAAe,EAAE,QAAgB;IACvE,IAAI,iDAAiD,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/F,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,MAAM,IAAI,IAAI,OAAO,MAAM,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAChC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,KAAc;IACrD,MAAM,IAAI,GAAG,KAAK,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,gBAAgB,CAAC;IACvF,OAAO,IAAI,WAAW,CAAC,GAAG,IAAI,qCAAqC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAW,EAAE,CAClD,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;AAE5D,+DAA+D;AAC/D,MAAM,UAAU,IAAI,CAAC,MAAwC;IAC3D,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;AAC5C,CAAC"}

package/dist/checks/supply/lockfiles/npm.js

@@ -0,0 +1,68 @@
+import { z } from 'zod';
+import { fromGit, fromUrl, LOCAL, npmSource, PUBLIC_REGISTRY, } from './locked.js';
+const v1Entry = z.lazy(() => z.looseObject({
+    version: z.string().optional(),
+    resolved: z.string().optional(),
+    dependencies: z.record(z.string(), v1Entry).optional(),
+}));
+const entry = z.looseObject({
+    name: z.string().optional(),
+    version: z.string().optional(),
+    resolved: z.string().optional(),
+    link: z.boolean().optional(),
+    license: z.unknown().optional(),
+});
+const lockfile = z.looseObject({
+    packages: z.record(z.string(), entry).optional(),
+    dependencies: z.record(z.string(), v1Entry).optional(),
+});
+const PLAIN_VERSION = /^\d[\w.+-]*$/;
+function sourceOf(name, version, resolved) {
+    if (resolved !== undefined)
+        return npmSource(name, version, resolved);
+    if (PLAIN_VERSION.test(version))
+        return PUBLIC_REGISTRY;
+    if (/^(?:git\+|git:|github:)/.test(version))
+        return fromGit(version);
+    return fromUrl(version);
+}
+function fromPackages(packages) {
+    return Object.entries(packages).flatMap(([path, found]) => {
+        if (path === '')
+            return [];
+        const marker = path.lastIndexOf('node_modules/');
+        const name = found.name ?? path.slice(marker + 'node_modules/'.length);
+        const version = found.version ?? '0.0.0';
+        const local = marker < 0 || found.link === true;
+        const licence = typeof found.license === 'string' ? { licences: [found.license] } : {};
+        return [
+            {
+                ecosystem: 'npm',
+                name,
+                version,
+                source: local ? LOCAL : sourceOf(name, version, found.resolved),
+                ...licence,
+            },
+        ];
+    });
+}
+function fromV1(dependencies) {
+    return Object.entries(dependencies).flatMap(([name, found]) => {
+        const version = found.version ?? '0.0.0';
+        const own = {
+            ecosystem: 'npm',
+            name,
+            version,
+            source: sourceOf(name, version, found.resolved),
+        };
+        return [own, ...fromV1(found.dependencies ?? {})];
+    });
+}
+/** `package-lock.json` and `npm-shrinkwrap.json`: the `packages` map, or v1's nested tree. */
+export function parseNpmLock(text) {
+    const parsed = lockfile.parse(JSON.parse(text));
+    if (parsed.packages !== undefined)
+        return fromPackages(parsed.packages);
+    return fromV1(parsed.dependencies ?? {});
+}
+//# sourceMappingURL=npm.js.map

package/dist/checks/supply/lockfiles/npm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../../../src/checks/supply/lockfiles/npm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,OAAO,EACP,KAAK,EAEL,SAAS,EACT,eAAe,GAEhB,MAAM,aAAa,CAAC;AAQrB,MAAM,OAAO,GAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAC9C,CAAC,CAAC,WAAW,CAAC;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CACH,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE;IAChD,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,cAAc,CAAC;AAErC,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAe,EAAE,QAA4B;IAC3E,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtE,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IACxD,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,QAAyD;IAC7E,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAY,EAAE;QAClE,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO;YACL;gBACE,SAAS,EAAE,KAAK;gBAChB,IAAI;gBACJ,OAAO;gBACP,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC;gBAC/D,GAAG,OAAO;aACX;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,YAA+C;IAC7D,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAY,EAAE;QACtE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;QACzC,MAAM,GAAG,GAAW;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI;YACJ,OAAO;YACP,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC;SAChD,CAAC;QACF,OAAO,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC"}

package/dist/checks/supply/lockfiles/pnpm.js

@@ -0,0 +1,47 @@
+import { parse } from 'yaml';
+import { z } from 'zod';
+import { before, fromFile, fromGit, fromUrl, LOCAL, npmSource, PUBLIC_REGISTRY, splitSpec, } from './locked.js';
+const resolution = z.looseObject({
+    type: z.string().optional(),
+    tarball: z.string().optional(),
+    repo: z.string().optional(),
+    directory: z.string().optional(),
+});
+const entry = z.looseObject({ resolution: resolution.optional(), version: z.string().optional() });
+const lockfile = z.looseObject({ packages: z.record(z.string(), entry).nullish() });
+const PLAIN_VERSION = /^\d[\w.+-]*$/;
+function sourceOf(name, keyVersion, locked) {
+    const found = locked.resolution;
+    if (found?.type === 'git')
+        return fromGit(found.repo ?? keyVersion);
+    if (found?.type === 'directory')
+        return LOCAL;
+    if (found?.tarball !== undefined) {
+        if (found.tarball.startsWith('file:'))
+            return fromFile(found.tarball.slice('file:'.length));
+        if (!PLAIN_VERSION.test(keyVersion))
+            return fromUrl(found.tarball);
+        return npmSource(name, keyVersion, found.tarball);
+    }
+    if (!PLAIN_VERSION.test(keyVersion))
+        return fromUrl(keyVersion);
+    return PUBLIC_REGISTRY;
+}
+/**
+ * `pnpm-lock.yaml` (lockfile versions 6 and 9): every package under `packages`, keyed
+ * `name@version`, where a git or tarball dependency's version is its URL.
+ */
+export function parsePnpmLock(text) {
+    const packages = lockfile.parse(parse(text)).packages ?? {};
+    return Object.entries(packages).map(([key, found]) => {
+        const { name, rest } = splitSpec(key.replace(/^\//, ''));
+        const keyVersion = before(rest, ['(']);
+        return {
+            ecosystem: 'npm',
+            name,
+            version: found.version ?? keyVersion,
+            source: sourceOf(name, keyVersion, found),
+        };
+    });
+}
+//# sourceMappingURL=pnpm.js.map

package/dist/checks/supply/lockfiles/pnpm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm.js","sourceRoot":"","sources":["../../../../src/checks/supply/lockfiles/pnpm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,MAAM,EACN,QAAQ,EACR,OAAO,EACP,OAAO,EACP,KAAK,EAEL,SAAS,EACT,eAAe,EAEf,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,MAAM,UAAU,GAAG,CAAC,CAAC,WAAW,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEnG,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAIpF,MAAM,aAAa,GAAG,cAAc,CAAC;AAErC,SAAS,QAAQ,CAAC,IAAY,EAAE,UAAkB,EAAE,MAAa;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC;IAChC,IAAI,KAAK,EAAE,IAAI,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC;IACpE,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,KAAK,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnE,OAAO,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;IAChE,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC5D,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACnD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,IAAI;YACJ,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,UAAU;YACpC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC;SAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}