@svp-labs/talos 0.0.0 → 0.1.0

package/dist/checks/supply/lockfiles/python.js

@@ -0,0 +1,77 @@
+import { parse } from 'smol-toml';
+import { z } from 'zod';
+import { fromFile, fromGit, fromUrl, LOCAL, PUBLIC_REGISTRY, } from './locked.js';
+const PUBLIC_INDEX = /^https:\/\/pypi\.org\/simple\/?$/;
+const uvSource = z.looseObject({
+    registry: z.string().optional(),
+    git: z.string().optional(),
+    url: z.string().optional(),
+    path: z.string().optional(),
+});
+const uvLock = z.looseObject({
+    package: z
+        .array(z.looseObject({
+        name: z.string(),
+        version: z.string().optional(),
+        source: uvSource.optional(),
+    }))
+        .default([]),
+});
+function uvSourceOf(source) {
+    if (source?.registry !== undefined) {
+        return { kind: 'registry', public: PUBLIC_INDEX.test(source.registry) };
+    }
+    if (source?.git !== undefined)
+        return fromGit(source.git);
+    if (source?.url !== undefined)
+        return fromUrl(source.url);
+    if (source?.path !== undefined)
+        return fromFile(source.path);
+    return LOCAL;
+}
+/** `uv.lock`: each `[[package]]` with its `source` table. */
+export function parseUvLock(text) {
+    return uvLock.parse(parse(text)).package.map((found) => ({
+        ecosystem: 'pypi',
+        name: found.name,
+        version: found.version ?? '0',
+        source: uvSourceOf(found.source),
+    }));
+}
+const poetrySource = z.looseObject({ type: z.string(), url: z.string().default('') });
+const poetryLock = z.looseObject({
+    package: z
+        .array(z.looseObject({ name: z.string(), version: z.string(), source: poetrySource.optional() }))
+        .default([]),
+});
+function poetrySourceOf(source) {
+    if (source === undefined)
+        return PUBLIC_REGISTRY;
+    switch (source.type) {
+        case 'git': {
+            return fromGit(source.url);
+        }
+        case 'file': {
+            return fromFile(source.url);
+        }
+        case 'directory': {
+            return LOCAL;
+        }
+        case 'legacy': {
+            return { kind: 'registry', public: false };
+        }
+        default: {
+            return fromUrl(source.url);
+        }
+    }
+}
+/** `poetry.lock`: a package without a `[package.source]` comes from PyPI. */
+export function parsePoetryLock(text) {
+    return poetryLock.parse(parse(text)).package.map((found) => ({
+        ecosystem: 'pypi',
+        name: found.name,
+        version: found.version,
+        source: poetrySourceOf(found.source),
+    }));
+}
+//# sourceMappingURL=python.js.map

package/dist/checks/supply/lockfiles/python.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.js","sourceRoot":"","sources":["../../../../src/checks/supply/lockfiles/python.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,QAAQ,EACR,OAAO,EACP,OAAO,EACP,KAAK,EAEL,eAAe,GAEhB,MAAM,aAAa,CAAC;AAErB,MAAM,YAAY,GAAG,kCAAkC,CAAC;AAExD,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3B,OAAO,EAAE,CAAC;SACP,KAAK,CACJ,CAAC,CAAC,WAAW,CAAC;QACZ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;KAC5B,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,MAA4C;IAC9D,IAAI,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,EAAE,GAAG,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,MAAM,EAAE,GAAG,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvD,SAAS,EAAE,MAAM;QACjB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,GAAG;QAC7B,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;KACjC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAEtF,MAAM,UAAU,GAAG,CAAC,CAAC,WAAW,CAAC;IAC/B,OAAO,EAAE,CAAC;SACP,KAAK,CACJ,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAC1F;SACA,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,MAAgD;IACtE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IACjD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,SAAS,EAAE,MAAM;QACjB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC;KACrC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/checks/supply/lockfiles/yarn.js

@@ -0,0 +1,77 @@
+import { parse } from 'yaml';
+import { z } from 'zod';
+import { before, fromFile, fromGit, fromUrl, LOCAL, npmSource, PUBLIC_REGISTRY, splitSpec, } from './locked.js';
+function unquote(text) {
+    return text.trim().replace(/^"(.*)"$/, '$1');
+}
+function v1Blocks(text) {
+    const blocks = [];
+    let current;
+    for (const line of text.split(/\r?\n/)) {
+        if (/^[^\s#].*:$/.test(line)) {
+            const first = unquote(line.slice(0, -1).split(', ')[0] ?? '');
+            current = { name: splitSpec(first).name };
+            blocks.push(current);
+            continue;
+        }
+        const field = /^ {2}(version|resolved) (.+)$/.exec(line);
+        if (current !== undefined && field?.[1] !== undefined && field[2] !== undefined) {
+            current[field[1] === 'version' ? 'version' : 'resolved'] = unquote(field[2]);
+        }
+    }
+    return blocks;
+}
+/** Yarn 1's own format: blocks of `version` and `resolved`, a registry URL ending `#<sha1>`. */
+function parseV1(text) {
+    return v1Blocks(text).map((block) => {
+        const version = block.version ?? '0.0.0';
+        const resolved = block.resolved?.replace(/^(https?:.*)#[0-9a-f]{40}$/, '$1');
+        return {
+            ecosystem: 'npm',
+            name: block.name,
+            version,
+            source: resolved === undefined ? PUBLIC_REGISTRY : npmSource(block.name, version, resolved),
+        };
+    });
+}
+const berryEntry = z.looseObject({
+    version: z.string().optional(),
+    resolution: z.string().optional(),
+});
+const LOCAL_PROTOCOLS = ['workspace:', 'portal:', 'link:'];
+/** A Yarn 2+ resolution's protocol: `npm:`, `workspace:`, `patch:` around another, a URL, git. */
+function berrySource(name, version, reference) {
+    if (reference.startsWith('npm:'))
+        return PUBLIC_REGISTRY;
+    if (LOCAL_PROTOCOLS.some((protocol) => reference.startsWith(protocol)))
+        return LOCAL;
+    if (reference.startsWith('patch:')) {
+        const inner = decodeURIComponent(before(reference.slice('patch:'.length), ['#']));
+        return berrySource(name, version, splitSpec(inner).rest);
+    }
+    if (reference.startsWith('file:'))
+        return fromFile(before(reference.slice(5), ['#', ':']));
+    if (/#commit=|\.git(?:#|$)|^(?:git[+:@]|github:)/.test(reference))
+        return fromGit(reference);
+    if (/^https?:/.test(reference))
+        return npmSource(name, version, reference);
+    return fromUrl(reference);
+}
+function parseBerry(text) {
+    const entries = z.record(z.string(), z.unknown()).parse(parse(text));
+    return Object.entries(entries).flatMap(([key, value]) => {
+        if (key === '__metadata')
+            return [];
+        const entry = berryEntry.parse(value);
+        if (entry.resolution === undefined)
+            return [];
+        const { name, rest } = splitSpec(entry.resolution);
+        const version = entry.version ?? '0.0.0';
+        return [{ ecosystem: 'npm', name, version, source: berrySource(name, version, rest) }];
+    });
+}
+/** `yarn.lock` from Yarn 1 or from Yarn 2 and later, which writes YAML. */
+export function parseYarnLock(text) {
+    return /^__metadata:/m.test(text) ? parseBerry(text) : parseV1(text);
+}
+//# sourceMappingURL=yarn.js.map

package/dist/checks/supply/lockfiles/yarn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yarn.js","sourceRoot":"","sources":["../../../../src/checks/supply/lockfiles/yarn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,MAAM,EACN,QAAQ,EACR,OAAO,EACP,OAAO,EACP,KAAK,EAEL,SAAS,EACT,eAAe,EAEf,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAID,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,OAA0B,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9D,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAChF,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gGAAgG;AAChG,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;QACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC;QAC7E,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO;YACP,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC;SAC5F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAC,WAAW,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAE3D,kGAAkG;AAClG,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe,EAAE,SAAiB;IACnE,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,eAAe,CAAC;IACzD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,6CAA6C,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7F,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3E,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAY,EAAE;QAChE,IAAI,GAAG,KAAK,YAAY;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAC9C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;QACzC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC"}

package/dist/checks/supply/pnpm-settings.js

@@ -0,0 +1,95 @@
+import { readFile } from 'node:fs/promises';
+import { join, posix } from 'node:path';
+import { parse } from 'yaml';
+import { z } from 'zod';
+/** The minimum release age pnpm must hold, in minutes: a day. */
+const MIN_RELEASE_AGE_MINUTES = 1440;
+const workspace = z.looseObject({
+    minimumReleaseAge: z.coerce.number().optional(),
+    blockExoticSubdeps: z.boolean().optional(),
+    trustPolicy: z.string().optional(),
+});
+/** `.npmrc` is `key=value` lines; `#` and `;` start comments. */
+function npmrcValues(text) {
+    const values = new Map();
+    for (const line of text.split(/\r?\n/)) {
+        const equals = line.indexOf('=');
+        const key = line.slice(0, Math.max(equals, 0)).trim();
+        if (equals > 0 && /^[\w.-]+$/.test(key))
+            values.set(key, line.slice(equals + 1).trim());
+    }
+    return values;
+}
+function fromNpmrc(values) {
+    const age = values.get('minimum-release-age');
+    const exotic = values.get('block-exotic-subdeps');
+    const trust = values.get('trust-policy');
+    return {
+        ...(age === undefined || Number.isNaN(Number(age)) ? {} : { minimumReleaseAge: Number(age) }),
+        ...(exotic === undefined ? {} : { blockExoticSubdeps: exotic === 'true' }),
+        ...(trust === undefined ? {} : { trustPolicy: trust }),
+    };
+}
+function fromWorkspace(text) {
+    if (text === undefined)
+        return {};
+    try {
+        const parsed = workspace.safeParse(parse(text) ?? {});
+        if (!parsed.success)
+            return {};
+        const { minimumReleaseAge, blockExoticSubdeps, trustPolicy } = parsed.data;
+        return {
+            ...(minimumReleaseAge === undefined ? {} : { minimumReleaseAge }),
+            ...(blockExoticSubdeps === undefined ? {} : { blockExoticSubdeps }),
+            ...(trustPolicy === undefined ? {} : { trustPolicy }),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+/** pnpm reads its settings from `pnpm-workspace.yaml`, which wins over `.npmrc`. */
+export function pnpmSettings(workspaceText, npmrcText) {
+    return { ...fromNpmrc(npmrcValues(npmrcText ?? '')), ...fromWorkspace(workspaceText) };
+}
+async function maybeRead(path) {
+    try {
+        return await readFile(path, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The settings pnpm applies to the project whose lockfile is at `lockfile`. */
+export async function pnpmSettingsAt(root, lockfile) {
+    const dir = join(root, posix.dirname(lockfile));
+    const [workspaceText, npmrcText] = await Promise.all([
+        maybeRead(join(dir, 'pnpm-workspace.yaml')),
+        maybeRead(join(dir, '.npmrc')),
+    ]);
+    return pnpmSettings(workspaceText, npmrcText);
+}
+/** What each pnpm guard needs, and what goes wrong without it. */
+export const PNPM_GUARDS = [
+    {
+        setting: 'minimumReleaseAge',
+        holds: (s) => (s.minimumReleaseAge ?? 0) >= MIN_RELEASE_AGE_MINUTES,
+        wanted: `minimumReleaseAge: ${MIN_RELEASE_AGE_MINUTES}`,
+        risk: 'pnpm would install a release less than a day old',
+    },
+    {
+        setting: 'blockExoticSubdeps',
+        holds: (s) => s.blockExoticSubdeps === true,
+        wanted: 'blockExoticSubdeps: true',
+        risk: 'a dependency of a dependency could come from git or a tarball URL',
+    },
+    {
+        setting: 'trustPolicy',
+        holds: (s) => s.trustPolicy === 'no-downgrade',
+        wanted: 'trustPolicy: no-downgrade',
+        risk: 'pnpm would install a release with less provenance than the ones before it',
+    },
+];
+/** pnpm refuses a provenance downgrade itself only under `trustPolicy: no-downgrade`. */
+export const enforcesTrust = (settings) => settings.trustPolicy === 'no-downgrade';
+//# sourceMappingURL=pnpm-settings.js.map

package/dist/checks/supply/pnpm-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm-settings.js","sourceRoot":"","sources":["../../../src/checks/supply/pnpm-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,iEAAiE;AACjE,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAQrC,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC;IAC9B,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/C,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,iEAAiE;AACjE,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,MAAmC;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzC,OAAO;QACL,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1E,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAwB;IAC7C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAC/B,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC3E,OAAO;YACL,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC;YACjE,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC;YACnE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAAC,aAAiC,EAAE,SAA6B;IAC3F,OAAO,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,QAAgB;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;KAC/B,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,WAAW,GAKlB;IACJ;QACE,OAAO,EAAE,mBAAmB;QAC5B,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,IAAI,uBAAuB;QACnE,MAAM,EAAE,sBAAsB,uBAAuB,EAAE;QACvD,IAAI,EAAE,kDAAkD;KACzD;IACD;QACE,OAAO,EAAE,oBAAoB;QAC7B,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,KAAK,IAAI;QAC3C,MAAM,EAAE,0BAA0B;QAClC,IAAI,EAAE,mEAAmE;KAC1E;IACD;QACE,OAAO,EAAE,aAAa;QACtB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,cAAc;QAC9C,MAAM,EAAE,2BAA2B;QACnC,IAAI,EAAE,2EAA2E;KAClF;CACF,CAAC;AAEF,yFAAyF;AACzF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAsB,EAAW,EAAE,CAC/D,QAAQ,CAAC,WAAW,KAAK,cAAc,CAAC"}

package/dist/checks/supply/provenance.js

@@ -0,0 +1,82 @@
+import { posix } from 'node:path';
+import { inPool } from './fetcher.js';
+import { judgedLockfiles } from './judged.js';
+import { isPublic, spec } from './lockfiles/index.js';
+import { enforcesTrust, pnpmSettingsAt } from './pnpm-settings.js';
+import { npmPackage } from './registries.js';
+import { APPLIES, skip } from '../../core/check.js';
+const NPM_LOCKFILES = new Set([
+    'pnpm-lock.yaml',
+    'package-lock.json',
+    'npm-shrinkwrap.json',
+    'yarn.lock',
+]);
+const TRUST = {
+    0: 'neither provenance nor a trusted publisher',
+    1: 'a provenance attestation',
+    2: 'a trusted publisher',
+};
+/** The most trust any release of the package published before `version` had. */
+export function earlierTrust(found, version) {
+    const published = found.published.get(version);
+    if (published === undefined)
+        return 0;
+    let most = 0;
+    for (const [other, when] of found.published) {
+        const trust = found.trust.get(other) ?? 0;
+        if (when.getTime() < published.getTime() && trust > most)
+            most = trust;
+    }
+    return most;
+}
+async function downgrade(lookup, path, locked) {
+    const found = await npmPackage(lookup, locked.name);
+    if (found?.published.get(locked.version) === undefined)
+        return [];
+    const own = found.trust.get(locked.version) ?? 0;
+    const before = earlierTrust(found, locked.version);
+    if (own >= before)
+        return [];
+    return [
+        {
+            rule: 'supply/provenance-downgrade',
+            key: spec(locked),
+            message: `${spec(locked)} in ${path} was published with ${TRUST[own]}, though an earlier release ` +
+                `of ${locked.name} had ${TRUST[before]}; a hijacked release often shows this way.`,
+        },
+    ];
+}
+async function judgedHere(ctx) {
+    const files = (await judgedLockfiles(ctx)).filter((f) => NPM_LOCKFILES.has(posix.basename(f.path)));
+    const kept = await Promise.all(files.map(async (file) => {
+        if (posix.basename(file.path) !== 'pnpm-lock.yaml')
+            return true;
+        return !enforcesTrust(await pnpmSettingsAt(ctx.root, file.path));
+    }));
+    return files.filter((_, index) => kept[index] === true);
+}
+/**
+ * npm versions published with less provenance than an earlier release of the same package had,
+ * where the package manager doesn't refuse them itself (pnpm's `trustPolicy: no-downgrade` does).
+ */
+export function provenanceCheck(deps) {
+    return {
+        id: 'supply/provenance',
+        tier: 'head',
+        scope: 'repo',
+        title: 'no npm release with weaker provenance than the releases before it',
+        applies: (ctx) => ctx.facts.has(...[...NPM_LOCKFILES].map((name) => `**/${name}`))
+            ? APPLIES
+            : skip('the repository has no npm lockfile'),
+        run: async (ctx) => {
+            const lookup = { fetcher: deps.fetcher, memo: ctx.memo };
+            const files = await judgedHere(ctx);
+            const found = await Promise.all(files.map(async (file) => {
+                const npm = file.judged.filter((l) => l.ecosystem === 'npm' && isPublic(l));
+                return (await inPool(npm, 8, (locked) => downgrade(lookup, file.path, locked))).flat();
+            }));
+            return found.flat();
+        },
+    };
+}
+//# sourceMappingURL=provenance.js.map

package/dist/checks/supply/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../../src/checks/supply/provenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,MAAM,EAAe,MAAM,cAAc,CAAC;AACnD,OAAO,EAAe,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAe,IAAI,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAmB,UAAU,EAAc,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAiC,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAGnF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,gBAAgB;IAChB,mBAAmB;IACnB,qBAAqB;IACrB,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,KAAK,GAAoC;IAC7C,CAAC,EAAE,4CAA4C;IAC/C,CAAC,EAAE,0BAA0B;IAC7B,CAAC,EAAE,qBAAqB;CACzB,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,KAAiB,EAAE,OAAe;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,GAAU,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,KAAK,GAAG,IAAI;YAAE,IAAI,GAAG,KAAK,CAAC;IACzE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;IACnE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,GAAG,IAAI,MAAM;QAAE,OAAO,EAAE,CAAC;IAC7B,OAAO;QACL;YACE,IAAI,EAAE,6BAA6B;YACnC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;YACjB,OAAO,EACL,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,uBAAuB,KAAK,CAAC,GAAG,CAAC,8BAA8B;gBACzF,MAAM,MAAM,CAAC,IAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,4CAA4C;SACrF;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAiB;IACzC,MAAM,KAAK,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAC1C,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,CAAC,aAAa,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAgB;IAC9C,OAAO;QACL,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,mEAAmE;QAC1E,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;QAChD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACvB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5E,OAAO,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzF,CAAC,CAAC,CACH,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/supply/registries.js

@@ -0,0 +1,109 @@
+import { z } from 'zod';
+import { getJson, getText } from './fetcher.js';
+import { EngineError } from '../../core/check.js';
+const npmDocument = z.looseObject({
+    time: z.record(z.string(), z.string()).default({}),
+    versions: z
+        .record(z.string(), z.looseObject({
+        dist: z.looseObject({ attestations: z.looseObject({}).optional() }).optional(),
+        _npmUser: z.looseObject({ trustedPublisher: z.unknown().optional() }).optional(),
+    }))
+        .default({}),
+});
+function dated(entries) {
+    const dates = new Map();
+    for (const [version, when] of entries) {
+        const date = when === undefined ? undefined : new Date(when);
+        if (date !== undefined && !Number.isNaN(date.getTime()))
+            dates.set(version, date);
+    }
+    return dates;
+}
+/** An npm package's publish times and trust levels, or `undefined` when npm doesn't know it. */
+export async function npmPackage(lookup, name) {
+    return lookup.memo(`supply/npm/${name}`, async () => {
+        const url = `https://registry.npmjs.org/${name.replace('/', '%2F')}`;
+        const raw = await getJson(lookup.fetcher, { url }, `npm's registry (${name})`);
+        if (raw === undefined)
+            return undefined;
+        const parsed = npmDocument.parse(raw);
+        const trust = new Map();
+        for (const [version, manifest] of Object.entries(parsed.versions)) {
+            const level = manifest.dist?.attestations === undefined ? 0 : 1;
+            trust.set(version, manifest._npmUser?.trustedPublisher === undefined ? level : 2);
+        }
+        return { published: dated(Object.entries(parsed.time)), trust };
+    });
+}
+const pypiRelease = z.looseObject({
+    urls: z.array(z.looseObject({ upload_time_iso_8601: z.string() })).default([]),
+});
+async function pypiPublished(lookup, name, version) {
+    const url = `https://pypi.org/pypi/${encodeURIComponent(name)}/${encodeURIComponent(version)}/json`;
+    const raw = await getJson(lookup.fetcher, { url }, `PyPI (${name})`);
+    if (raw === undefined)
+        return undefined;
+    const times = pypiRelease.parse(raw).urls.map((file) => new Date(file.upload_time_iso_8601));
+    const first = Math.min(...times.map((time) => time.getTime()));
+    return Number.isFinite(first) ? new Date(first) : undefined;
+}
+const packagist = z.looseObject({
+    packages: z.record(z.string(), z.array(z.looseObject({ version: z.string().optional(), time: z.string().optional() }))),
+});
+/** Packagist's minified metadata leaves out a field that repeats the previous version's. */
+async function packagistTimes(lookup, name) {
+    return lookup.memo(`supply/packagist/${name}`, async () => {
+        const url = `https://repo.packagist.org/p2/${name}.json`;
+        const raw = await getJson(lookup.fetcher, { url }, `Packagist (${name})`);
+        if (raw === undefined)
+            return new Map();
+        const entries = [];
+        let time;
+        for (const release of packagist.parse(raw).packages[name] ?? []) {
+            time = release.time ?? time;
+            if (release.version !== undefined)
+                entries.push([release.version.replace(/^v/, ''), time]);
+        }
+        return dated(entries);
+    });
+}
+/** The sparse index's path for a crate: `1/a`, `2/ab`, `3/a/abc`, `ab/cd/abcd…`. */
+export function crateIndexPath(name) {
+    const lower = name.toLowerCase();
+    if (lower.length <= 2)
+        return `${lower.length}/${lower}`;
+    if (lower.length === 3)
+        return `3/${lower.charAt(0)}/${lower}`;
+    return `${lower.slice(0, 2)}/${lower.slice(2, 4)}/${lower}`;
+}
+const crateLine = z.looseObject({ vers: z.string(), pubtime: z.string().optional() });
+function crateEntry(line) {
+    let raw;
+    try {
+        raw = JSON.parse(line);
+    }
+    catch {
+        throw new EngineError('the crates.io index answered with a line that is not JSON');
+    }
+    const entry = crateLine.parse(raw);
+    return [entry.vers, entry.pubtime];
+}
+async function crateTimes(lookup, name) {
+    return lookup.memo(`supply/crates/${name}`, async () => {
+        const url = `https://index.crates.io/${crateIndexPath(name)}`;
+        const body = await getText(lookup.fetcher, { url }, `the crates.io index (${name})`);
+        const lines = (body ?? '').split('\n').filter((line) => line.trim() !== '');
+        return dated(lines.map((line) => crateEntry(line)));
+    });
+}
+const PUBLISHED = {
+    npm: async (lookup, name, version) => (await npmPackage(lookup, name))?.published.get(version),
+    pypi: pypiPublished,
+    packagist: async (lookup, name, version) => (await packagistTimes(lookup, name)).get(version.replace(/^v/, '')),
+    crates: async (lookup, name, version) => (await crateTimes(lookup, name)).get(version),
+};
+/** When the public registry published a locked version; `undefined` when it doesn't know it. */
+export async function publishedAt(lookup, locked) {
+    return PUBLISHED[locked.ecosystem](lookup, locked.name, locked.version);
+}
+//# sourceMappingURL=registries.js.map

package/dist/checks/supply/registries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registries.js","sourceRoot":"","sources":["../../../src/checks/supply/registries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAe,MAAM,cAAc,CAAC;AAE7D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAalD,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,QAAQ,EAAE,CAAC;SACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,WAAW,CAAC;QACZ,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC9E,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;KACjF,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAEH,SAAS,KAAK,CAAC,OAA2D;IACxE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IACtC,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,IAAY;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,GAAG,GAAG,8BAA8B,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,mBAAmB,IAAI,GAAG,CAAC,CAAC;QAC/E,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;QACvC,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/E,CAAC,CAAC;AAEH,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;IACxE,MAAM,GAAG,GAAG,yBAAyB,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC;IACpG,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC;IACrE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAChB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CACxF;CACF,CAAC,CAAC;AAEH,4FAA4F;AAC5F,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,IAAY;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,GAAG,GAAG,iCAAiC,IAAI,OAAO,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,cAAc,IAAI,GAAG,CAAC,CAAC;QAC1E,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,GAAG,EAAgB,CAAC;QACtD,MAAM,OAAO,GAAmC,EAAE,CAAC;QACnD,IAAI,IAAwB,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAChE,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;YAC5B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;IACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;IAC/D,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEtF,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,2DAA2D,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,IAAY;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,GAAG,GAAG,2BAA2B,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,wBAAwB,IAAI,GAAG,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,SAAS,GAEX;IACF,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;IAC9F,IAAI,EAAE,aAAa;IACnB,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CACzC,CAAC,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;CACvF,CAAC;AAEF,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,MAAc;IAC9D,OAAO,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC"}

package/dist/checks/supply/release-age.js

@@ -0,0 +1,63 @@
+import { fixesFor } from './advisories.js';
+import { expired, hoursBetween, youngerThanADay } from './dates.js';
+import { hasLockfile } from './deps.js';
+import { inPool } from './fetcher.js';
+import { judgedLockfiles } from './judged.js';
+import { isPublic, spec } from './lockfiles/index.js';
+import { publishedAt } from './registries.js';
+function allowed(config, locked, now) {
+    const entry = config.supply_chain.allow[spec(locked)];
+    return entry !== undefined && !expired(entry, now);
+}
+/** The fast lane: the young release is the fixed version of an advisory against one it replaces. */
+async function fixesAnAdvisory(lookup, file, locked) {
+    const replaced = file.replaced.get(locked.name) ?? [];
+    const fixes = await fixesFor(lookup, locked.ecosystem, locked.name, replaced);
+    return fixes.has(locked.version) || fixes.has(locked.version.replace(/^v/, ''));
+}
+function finding(file, young, now) {
+    const hours = hoursBetween(young.published, now);
+    return {
+        rule: 'supply/young-release',
+        key: spec(young.locked),
+        message: `${spec(young.locked)} in ${file.path} was published ${hours} hours ago; a release must be a ` +
+            'day old unless it fixes an advisory against the version it replaces or ' +
+            'supply_chain.allow lists it.',
+    };
+}
+async function youngIn(file, lookup, deps, config) {
+    const now = deps.now();
+    const dated = await inPool(file.judged.filter(isPublic), 8, async (locked) => ({
+        locked,
+        published: await publishedAt(lookup, locked),
+    }));
+    const young = dated.filter((entry) => entry.published !== undefined && youngerThanADay(entry.published, now));
+    const findings = [];
+    for (const entry of young.filter((y) => !allowed(config, y.locked, now))) {
+        if (!(await fixesAnAdvisory(lookup, file, entry.locked))) {
+            findings.push(finding(file, entry, now));
+        }
+    }
+    return findings;
+}
+/**
+ * Every locked version a public registry published at least a day before the check runs. In a
+ * comparison only the versions the change adds are judged, so a release that was young when it
+ * landed is never held against a later change.
+ */
+export function releaseAgeCheck(deps) {
+    return {
+        id: 'supply/release-age',
+        tier: 'head',
+        scope: 'repo',
+        title: 'every locked release at least a day old, or a fix for an advisory',
+        applies: hasLockfile,
+        run: async (ctx) => {
+            const lookup = { fetcher: deps.fetcher, memo: ctx.memo };
+            const files = await judgedLockfiles(ctx);
+            const found = await Promise.all(files.map((file) => youngIn(file, lookup, deps, ctx.config)));
+            return found.flat();
+        },
+    };
+}
+//# sourceMappingURL=release-age.js.map

package/dist/checks/supply/release-age.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-age.js","sourceRoot":"","sources":["../../../src/checks/supply/release-age.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,WAAW,EAAmB,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,MAAM,EAAe,MAAM,cAAc,CAAC;AACnD,OAAO,EAAe,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAe,IAAI,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAO9C,SAAS,OAAO,CAAC,MAAmB,EAAE,MAAc,EAAE,GAAS;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,KAAY,EAAE,GAAS;IACpD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACvB,OAAO,EACL,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,kBAAkB,KAAK,kCAAkC;YAC9F,yEAAyE;YACzE,8BAA8B;KACjC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,MAAc,EAAE,IAAgB,EAAE,MAAmB;IACxF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,MAAM;QACN,SAAS,EAAE,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;KAC7C,CAAC,CAAC,CAAC;IACJ,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CACxB,CAAC,KAAK,EAAkB,EAAE,CACxB,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CACzE,CAAC;IACF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAgB;IAC9C,OAAO;QACL,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,mEAAmE;QAC1E,OAAO,EAAE,WAAW;QACpB,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9F,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}