@xagents_in/unmask 0.1.2 → 0.1.3

package/dist/core/report-exploration.mjs

@@ -0,0 +1,328 @@
+import { createHash } from "node:crypto";
+
+const states = new Map([
+  ["changed", "changed"],
+  ["artifact-only", "added"],
+  ["byte-identical", "identical"],
+  ["not-compared", "not-compared"],
+]);
+const digest = (value) => (/^[a-f0-9]{64}$/.test(value ?? "") ? value : null);
+const order = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+export const EXPLORATION_BYTE_LIMIT = 131072;
+export const explorationLimitations = [
+  "States compare artifact and selected source, not releases or version history.",
+  "Source-only paths are recorded observations; their hashes, file types and excerpts may be unavailable.",
+  "Incomplete inventories and unassessed files do not establish safety or absence.",
+];
+
+export function safeExplorationPath(value, { prefix = false } = {}) {
+  if (
+    typeof value !== "string" ||
+    value.length > 4096 ||
+    /[\x00-\x1f\x7f\\%:]/.test(value)
+  )
+    return false;
+  if (prefix && value === "") return true;
+  const parts = (
+    prefix && value.endsWith("/") ? value.slice(0, -1) : value
+  ).split("/");
+  return parts.every((part) => part && part !== "." && part !== "..");
+}
+
+export function explorationJson(value) {
+  return JSON.stringify(value).replace(
+    /[<>&\u2028\u2029]/g,
+    (character) =>
+      `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`,
+  );
+}
+
+export function reportFileRows(report, { reportId } = {}) {
+  if (reportId !== undefined && !/^[a-f0-9]{32}$/.test(reportId))
+    throw new TypeError("Invalid report identity");
+  const rows = [];
+  const paths = new Set();
+  let omitted = 0;
+  for (const file of report.files ?? []) {
+    if (
+      !states.has(file.state) ||
+      !safeExplorationPath(file.originalPath) ||
+      (file.path !== null && !safeExplorationPath(file.path))
+    ) {
+      omitted++;
+      continue;
+    }
+    if (file.path !== null) paths.add(file.path);
+    rows.push({
+      path: file.path,
+      originalPath: file.originalPath,
+      state: states.get(file.state),
+      comparisonState: file.state,
+      size:
+        Number.isSafeInteger(file.size) && file.size >= 0 ? file.size : null,
+      artifactSha256: digest(file.artifactSha256),
+      sourceSha256: digest(file.sourceSha256),
+      reason:
+        typeof file.reason === "string" ? file.reason.slice(0, 128) : null,
+    });
+  }
+  for (const path of new Set(report.coverage?.sourceOnly ?? [])) {
+    if (!safeExplorationPath(path)) {
+      omitted++;
+      continue;
+    }
+    if (paths.has(path)) continue;
+    rows.push({
+      path,
+      originalPath: null,
+      state: "removed",
+      comparisonState: "source-only",
+      size: null,
+      artifactSha256: null,
+      sourceSha256: null,
+      reason: "recorded-source-only",
+    });
+  }
+  rows.sort(
+    (a, b) =>
+      order(a.path ?? a.originalPath, b.path ?? b.originalPath) ||
+      order(a.originalPath ?? "", b.originalPath ?? ""),
+  );
+  if (reportId !== undefined)
+    for (const file of rows) {
+      file.fileId = `f-${createHash("sha256")
+        .update(
+          JSON.stringify([
+            "unmask-file-id-v1",
+            reportId,
+            file.path,
+            file.originalPath,
+          ]),
+        )
+        .digest("base64url")}`;
+    }
+  return { rows, omitted };
+}
+
+export function buildReportFileInventory(
+  report,
+  { state = "all", prefix = "", offset = 0, limit = 50 } = {},
+  context = {},
+) {
+  if (
+    !["all", "removed", ...states.values()].includes(state) ||
+    !safeExplorationPath(prefix, { prefix: true }) ||
+    !Number.isSafeInteger(offset) ||
+    offset < 0 ||
+    !Number.isSafeInteger(limit) ||
+    limit < 1 ||
+    limit > 100
+  )
+    throw new TypeError("Invalid inventory query");
+  const { rows, omitted } = reportFileRows(report, context);
+  const filtered = rows.filter(
+    (file) =>
+      (state === "all" || file.state === state) &&
+      (file.path ?? file.originalPath).startsWith(prefix),
+  );
+  const files = [];
+  let bytes = 0;
+  for (const file of filtered.slice(offset, offset + limit)) {
+    const size = Buffer.byteLength(explorationJson(file)) + 1;
+    if (
+      bytes + size >
+      EXPLORATION_BYTE_LIMIT -
+        Buffer.byteLength(explorationJson({ prefix })) -
+        8192
+    )
+      break;
+    bytes += size;
+    files.push(file);
+  }
+  return {
+    schemaVersion: "1",
+    scope: "artifact-source",
+    state,
+    prefix,
+    offset,
+    limit,
+    total: filtered.length,
+    files,
+    nextOffset:
+      offset + files.length < filtered.length ? offset + files.length : null,
+    omittedUnsafePaths: omitted,
+    inventoryComplete: report.coverage?.inventory?.complete === true,
+    sourceComplete: report.coverage?.sourceComplete === true,
+    limitations: explorationLimitations,
+  };
+}
+
+function validRange(value, size) {
+  return (
+    Array.isArray(value) &&
+    value.length === 2 &&
+    value.every((number) => Number.isSafeInteger(number) && number >= 0) &&
+    value[0] <= value[1] &&
+    value[1] <= size
+  );
+}
+
+function recordedExcerpt(item) {
+  const unavailable = {
+    excerpt: null,
+    excerptRange: null,
+    recordedExcerptRange: null,
+    excerptTruncated: false,
+    excerptStatus: "not-recorded",
+  };
+  if (item.excerpt === undefined) return unavailable;
+  if (
+    typeof item.excerpt !== "string" ||
+    !validRange(item.excerptRange, item.size) ||
+    item.excerptRange[0] !== item.range[0] ||
+    item.excerptRange[1] > item.range[1] ||
+    Buffer.byteLength(item.excerpt) !==
+      item.excerptRange[1] - item.excerptRange[0]
+  )
+    return { ...unavailable, excerptStatus: "invalid-recorded-range" };
+  let excerpt = "",
+    bytes = 0;
+  for (const character of item.excerpt) {
+    const size = Buffer.byteLength(character);
+    if (bytes + size > 2048) break;
+    bytes += size;
+    excerpt += character;
+  }
+  return {
+    excerpt,
+    excerptRange: [item.excerptRange[0], item.excerptRange[0] + bytes],
+    recordedExcerptRange: item.excerptRange,
+    excerptTruncated: bytes < Buffer.byteLength(item.excerpt),
+    excerptStatus: "recorded",
+  };
+}
+
+export function buildReportFileEvidence(report, selection, context = {}) {
+  const keys = Object.keys(selection ?? {});
+  if (
+    keys.length !== 1 ||
+    !["path", "originalPath", "fileId"].includes(keys[0]) ||
+    (keys[0] === "fileId"
+      ? !/^[a-f0-9]{32}$/.test(context.reportId ?? "") ||
+        !/^f-[A-Za-z0-9_-]{43}$/.test(selection.fileId)
+      : !safeExplorationPath(selection[keys[0]]))
+  )
+    throw new TypeError("Invalid file selection");
+  const { rows } = reportFileRows(report, context);
+  const matches = rows.filter((file) =>
+    keys[0] === "fileId"
+      ? file.fileId === selection.fileId
+      : keys[0] === "path"
+        ? file.path === selection.path
+        : file.path === null && file.originalPath === selection.originalPath,
+  );
+  if (matches.length !== 1) return null;
+  const file = matches[0];
+  const rawFile = (report.files ?? []).find(
+    (item) =>
+      item.path === file.path && item.originalPath === file.originalPath,
+  );
+  const samePathEvidence = (report.evidence ?? []).filter((item) =>
+    file.path === null
+      ? item.side === "artifact" &&
+        item.path === null &&
+        item.originalPath === file.originalPath
+      : item.path === file.path &&
+        (file.state !== "removed" || item.side === "source"),
+  );
+  if (file.state === "removed") {
+    const hashes = new Set(
+      samePathEvidence
+        .filter(
+          (item) =>
+            digest(item.fileSha256) &&
+            digest(item.blobDigest) &&
+            item.blobDigest === report.inputs?.sourceArchive?.sha256,
+        )
+        .map((item) => item.fileSha256),
+    );
+    if (hashes.size === 1) file.sourceSha256 = [...hashes][0];
+  }
+  const candidateIds = new Set([
+    ...(rawFile?.evidenceIds ?? []),
+    ...samePathEvidence.map((item) => item.id),
+  ]);
+  const result = {
+    schemaVersion: "1",
+    scope: "artifact-source",
+    file,
+    recordedOnly: true,
+    evidence: [],
+    evidenceStatus: "unavailable",
+    evidenceOmitted: 0,
+    invalidEvidenceOmitted: 0,
+    limitations: [
+      ...explorationLimitations,
+      "Only previously recorded excerpts are returned; omitted text is not fetched or reconstructed. Hashes are recorded claims, not new artifact verification. Render excerpts as text, never HTML.",
+    ],
+  };
+  const evidenceById = new Map();
+  for (const item of report.evidence ?? [])
+    evidenceById.set(item.id, evidenceById.has(item.id) ? null : item);
+  let bytes = Buffer.byteLength(explorationJson(result));
+  for (const id of candidateIds) {
+    const item = evidenceById.get(id);
+    const expectedHash =
+      item?.side === "artifact" ? file.artifactSha256 : file.sourceSha256;
+    const input =
+      item?.side === "artifact"
+        ? report.inputs?.artifact
+        : report.inputs?.sourceArchive;
+    if (
+      !item ||
+      !/^ev-[a-f0-9]{64}$/.test(id) ||
+      !["artifact", "source"].includes(item.side) ||
+      item.path !== file.path ||
+      !safeExplorationPath(item.originalPath) ||
+      (item.side === "artifact" &&
+        (item.originalPath !== file.originalPath || item.size !== file.size)) ||
+      !expectedHash ||
+      item.fileSha256 !== expectedHash ||
+      !digest(item.blobDigest) ||
+      item.blobDigest !== input?.sha256 ||
+      !Number.isSafeInteger(item.size) ||
+      item.size < 0 ||
+      !validRange(item.range, item.size)
+    ) {
+      result.invalidEvidenceOmitted++;
+      continue;
+    }
+    const evidence = {
+      id,
+      side: item.side,
+      path: item.path,
+      originalPath: item.originalPath,
+      fileSha256: item.fileSha256,
+      blobDigest: item.blobDigest,
+      size: item.size,
+      range: item.range,
+      ...recordedExcerpt(item),
+    };
+    const size = Buffer.byteLength(explorationJson(evidence)) + 1;
+    if (
+      result.evidence.length >= 32 ||
+      bytes + size > EXPLORATION_BYTE_LIMIT - 2048
+    ) {
+      result.evidenceOmitted++;
+      continue;
+    }
+    bytes += size;
+    result.evidence.push(evidence);
+  }
+  if (result.evidence.length)
+    result.evidenceStatus =
+      result.evidenceOmitted || result.invalidEvidenceOmitted
+        ? "partial"
+        : "recorded";
+  return result;
+}

package/dist/server/app.mjs

@@ -1,8 +1,10 @@
 import { createServer } from "node:http";
+import { createRegistryFactsHandler } from "./registry-facts.mjs";
 import { buildPackageDetails } from "../core/package-details.mjs";
 import { attachVulnerabilityCheck } from "./enrichment.mjs";
 import { createQueue, resolveLimits, systemClock } from "./queue.mjs";
 import { createReportStore } from "./store.mjs";
+import { handleReportExploration } from "./report-exploration.mjs";
 import { renderReport } from "../viewer/render.mjs";
 import {
   renderHome,
@@ -105,6 +107,7 @@ export function createApp({
   versionInfo,
   limits: overrides,
   clock = systemClock,
+  registryFacts = {},
 } = {}) {
   if (typeof runAnalysis !== "function")
     throw new TypeError("runAnalysis is required");
@@ -119,6 +122,7 @@ export function createApp({
     );
   if (enrichJob !== undefined && typeof enrichJob !== "function")
     throw new TypeError("enrichJob must be a function");
+  const registryFactsHandler = createRegistryFactsHandler(registryFacts);
   const limits = resolveLimits(overrides);
   const version = Object.fromEntries(
     ["version", "commit", "tarballSha256"].map((key) => [
@@ -174,6 +178,7 @@ export function createApp({
       }
       async function handle() {
         const path = req.url;
+        if (await registryFactsHandler(req, json)) return;
         if (path === "/check") {
           if (req.method !== "POST")
             return error(
@@ -257,6 +262,7 @@ export function createApp({
             "Use the release form to start a check.",
             { allow: "GET" },
           );
+        if (handleReportExploration({ path, getJob: queue.get, send })) return;
         if (path === "/") return send(200, renderHome());
         if (path === "/healthz") return json(200, { status: "ok" });
         if (path === "/version") return json(200, version);

package/dist/server/registry-facts.mjs

@@ -0,0 +1,118 @@
+import {
+  getRegistryFacts,
+  getRegistryHistory,
+  registryIdentity,
+} from "../core/registry-facts.mjs";
+
+export function createRegistryFactsHandler(options = {}) {
+  const maxConcurrent = options.maxConcurrent ?? 2;
+  const maxRequests = options.maxRequests ?? 30;
+  if (
+    !Number.isSafeInteger(maxConcurrent) ||
+    maxConcurrent < 1 ||
+    maxConcurrent > 2 ||
+    !Number.isSafeInteger(maxRequests) ||
+    maxRequests < 1 ||
+    maxRequests > 30
+  )
+    throw new TypeError("Invalid registry lookup admission limits");
+  let active = 0,
+    used = 0,
+    windowStart = Date.now();
+  return async function handleRegistryFacts(req, json) {
+    const url = new URL(req.url, "http://localhost");
+    const history = url.pathname === "/api/registry/history";
+    if (url.pathname !== "/api/registry/facts" && !history) return false;
+    if (req.method !== "GET") {
+      json(
+        405,
+        { status: "rejected", reason: "method-not-allowed" },
+        { allow: "GET" },
+      );
+      return true;
+    }
+    const spec = url.searchParams.get("package");
+    let limit = 20;
+    try {
+      const allowed = history ? ["package", "limit"] : ["package"];
+      if (
+        !spec ||
+        [...url.searchParams.keys()].some((key) => !allowed.includes(key)) ||
+        allowed.some((key) => url.searchParams.getAll(key).length > 1)
+      )
+        throw new Error();
+      if (history) {
+        registryIdentity(`${spec}@0.0.0`);
+        if (url.searchParams.has("limit")) {
+          const raw = url.searchParams.get("limit");
+          if (!/^[1-9]\d{0,2}$/.test(raw)) throw new Error();
+          limit = Number(raw);
+          if (limit > 100) throw new Error();
+        }
+      } else registryIdentity(spec);
+    } catch {
+      json(400, {
+        status: "rejected",
+        reason: history
+          ? "package-name-and-bounded-limit-required"
+          : "exact-package-required",
+      });
+      return true;
+    }
+    const now = Date.now();
+    if (now - windowStart >= 60000) {
+      used = 0;
+      windowStart = now;
+    }
+    if (active >= maxConcurrent || used >= maxRequests) {
+      json(
+        429,
+        { status: "unavailable", reason: "registry-lookup-limit" },
+        {
+          "retry-after": String(
+            Math.max(1, Math.ceil((60000 - (now - windowStart)) / 1000)),
+          ),
+        },
+      );
+      return true;
+    }
+    used++;
+    active++;
+    try {
+      json(
+        200,
+        history
+          ? await getRegistryHistory(spec, { ...options, limit })
+          : await getRegistryFacts(spec, options),
+      );
+    } catch (error) {
+      const reason = [
+        "acquisition-timeout",
+        "response-cap",
+        "redirect-refused",
+        "invalid-registry-document",
+        "registry-identity-mismatch",
+        "http-status",
+        "network-failure",
+        "invalid-response",
+        "registry-history-cap",
+      ].includes(error.code)
+        ? error.code
+        : "registry-unavailable";
+      const status =
+        reason === "acquisition-timeout"
+          ? 504
+          : error.observation?.status === 404
+            ? 404
+            : 502;
+      json(status, {
+        status: "unavailable",
+        reason,
+        safetyVerdict: "not-provided",
+      });
+    } finally {
+      active--;
+    }
+    return true;
+  };
+}

package/dist/server/report-exploration.mjs

@@ -0,0 +1,87 @@
+import {
+  buildReportFileInventory,
+  buildReportFileEvidence,
+  explorationJson,
+} from "../core/report-exploration.mjs";
+
+function queryParameters(raw, allowed) {
+  if (raw.length > 16384) throw new TypeError("Query too long");
+  decodeURIComponent(raw.replace(/\+/g, " "));
+  const params = new URLSearchParams(raw);
+  for (const key of params.keys())
+    if (!allowed.includes(key) || params.getAll(key).length !== 1)
+      throw new TypeError("Unknown or duplicate query key");
+  return params;
+}
+function integer(params, name, fallback) {
+  if (!params.has(name)) return fallback;
+  const value = params.get(name);
+  if (!/^(0|[1-9]\d*)$/.test(value)) throw new TypeError("Invalid integer");
+  return Number(value);
+}
+
+export function handleReportExploration({ path, getJob, send }) {
+  const match = /^\/r\/([a-f0-9]{32})\/(files|file)\.json(?:\?([^#]*))?$/.exec(
+    path,
+  );
+  if (!match) return false;
+  const json = (status, body, headers = {}) =>
+    send(status, explorationJson(body), "application/json; charset=utf-8", {
+      "content-disposition":
+        match[2] === "file"
+          ? 'attachment; filename="unmask-file-evidence.json"'
+          : 'attachment; filename="unmask-files.json"',
+      ...headers,
+    });
+  const drilldown = match[2] === "file";
+  const context = { reportId: match[1] };
+  let options;
+  try {
+    if (drilldown) {
+      const params = queryParameters(match[3] ?? "", [
+        "path",
+        "originalPath",
+        "fileId",
+      ]);
+      options = Object.fromEntries(params);
+      buildReportFileEvidence({ files: [] }, options, context);
+    } else {
+      const params = queryParameters(match[3] ?? "", [
+        "state",
+        "prefix",
+        "offset",
+        "limit",
+      ]);
+      options = {
+        state: params.get("state") ?? "all",
+        prefix: params.get("prefix") ?? "",
+        offset: integer(params, "offset", 0),
+        limit: integer(params, "limit", 50),
+      };
+      buildReportFileInventory({ files: [] }, options, context);
+    }
+  } catch {
+    json(400, { error: "invalid-query" });
+    return true;
+  }
+  const job = getJob(match[1]);
+  if (!job) json(404, { error: "report-unavailable" });
+  else if (!job.report) {
+    const pending = ["queued", "running"].includes(job.status);
+    json(
+      pending ? 202 : 409,
+      {
+        error: pending ? "report-pending" : "report-unavailable",
+        status: job.status,
+      },
+      pending ? { "retry-after": "3" } : {},
+    );
+  } else {
+    const body = drilldown
+      ? buildReportFileEvidence(job.report, options, context)
+      : buildReportFileInventory(job.report, options, context);
+    if (!body) json(404, { error: "file-unavailable" });
+    else json(200, { reportId: match[1], ...body });
+  }
+  return true;
+}

package/dist/version.json

@@ -1 +1 @@
-{"buildSchema":"1","version":"0.1.2","dirty":false,"commit":"85bd6d9c0ce7bc31c16d3b1aef695826c0b52354","sourceSha256":"41b4925fd7f4c0d5e8a0018bce3244e138397b48b9663b68a08a9e0e4b32f898","packageSha256":"97af1181106db21be2cde05366ede4e8c018c367cf9bd6b21168dcb78baaff56","lockfileSha256":"84beb1a861f96a8cb788de5bfeeaddcaff04af8c766ec6489601ba42b89fc583","files":{"cli/hosted.mjs":{"sha256":"dea7b512a2e811102521565e9f218c77aab916fe05e838f55a9aeb7b43cd0852","size":7436},"cli/main.mjs":{"sha256":"3bff23e18025d73dbfd8eb3a9571a7797702f03ed14e8d2d1edd6a12304c579e","size":6597},"core/acquire.mjs":{"sha256":"aee5ed002292edf1b03385ceec8ebfb03de452dba36bbdced96f888eaafa1d67","size":9549},"core/advisories.mjs":{"sha256":"388088e44422ffeb3b60d930c84cec29fbc89b98d8dfd2879bc6ede50f4e7ea9","size":13004},"core/archive.mjs":{"sha256":"80aa4373c0324458fe322a83af18a4cfd0ffec4b39ebdeffc9084639a8655410","size":16193},"core/compare.mjs":{"sha256":"540614266e06a2875010793d036d256ddfac72f978157cd3d147ffb99015d8e4","size":7579},"core/manifests.mjs":{"sha256":"29c40e01ff1e1dfaed444600d8c78380d23d4bc9be71960251e39ea3594de2f1","size":17891},"core/online.mjs":{"sha256":"368a3f2558e16db0701d2eaf068b48e2661e7e01ab7cf5605cdd22766aeb5cca","size":9741},"core/package-details.mjs":{"sha256":"770551a6ab84e523dbc56ede6131b08eb22b8c21fc9c8b179fe0d1769fb2ec00","size":21538},"core/pipeline.mjs":{"sha256":"9c4ddc5c258a99455a1230c978fd132c135057ad7bb6c7baa201ae530ee136fd","size":11060},"core/policy.mjs":{"sha256":"4281c626c00a6424992f5e1eba26876e2b70f4b968450a8ca52fa42f5a121ba5","size":2954},"core/report.mjs":{"sha256":"aa167c94c257a5ff6d830630a37a51a9a9e47f82aa4a0a7b96ead91a5967294b","size":15844},"core/resolve.mjs":{"sha256":"d5575da49ff78e8fea8df1f2fc10a39540adea285eddfa347746e848f9fdf957","size":5202},"core/source.mjs":{"sha256":"798fe74e3fba836b82576cd46e1b91e6f6e0a4e3cf273c533b5e074247c81373","size":3238},"core/syntax.mjs":{"sha256":"2d50f2e73e17aedbcbccd92af280e171de4ef78b55acccd23d6b6ef11e891776","size":10450},"model/client.mjs":{"sha256":"efb68132710cbdff6b86b58cbac006c48e10f9317e852f00b120ef7c3c7ed9c1","size":42865},"model/config.mjs":{"sha256":"127605979a299616be15f4a47e94dcd82928b00ad2af71744ffaa6e359516486","size":3245},"server/app.mjs":{"sha256":"54cb435f6ab70739c16a2db9eb63eb91704a5e1515cbb2c25793f47baa4e0299","size":10128},"server/enrichment.mjs":{"sha256":"3c5cc57f2c8f019f79418457f366a9422e0a03a8ba86a41b0767aba636bde179","size":3825},"server/main.mjs":{"sha256":"e5bdcd02209c2ccc1ed8c73b85b9988d61aa3e1bcf7c8d119eed782a4bfcd224","size":4587},"server/queue.mjs":{"sha256":"23e30f3ff570771b77a244be9200ad510d2f19811eee566d68b364b7f741a9d7","size":7371},"server/runner.mjs":{"sha256":"a6ca5bfbd7b239f7110639d854ca9a263f4cf3aaf06701ea54493b29f8244706","size":9071},"server/store.mjs":{"sha256":"efa2a35c7e9d0344c26e24ba360a457cdf80f4f48975f0186f81844b9fb7a097","size":2706},"server/worker.mjs":{"sha256":"1df839608cd1c691fc2801d89e698daeef3e48d7f4b8843ce1252a21fde9730a","size":1902},"viewer/render.mjs":{"sha256":"c77442c27041a5fe28269b8c80c9d24c72b73a226e8d4491e6d7285a9feb5309","size":19443},"viewer/shell.mjs":{"sha256":"5f800d0a97fe416d02cf9abef766d651b444b4745ad3a998926599469358ca79","size":9408}}}
+{"buildSchema":"1","version":"0.1.3","dirty":false,"commit":"541bc4d2e4710b411202882ec2480801994b6cf9","sourceSha256":"429745022e980eb8d09b1c6a6614b8b25f49921bd1883b0b111dfd5c3137ada3","packageSha256":"28210403766aff6ca070f8ca93df42117e93eedb5005b2a1b1fec4ee2f68c0c0","lockfileSha256":"2f632db652163f9f8f55ed649962fc5e4f718daf2edf6b0f0eea5d9501013dac","files":{"cli/batch.mjs":{"sha256":"101f7ecb4c3d5890c42f402e5ca00ab97351c4a4d90e07a1fa4367e3c0807650","size":7296},"cli/hosted.mjs":{"sha256":"dea7b512a2e811102521565e9f218c77aab916fe05e838f55a9aeb7b43cd0852","size":7436},"cli/main.mjs":{"sha256":"c4429dd331b377a1b1ca9b25a04721d51f38c39ee395de2239d0ad2bf7ccb57c","size":6825},"cli/scan.mjs":{"sha256":"9bf33e926ededf1beb1e4af73c861ba5bf33bee74ca0544151112284e0afc1b5","size":3906},"core/acquire.mjs":{"sha256":"aee5ed002292edf1b03385ceec8ebfb03de452dba36bbdced96f888eaafa1d67","size":9549},"core/advisories.mjs":{"sha256":"388088e44422ffeb3b60d930c84cec29fbc89b98d8dfd2879bc6ede50f4e7ea9","size":13004},"core/archive.mjs":{"sha256":"80aa4373c0324458fe322a83af18a4cfd0ffec4b39ebdeffc9084639a8655410","size":16193},"core/compare.mjs":{"sha256":"540614266e06a2875010793d036d256ddfac72f978157cd3d147ffb99015d8e4","size":7579},"core/manifests.mjs":{"sha256":"29c40e01ff1e1dfaed444600d8c78380d23d4bc9be71960251e39ea3594de2f1","size":17891},"core/online.mjs":{"sha256":"368a3f2558e16db0701d2eaf068b48e2661e7e01ab7cf5605cdd22766aeb5cca","size":9741},"core/package-details.mjs":{"sha256":"770551a6ab84e523dbc56ede6131b08eb22b8c21fc9c8b179fe0d1769fb2ec00","size":21538},"core/pipeline.mjs":{"sha256":"9c4ddc5c258a99455a1230c978fd132c135057ad7bb6c7baa201ae530ee136fd","size":11060},"core/policy.mjs":{"sha256":"4281c626c00a6424992f5e1eba26876e2b70f4b968450a8ca52fa42f5a121ba5","size":2954},"core/registry-facts.mjs":{"sha256":"726344597044b0c23fb74aff4fbfe7c60cbbfc4c0bee838abf9257134f9c96db","size":11013},"core/report-exploration.mjs":{"sha256":"1dcc9897d3bbc98ee3107ef8f8279d9eed6ee6d104455eb214a5e5644bd197fb","size":10137},"core/report.mjs":{"sha256":"aa167c94c257a5ff6d830630a37a51a9a9e47f82aa4a0a7b96ead91a5967294b","size":15844},"core/resolve.mjs":{"sha256":"d5575da49ff78e8fea8df1f2fc10a39540adea285eddfa347746e848f9fdf957","size":5202},"core/source.mjs":{"sha256":"798fe74e3fba836b82576cd46e1b91e6f6e0a4e3cf273c533b5e074247c81373","size":3238},"core/syntax.mjs":{"sha256":"2d50f2e73e17aedbcbccd92af280e171de4ef78b55acccd23d6b6ef11e891776","size":10450},"model/client.mjs":{"sha256":"efb68132710cbdff6b86b58cbac006c48e10f9317e852f00b120ef7c3c7ed9c1","size":42865},"model/config.mjs":{"sha256":"127605979a299616be15f4a47e94dcd82928b00ad2af71744ffaa6e359516486","size":3245},"server/app.mjs":{"sha256":"2aa5678bcdd38702707fa05ec7aa749d46f1590993e491ec0adc408a35d2f890","size":10498},"server/enrichment.mjs":{"sha256":"3c5cc57f2c8f019f79418457f366a9422e0a03a8ba86a41b0767aba636bde179","size":3825},"server/main.mjs":{"sha256":"e5bdcd02209c2ccc1ed8c73b85b9988d61aa3e1bcf7c8d119eed782a4bfcd224","size":4587},"server/queue.mjs":{"sha256":"23e30f3ff570771b77a244be9200ad510d2f19811eee566d68b364b7f741a9d7","size":7371},"server/registry-facts.mjs":{"sha256":"58bce5b2a40f25e7561f122ea012594c9eb6789f993ca83dadc07f198afca9e3","size":3315},"server/report-exploration.mjs":{"sha256":"862b8d0ea07b627368aaca3a0f66359cfc638b14c54ab4158f8ef313602c3810","size":2774},"server/runner.mjs":{"sha256":"a6ca5bfbd7b239f7110639d854ca9a263f4cf3aaf06701ea54493b29f8244706","size":9071},"server/store.mjs":{"sha256":"efa2a35c7e9d0344c26e24ba360a457cdf80f4f48975f0186f81844b9fb7a097","size":2706},"server/worker.mjs":{"sha256":"1df839608cd1c691fc2801d89e698daeef3e48d7f4b8843ce1252a21fde9730a","size":1902},"viewer/render.mjs":{"sha256":"c77442c27041a5fe28269b8c80c9d24c72b73a226e8d4491e6d7285a9feb5309","size":19443},"viewer/shell.mjs":{"sha256":"5f800d0a97fe416d02cf9abef766d651b444b4745ad3a998926599469358ca79","size":9408}}}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xagents_in/unmask",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": false,
   "description": "Evidence-based comparison of npm packages and their source archives",
   "license": "MIT",