autoremediator 0.21.2 → 0.22.0

package/dist/api/evidence-pack/vex.js

@@ -0,0 +1,197 @@
+import { randomUUID } from "node:crypto";
+import { npmPurl, splitName } from "./components.js";
+const CDX_STATE = {
+    fixed: "resolved",
+    affected: "exploitable",
+    not_affected: "not_affected",
+    under_investigation: "in_triage",
+};
+const SEVERITY = {
+    LOW: "low",
+    MEDIUM: "medium",
+    HIGH: "high",
+    CRITICAL: "critical",
+    UNKNOWN: "unknown",
+};
+function advisorySource(id) {
+    if (/^CVE-\d{4}-\d{4,}$/i.test(id)) {
+        return { name: "NVD", url: `https://nvd.nist.gov/vuln/detail/${id.toUpperCase()}` };
+    }
+    if (/^GHSA-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}$/i.test(id)) {
+        return { name: "GitHub Advisory Database", url: `https://github.com/advisories/${id}` };
+    }
+    return undefined;
+}
+const isHttpUrl = (value) => /^https?:\/\/[^\s]+$/.test(value);
+const isDateTime = (value) => /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(value);
+function libraryComponent(component) {
+    const purl = npmPurl(component.name, component.version);
+    return {
+        type: "library",
+        "bom-ref": purl,
+        ...splitName(component.name),
+        version: component.version,
+        purl,
+    };
+}
+function cdxVulnerability(finding, details, now) {
+    const source = advisorySource(finding.cveId);
+    const references = (details?.references ?? []).filter((url) => isHttpUrl(url));
+    const kev = details?.kev;
+    const response = finding.updateAvailable ? ["update"] : undefined;
+    return {
+        id: finding.cveId,
+        ...(source ? { source } : {}),
+        ...(details?.severity
+            ? {
+                ratings: [
+                    {
+                        ...(details.cvssScore === undefined ? {} : { score: details.cvssScore }),
+                        severity: SEVERITY[details.severity] ?? "unknown",
+                        method: "other",
+                    },
+                ],
+            }
+            : {}),
+        ...(details?.summary ? { description: details.summary } : {}),
+        ...(details?.publishedAt && isDateTime(details.publishedAt)
+            ? { published: details.publishedAt }
+            : {}),
+        ...(references.length > 0 ? { advisories: references.map((url) => ({ url })) } : {}),
+        ...(finding.actionStatement && finding.status === "affected"
+            ? { recommendation: finding.actionStatement }
+            : {}),
+        ...(kev?.knownExploited
+            ? {
+                properties: [
+                    { name: "cisa-kev:known-exploited", value: "true" },
+                    ...(kev.dateAdded ? [{ name: "cisa-kev:date-added", value: kev.dateAdded }] : []),
+                    ...(kev.dueDate ? [{ name: "cisa-kev:due-date", value: kev.dueDate }] : []),
+                ],
+            }
+            : {}),
+        analysis: {
+            state: CDX_STATE[finding.status],
+            ...(finding.cycloneDxJustification ? { justification: finding.cycloneDxJustification } : {}),
+            ...(response ? { response } : {}),
+            detail: `${finding.detail} Basis: ${finding.basis === "run" ? `recorded run${finding.runIds.length === 1 ? "" : "s"} ${finding.runIds.join(", ")} read against the current lockfile` : "the project's policy file"}. Generated ${now}.`,
+        },
+        ...(finding.component
+            ? {
+                affects: [
+                    {
+                        ref: npmPurl(finding.component.name, finding.component.version),
+                        versions: [
+                            {
+                                version: finding.component.version,
+                                status: finding.status === "fixed" ? "unaffected" : "affected",
+                            },
+                        ],
+                    },
+                ],
+            }
+            : {}),
+    };
+}
+/**
+ * A CycloneDX 1.6 VEX document: one vulnerability per advisory and component, each with the
+ * `affects` reference to the component's purl, the analysis state, and where the claim came from.
+ * The components it references are listed in the document so it stands alone.
+ */
+export function buildCycloneDxVex(input) {
+    const timestamp = input.now.toISOString();
+    const referenced = new Map();
+    for (const finding of input.findings) {
+        if (finding.component) {
+            referenced.set(npmPurl(finding.component.name, finding.component.version), libraryComponent(finding.component));
+        }
+    }
+    const productRef = input.product.purl ??
+        `product:${input.product.name}${input.product.version ? `@${input.product.version}` : ""}`;
+    return {
+        bomFormat: "CycloneDX",
+        specVersion: "1.6",
+        serialNumber: `urn:uuid:${randomUUID()}`,
+        version: 1,
+        metadata: {
+            timestamp,
+            tools: {
+                components: [
+                    {
+                        type: "application",
+                        "bom-ref": "autoremediator",
+                        name: "autoremediator",
+                        version: input.toolVersion,
+                    },
+                ],
+            },
+            component: {
+                type: "application",
+                "bom-ref": productRef,
+                ...splitName(input.product.name),
+                ...(input.product.version ? { version: input.product.version } : {}),
+                ...(input.product.purl ? { purl: input.product.purl } : {}),
+            },
+            ...(input.product.manufacturer ? { manufacturer: { name: input.product.manufacturer } } : {}),
+        },
+        components: [...referenced.values()].toSorted((a, b) => a["bom-ref"].localeCompare(b["bom-ref"])),
+        vulnerabilities: input.findings.map((finding) => cdxVulnerability(finding, input.cves.get(finding.cveId), timestamp)),
+    };
+}
+// ---------------------------------------------------------------------------
+// OpenVEX v0.2.0
+// ---------------------------------------------------------------------------
+export const OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
+function openVexStatement(finding, product, now) {
+    const productId = product.purl ??
+        `urn:product:${encodeURIComponent(product.name)}${product.version ? `@${encodeURIComponent(product.version)}` : ""}`;
+    const componentPurl = finding.component
+        ? npmPurl(finding.component.name, finding.component.version)
+        : undefined;
+    const basis = finding.basis === "run"
+        ? `recorded run${finding.runIds.length === 1 ? "" : "s"} ${finding.runIds.join(", ")}`
+        : "the project's policy file";
+    const needsImpact = finding.status === "not_affected" && !finding.openVexJustification;
+    return {
+        vulnerability: { name: finding.cveId },
+        timestamp: now,
+        products: [
+            {
+                "@id": productId,
+                ...(product.purl ? { identifiers: { purl: product.purl } } : {}),
+                ...(componentPurl
+                    ? { subcomponents: [{ "@id": componentPurl, identifiers: { purl: componentPurl } }] }
+                    : {}),
+            },
+        ],
+        status: finding.status,
+        ...(finding.status === "not_affected" && finding.openVexJustification
+            ? { justification: finding.openVexJustification }
+            : {}),
+        // OpenVEX asks for a justification or an impact statement when nothing is affected.
+        ...(needsImpact || (finding.status === "not_affected" && finding.impactStatement)
+            ? { impact_statement: finding.impactStatement ?? finding.detail }
+            : {}),
+        ...(finding.status === "affected"
+            ? {
+                action_statement: finding.actionStatement ?? "No remediation has been recorded.",
+                action_statement_timestamp: now,
+            }
+            : {}),
+        status_notes: `${finding.detail} Basis: ${basis}.`,
+    };
+}
+export function buildOpenVex(input) {
+    const timestamp = input.now.toISOString();
+    return {
+        "@context": OPENVEX_CONTEXT,
+        "@id": `urn:uuid:${randomUUID()}`,
+        author: input.author ??
+            `Unreviewed draft generated by autoremediator ${input.toolVersion} for ${input.product.name}`,
+        timestamp,
+        version: 1,
+        tooling: `autoremediator ${input.toolVersion}`,
+        statements: input.findings.map((finding) => openVexStatement(finding, input.product, timestamp)),
+    };
+}
+//# sourceMappingURL=vex.js.map

package/dist/api/evidence-pack/vex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vex.js","sourceRoot":"","sources":["../../../src/api/evidence-pack/vex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAUrD,MAAM,SAAS,GAAgC;IAC7C,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,aAAa;IACvB,YAAY,EAAE,cAAc;IAC5B,mBAAmB,EAAE,WAAW;CACjC,CAAC;AAsCF,MAAM,QAAQ,GAA2B;IACvC,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;CACnB,CAAC;AAEF,SAAS,cAAc,CAAC,EAAU;IAChC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,oCAAoC,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,6CAA6C,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,iCAAiC,EAAE,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAW,EAAE,CAC5C,sEAAsE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAErF,SAAS,gBAAgB,CAAC,SAA2B;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,IAAI;QACf,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC;QAC5B,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,IAAI;KACL,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAmB,EACnB,OAAsC,EACtC,GAAW;IAEX,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,KAAK;QACjB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,OAAO,EAAE,QAAQ;YACnB,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP;wBACE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;wBACxE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,SAAS;wBACjD,MAAM,EAAE,OAAgB;qBACzB;iBACF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC;YACzD,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;YAC1D,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,eAAe,EAAE;YAC7C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,EAAE,cAAc;YACrB,CAAC,CAAC;gBACE,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,MAAM,EAAE;oBACnD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5E;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,QAAQ,EAAE;YACR,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;YAChC,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,WAAW,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,CAAC,2BAA2B,eAAe,GAAG,GAAG;SACxO;QACD,GAAG,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP;wBACE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC;wBAC/D,QAAQ,EAAE;4BACR;gCACE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO;gCAClC,MAAM,EACJ,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAE,YAAsB,CAAC,CAAC,CAAE,UAAoB;6BAC/E;yBACF;qBACF;iBACF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAMjC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8B,CAAC;IACzD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,UAAU,CAAC,GAAG,CACZ,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAC1D,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CACpC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GACd,KAAK,CAAC,OAAO,CAAC,IAAI;QAClB,WAAW,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7F,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,YAAY,UAAU,EAAE,EAAE;QACxC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE;YACR,SAAS;YACT,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV;wBACE,IAAI,EAAE,aAAa;wBACnB,SAAS,EAAE,gBAAgB;wBAC3B,IAAI,EAAE,gBAAgB;wBACtB,OAAO,EAAE,KAAK,CAAC,WAAW;qBAC3B;iBACF;aACF;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,aAAa;gBACnB,SAAS,EAAE,UAAU;gBACrB,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAChC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D;YACD,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9F;QACD,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACrD,CAAC,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CACzC;QACD,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAC9C,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CACpE;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AA6B/D,SAAS,gBAAgB,CACvB,OAAmB,EACnB,OAAwB,EACxB,GAAW;IAEX,MAAM,SAAS,GACb,OAAO,CAAC,IAAI;QACZ,eAAe,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACvH,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS;QACrC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC;QAC5D,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,KAAK,GACT,OAAO,CAAC,KAAK,KAAK,KAAK;QACrB,CAAC,CAAC,eAAe,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACtF,CAAC,CAAC,2BAA2B,CAAC;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACvF,OAAO;QACL,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE;QACtC,SAAS,EAAE,GAAG;QACd,QAAQ,EAAE;YACR;gBACE,KAAK,EAAE,SAAS;gBAChB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,aAAa;oBACf,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE;oBACrF,CAAC,CAAC,EAAE,CAAC;aACR;SACF;QACD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,cAAc,IAAI,OAAO,CAAC,oBAAoB;YACnE,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,oBAAoB,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,oFAAoF;QACpF,GAAG,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC;YAC/E,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,MAAM,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU;YAC/B,CAAC,CAAC;gBACE,gBAAgB,EAAE,OAAO,CAAC,eAAe,IAAI,mCAAmC;gBAChF,0BAA0B,EAAE,GAAG;aAChC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,GAAG,OAAO,CAAC,MAAM,WAAW,KAAK,GAAG;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAM5B;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO;QACL,UAAU,EAAE,eAAe;QAC3B,KAAK,EAAE,YAAY,UAAU,EAAE,EAAE;QACjC,MAAM,EACJ,KAAK,CAAC,MAAM;YACZ,gDAAgD,KAAK,CAAC,WAAW,QAAQ,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;QAC/F,SAAS;QACT,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,kBAAkB,KAAK,CAAC,WAAW,EAAE;QAC9C,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CACpD;KACF,CAAC;AACJ,CAAC"}

package/dist/api/freshness/deps.d.ts

@@ -0,0 +1,27 @@
+import { type NpmRegistryPackageInfo, type PackageTimeline } from "../../intelligence/sources/registry.js";
+import type { FreshnessStep, StepAssessment } from "./types.js";
+export interface DirectDependency {
+    name: string;
+    field: FreshnessStep["field"];
+    range: string;
+}
+/** What the freshness operations need from outside: the package manager, the registry, the clock. */
+export interface FreshnessDeps {
+    /** Direct dependencies that come from a registry (not workspace, file, link or git ranges). */
+    readDirect(cwd: string): DirectDependency[];
+    isInstalled(cwd: string, name: string): boolean;
+    /** Packages whose installed version is older than the registry's latest. */
+    queryOutdated(cwd: string, options: {
+        packageManager?: string;
+    }): Promise<Map<string, NpmRegistryPackageInfo>>;
+    fetchTimeline(name: string, cwd: string): Promise<PackageTimeline | undefined>;
+    assess(name: string, from: string, to: string, cwd: string): Promise<StepAssessment>;
+    now(): number;
+    /** How many registry or tarball requests run at once. */
+    concurrency: number;
+}
+export declare function readDirectDependencies(cwd: string): DirectDependency[];
+export declare const defaultFreshnessDeps: FreshnessDeps;
+/** Run `task` over `items`, at most `limit` at a time, keeping the order of the results. */
+export declare function mapLimit<T, R>(items: readonly T[], limit: number, task: (item: T) => Promise<R>): Promise<R[]>;
+//# sourceMappingURL=deps.d.ts.map

package/dist/api/freshness/deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../src/api/freshness/deps.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACrB,MAAM,wCAAwC,CAAC;AAGhD,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qGAAqG;AACrG,MAAM,WAAW,aAAa;IAC5B,+FAA+F;IAC/F,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAC5C,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,4EAA4E;IAC5E,aAAa,CACX,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GACnC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAC/E,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrF,GAAG,IAAI,MAAM,CAAC;IACd,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;CACrB;AAKD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAqBtE;AAED,eAAO,MAAM,oBAAoB,EAAE,aAkBlC,CAAC;AAEF,4FAA4F;AAC5F,wBAAsB,QAAQ,CAAC,CAAC,EAAE,CAAC,EACjC,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5B,OAAO,CAAC,CAAC,EAAE,CAAC,CAWd"}

package/dist/api/freshness/deps.js

@@ -0,0 +1,60 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fetchPackageTimeline, queryOutdatedPackages, } from "../../intelligence/sources/registry.js";
+import { loadRegistryConfig } from "../../platform/registry-config.js";
+import { assessUpgrade } from "../../remediation/impact/assess.js";
+const NOT_FROM_REGISTRY = /^(workspace|file|link|portal|patch|npm|git|git\+[a-z]+|github|gitlab|bitbucket|https?):/i;
+export function readDirectDependencies(cwd) {
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+    }
+    catch (error) {
+        throw new Error(`Cannot read package.json in ${cwd}: ${error instanceof Error ? error.message : String(error)}`, {
+            cause: error,
+        });
+    }
+    const found = new Map();
+    for (const field of ["devDependencies", "dependencies"]) {
+        for (const [name, range] of Object.entries(manifest[field] ?? {})) {
+            if (typeof range === "string" && !NOT_FROM_REGISTRY.test(range)) {
+                found.set(name, { name, field, range });
+            }
+        }
+    }
+    return [...found.values()].toSorted((a, b) => a.name.localeCompare(b.name));
+}
+export const defaultFreshnessDeps = {
+    readDirect: readDirectDependencies,
+    isInstalled: (cwd, name) => existsSync(join(cwd, "node_modules", name, "package.json")),
+    queryOutdated: (cwd, options) => queryOutdatedPackages(cwd, options),
+    fetchTimeline: (name, cwd) => fetchPackageTimeline(name, loadRegistryConfig(cwd)),
+    async assess(name, from, to, cwd) {
+        try {
+            const result = await assessUpgrade(name, from, to, { cwd });
+            return { breakability: result.breakability, score: result.score, summary: result.summary };
+        }
+        catch (error) {
+            return {
+                breakability: "Unknown",
+                summary: `could not assess ${name} ${from} -> ${to}: ${error instanceof Error ? error.message.split("\n")[0] : String(error)}`,
+            };
+        }
+    },
+    now: () => Date.now(),
+    concurrency: 4,
+};
+/** Run `task` over `items`, at most `limit` at a time, keeping the order of the results. */
+export async function mapLimit(items, limit, task) {
+    const results = [];
+    let next = 0;
+    const worker = async () => {
+        while (next < items.length) {
+            const index = next++;
+            results[index] = await task(items[index]);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, worker));
+    return results;
+}
+//# sourceMappingURL=deps.js.map

package/dist/api/freshness/deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../../src/api/freshness/deps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GAGtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AA0BnE,MAAM,iBAAiB,GACrB,0FAA0F,CAAC;AAE7F,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,QAA6F,CAAC;IAClG,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAoB,CAAC;IAC5F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,+BAA+B,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC/F;YACE,KAAK,EAAE,KAAK;SACb,CACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAU,EAAE,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAkB;IACjD,UAAU,EAAE,sBAAsB;IAClC,WAAW,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACvF,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC;IACpE,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjF,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC7F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,YAAY,EAAE,SAAS;gBACvB,OAAO,EAAE,oBAAoB,IAAI,IAAI,IAAI,OAAO,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC/H,CAAC;QACJ,CAAC;IACH,CAAC;IACD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IACrB,WAAW,EAAE,CAAC;CACf,CAAC;AAEF,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAAmB,EACnB,KAAa,EACb,IAA6B;IAE7B,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;QACvC,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9F,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/api/freshness/distance.d.ts

@@ -0,0 +1,42 @@
+/**
+ * How far behind the latest release a version is, and what that is worth. Pure: no registry, no
+ * clock (the caller passes `now`), so the same inputs always give the same numbers.
+ */
+import semver from "semver";
+import type { FreshnessPolicy } from "../../platform/freshness-policy.js";
+import type { FreshnessDistance } from "./types.js";
+/** An exact version, or the nearest one a range-like string names; undefined when it names none. */
+export declare function parseVersion(version: string): semver.SemVer | undefined;
+export interface DistanceInput {
+    installed: string;
+    latest: string;
+    /** Every published version, to count releases in between. */
+    published?: readonly string[];
+    /** When the installed version was published. */
+    installedPublishedAt?: string;
+    /** Epoch milliseconds. */
+    now: number;
+}
+/** True when `latest` is a newer release than `installed`. */
+export declare function isBehind(installed: string, latest: string): boolean;
+/**
+ * The distance from `installed` to `latest`. Majors are the plain difference; minors count only on
+ * the latest major and patches only on the latest minor, because "three minors behind" means little
+ * across a major boundary. A version that is not older than the latest is 0 behind. Undefined when
+ * either version cannot be read.
+ */
+export declare function distanceBetween(input: DistanceInput): FreshnessDistance | undefined;
+/**
+ * The policy limits a distance is past, in words. A package that is not behind is never past a
+ * limit, however old its version: nothing newer exists to move to.
+ */
+export declare function exceedsPolicy(distance: FreshnessDistance, behind: boolean, policy: FreshnessPolicy | undefined): string[];
+/**
+ * How stale one dependency is, 0 to 100: 40 per major behind, 5 per minor behind (at most 30), 1 per
+ * patch behind (at most 10), capped at 100. A transparent weighting, not a measurement: it exists to
+ * rank packages and to give the project one number to watch.
+ */
+export declare function penaltyOf(distance: FreshnessDistance): number;
+/** 100 minus the mean penalty of the packages that count, rounded; 100 when none count. */
+export declare function projectScore(penalties: readonly number[]): number;
+//# sourceMappingURL=distance.d.ts.map

package/dist/api/freshness/distance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distance.d.ts","sourceRoot":"","sources":["../../../src/api/freshness/distance.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAIpD,oGAAoG;AACpG,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,SAAS,CAEvE;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,gDAAgD;IAChD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,8DAA8D;AAC9D,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAInE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,iBAAiB,GAAG,SAAS,CA8BnF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,eAAe,GAAG,SAAS,GAClC,MAAM,EAAE,CAqBV;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAO7D;AAED,2FAA2F;AAC3F,wBAAgB,YAAY,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIjE"}

package/dist/api/freshness/distance.js

@@ -0,0 +1,86 @@
+/**
+ * How far behind the latest release a version is, and what that is worth. Pure: no registry, no
+ * clock (the caller passes `now`), so the same inputs always give the same numbers.
+ */
+import semver from "semver";
+const DAY_MS = 86_400_000;
+/** An exact version, or the nearest one a range-like string names; undefined when it names none. */
+export function parseVersion(version) {
+    return semver.parse(version) ?? semver.coerce(version) ?? undefined;
+}
+/** True when `latest` is a newer release than `installed`. */
+export function isBehind(installed, latest) {
+    const from = parseVersion(installed);
+    const to = parseVersion(latest);
+    return from !== undefined && to !== undefined && semver.gt(to, from);
+}
+/**
+ * The distance from `installed` to `latest`. Majors are the plain difference; minors count only on
+ * the latest major and patches only on the latest minor, because "three minors behind" means little
+ * across a major boundary. A version that is not older than the latest is 0 behind. Undefined when
+ * either version cannot be read.
+ */
+export function distanceBetween(input) {
+    const from = parseVersion(input.installed);
+    const to = parseVersion(input.latest);
+    if (!from || !to)
+        return undefined;
+    const behind = semver.gt(to, from);
+    const majorsBehind = behind ? Math.max(0, to.major - from.major) : 0;
+    const minorsBehind = behind && majorsBehind === 0 ? Math.max(0, to.minor - from.minor) : 0;
+    const patchesBehind = behind && majorsBehind === 0 && minorsBehind === 0 ? Math.max(0, to.patch - from.patch) : 0;
+    const result = { majorsBehind, minorsBehind, patchesBehind };
+    if (input.published) {
+        result.releasesBehind = behind
+            ? input.published.filter((version) => semver.valid(version) !== null &&
+                semver.prerelease(version) === null &&
+                semver.gt(version, from) &&
+                semver.lte(version, to)).length
+            : 0;
+    }
+    if (input.installedPublishedAt) {
+        const at = Date.parse(input.installedPublishedAt);
+        if (!Number.isNaN(at))
+            result.ageDays = Math.max(0, Math.floor((input.now - at) / DAY_MS));
+    }
+    return result;
+}
+/**
+ * The policy limits a distance is past, in words. A package that is not behind is never past a
+ * limit, however old its version: nothing newer exists to move to.
+ */
+export function exceedsPolicy(distance, behind, policy) {
+    if (!policy || !behind)
+        return [];
+    const reasons = [];
+    if (policy.maxMajorsBehind !== undefined && distance.majorsBehind > policy.maxMajorsBehind) {
+        reasons.push(`${distance.majorsBehind} major${distance.majorsBehind === 1 ? "" : "s"} behind (limit ${policy.maxMajorsBehind})`);
+    }
+    if (policy.maxMinorsBehind !== undefined && distance.minorsBehind > policy.maxMinorsBehind) {
+        reasons.push(`${distance.minorsBehind} minor${distance.minorsBehind === 1 ? "" : "s"} behind (limit ${policy.maxMinorsBehind})`);
+    }
+    if (policy.maxAgeDays !== undefined &&
+        distance.ageDays !== undefined &&
+        distance.ageDays > policy.maxAgeDays) {
+        reasons.push(`installed version is ${distance.ageDays} days old (limit ${policy.maxAgeDays})`);
+    }
+    return reasons;
+}
+/**
+ * How stale one dependency is, 0 to 100: 40 per major behind, 5 per minor behind (at most 30), 1 per
+ * patch behind (at most 10), capped at 100. A transparent weighting, not a measurement: it exists to
+ * rank packages and to give the project one number to watch.
+ */
+export function penaltyOf(distance) {
+    return Math.min(100, 40 * distance.majorsBehind +
+        Math.min(30, 5 * distance.minorsBehind) +
+        Math.min(10, distance.patchesBehind));
+}
+/** 100 minus the mean penalty of the packages that count, rounded; 100 when none count. */
+export function projectScore(penalties) {
+    if (penalties.length === 0)
+        return 100;
+    const mean = penalties.reduce((total, penalty) => total + penalty, 0) / penalties.length;
+    return Math.round(100 - mean);
+}
+//# sourceMappingURL=distance.js.map

package/dist/api/freshness/distance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"distance.js","sourceRoot":"","sources":["../../../src/api/freshness/distance.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAK5B,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,oGAAoG;AACpG,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;AACtE,CAAC;AAaD,8DAA8D;AAC9D,MAAM,UAAU,QAAQ,CAAC,SAAiB,EAAE,MAAc;IACxD,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAoB;IAClD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAEnC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,MAAM,IAAI,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,aAAa,GACjB,MAAM,IAAI,YAAY,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9F,MAAM,MAAM,GAAsB,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;IAEhF,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,CAAC,cAAc,GAAG,MAAM;YAC5B,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CACpB,CAAC,OAAO,EAAE,EAAE,CACV,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI;gBAC9B,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI;gBACnC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC;gBACxB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAC1B,CAAC,MAAM;YACV,CAAC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,QAA2B,EAC3B,MAAe,EACf,MAAmC;IAEnC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3F,OAAO,CAAC,IAAI,CACV,GAAG,QAAQ,CAAC,YAAY,SAAS,QAAQ,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,kBAAkB,MAAM,CAAC,eAAe,GAAG,CACnH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,QAAQ,CAAC,YAAY,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3F,OAAO,CAAC,IAAI,CACV,GAAG,QAAQ,CAAC,YAAY,SAAS,QAAQ,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,kBAAkB,MAAM,CAAC,eAAe,GAAG,CACnH,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,UAAU,KAAK,SAAS;QAC/B,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC9B,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,UAAU,EACpC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,wBAAwB,QAAQ,CAAC,OAAO,oBAAoB,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,QAA2B;IACnD,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,EACH,EAAE,GAAG,QAAQ,CAAC,YAAY;QACxB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,aAAa,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,YAAY,CAAC,SAA4B;IACvD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,GAAG,OAAO,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC;IACzF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;AAChC,CAAC"}

package/dist/api/freshness/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Dependency freshness: how far behind the latest release the direct dependencies are, and the
+ * smallest verified steps that bring them back inside the policy's `freshness` limits.
+ */
+export { freshnessReport, orderClimbs } from "./report.js";
+export { applyFreshness, planFreshnessStep } from "./step.js";
+export { defaultFreshnessDeps, type FreshnessDeps } from "./deps.js";
+export { distanceBetween, exceedsPolicy, penaltyOf, projectScore } from "./distance.js";
+export { climbSteps } from "./path.js";
+export { isIgnoredPackage, type FreshnessPolicy } from "../../platform/freshness-policy.js";
+export type { ApplyFreshnessOptions, ApplyFreshnessResult, FreshnessClimb, FreshnessCounts, FreshnessDistance, FreshnessOptions, FreshnessPackage, FreshnessPlanResult, FreshnessReport, FreshnessStatus, FreshnessStep, FreshnessStepOutcome, HeldReason, PlanFreshnessStepOptions, PlannedFreshnessStep, StepAssessment, StepOutcomeStatus, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/api/freshness/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/freshness/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC5F,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,wBAAwB,EACxB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,GAClB,MAAM,YAAY,CAAC"}

package/dist/api/freshness/index.js

@@ -0,0 +1,11 @@
+/**
+ * Dependency freshness: how far behind the latest release the direct dependencies are, and the
+ * smallest verified steps that bring them back inside the policy's `freshness` limits.
+ */
+export { freshnessReport, orderClimbs } from "./report.js";
+export { applyFreshness, planFreshnessStep } from "./step.js";
+export { defaultFreshnessDeps } from "./deps.js";
+export { distanceBetween, exceedsPolicy, penaltyOf, projectScore } from "./distance.js";
+export { climbSteps } from "./path.js";
+export { isIgnoredPackage } from "../../platform/freshness-policy.js";
+//# sourceMappingURL=index.js.map

package/dist/api/freshness/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/freshness/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAsB,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAwB,MAAM,oCAAoC,CAAC"}

package/dist/api/freshness/path.d.ts

@@ -0,0 +1,29 @@
+import type { FreshnessPolicy } from "../../platform/freshness-policy.js";
+import type { FreshnessStep } from "./types.js";
+export interface ClimbInput {
+    packageName: string;
+    field: FreshnessStep["field"];
+    installed: string;
+    latest: string;
+    /** Every published version. */
+    versions: readonly string[];
+    deprecated?: ReadonlySet<string>;
+    /** Publish time of each version, to apply `maxAgeDays` to the version a step lands on. */
+    published?: ReadonlyMap<string, string>;
+    policy?: FreshnessPolicy;
+    /** Versions never to land on (remediation memory: tried earlier and rejected). */
+    rejected?: ReadonlySet<string>;
+    now: number;
+}
+/**
+ * The breaking boundary a version sits in: its major, or, below 1.0.0, its `0.minor`, because a 0.x
+ * minor may break (the assumption semver's caret ranges make too). A climb moves one boundary at a
+ * time, and crossing one counts as a major bump for the policy.
+ */
+export declare function boundaryOf(version: string): string;
+/**
+ * The steps from `installed` towards `latest`, or none when it is not behind, or when no published
+ * version lies in between (the registry says latest is newer, but offers nothing to land on).
+ */
+export declare function climbSteps(input: ClimbInput): FreshnessStep[];
+//# sourceMappingURL=path.d.ts.map

package/dist/api/freshness/path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../../src/api/freshness/path.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,0FAA0F;IAC1F,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIlD;AA+CD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,aAAa,EAAE,CA4C7D"}

package/dist/api/freshness/path.js

@@ -0,0 +1,103 @@
+/**
+ * The climb from an installed version towards the latest, in small steps. Pure.
+ *
+ * A step is one jump: the first catches up to the newest release on the installed major (the
+ * migration path upgrade guides recommend, and the lowest-risk move there is), and each later one
+ * goes to the newest release of the next major that has any. Below 1.0.0 every `0.minor` counts as
+ * a major, since a 0.x minor may break. A deprecated release is never landed on while another
+ * candidate exists. The climb stops at the first step that leaves the package inside the policy, so
+ * a package allowed to trail by one major is not dragged onto the newest one. Without a policy the
+ * climb runs all the way to the latest release.
+ */
+import semver from "semver";
+import { classifyUpgradeLevel } from "../../intelligence/sources/registry.js";
+import { distanceBetween, exceedsPolicy, isBehind, parseVersion } from "./distance.js";
+/**
+ * The breaking boundary a version sits in: its major, or, below 1.0.0, its `0.minor`, because a 0.x
+ * minor may break (the assumption semver's caret ranges make too). A climb moves one boundary at a
+ * time, and crossing one counts as a major bump for the policy.
+ */
+export function boundaryOf(version) {
+    const parsed = parseVersion(version);
+    if (!parsed)
+        return version;
+    return parsed.major === 0 ? `0.${parsed.minor}` : String(parsed.major);
+}
+/**
+ * The versions a step may land on, one per boundary: stable, newer than `installed`, no newer than
+ * `latest`. A deprecated release is never chosen while another candidate exists: within a boundary
+ * it gives way to a release that is not deprecated, and a boundary whose newer releases are all
+ * deprecated is skipped when any other boundary has a candidate. Only when every candidate is
+ * deprecated are they returned, flagged, for the step to be held.
+ */
+function candidates(input, installed, latest) {
+    const stable = input.versions.filter((version) => semver.valid(version) !== null &&
+        semver.prerelease(version) === null &&
+        semver.gt(version, installed) &&
+        semver.lte(version, latest) &&
+        !input.rejected?.has(version));
+    const deprecated = input.deprecated ?? new Set();
+    const byBoundary = new Map();
+    for (const version of stable) {
+        const key = boundaryOf(version);
+        const group = byBoundary.get(key) ?? [];
+        group.push(version);
+        byBoundary.set(key, group);
+    }
+    const best = [];
+    for (const group of byBoundary.values()) {
+        const preferred = group.filter((version) => !deprecated.has(version));
+        const pool = preferred.length > 0 ? preferred : group;
+        best.push({ version: pool.toSorted(semver.rcompare)[0], deprecated: preferred.length === 0 });
+    }
+    const ordered = best.toSorted((a, b) => semver.compare(a.version, b.version));
+    const usable = ordered.filter((candidate) => !candidate.deprecated);
+    return usable.length > 0 ? usable : ordered;
+}
+/**
+ * The steps from `installed` towards `latest`, or none when it is not behind, or when no published
+ * version lies in between (the registry says latest is newer, but offers nothing to land on).
+ */
+export function climbSteps(input) {
+    const installed = parseVersion(input.installed);
+    const latest = parseVersion(input.latest);
+    if (!installed || !latest || !isBehind(input.installed, input.latest))
+        return [];
+    const chosen = [];
+    for (const target of candidates(input, installed, latest)) {
+        chosen.push(target);
+        const distance = distanceBetween({
+            installed: target.version,
+            latest: input.latest,
+            installedPublishedAt: input.published?.get(target.version),
+            now: input.now,
+        });
+        const behind = isBehind(target.version, input.latest);
+        // A landing whose publish time is unknown cannot be shown to meet `maxAgeDays`, so the climb goes on.
+        const ageUnknown = input.policy?.maxAgeDays !== undefined && distance?.ageDays === undefined && behind;
+        if (input.policy &&
+            distance &&
+            !ageUnknown &&
+            exceedsPolicy(distance, behind, input.policy).length === 0) {
+            break;
+        }
+    }
+    return chosen.map((target, position) => {
+        const fromVersion = position === 0 ? installed.version : chosen[position - 1].version;
+        const toVersion = target.version;
+        const step = {
+            packageName: input.packageName,
+            field: input.field,
+            fromVersion,
+            toVersion,
+            level: classifyUpgradeLevel(fromVersion, toVersion) ?? "major",
+            kind: boundaryOf(fromVersion) === boundaryOf(toVersion) ? "catch-up" : "major",
+            index: position + 1,
+            of: chosen.length,
+        };
+        if (target.deprecated)
+            step.deprecated = true;
+        return step;
+    });
+}
+//# sourceMappingURL=path.js.map

package/dist/api/freshness/path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.js","sourceRoot":"","sources":["../../../src/api/freshness/path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAE9E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAmBvF;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAQD;;;;;;GAMG;AACH,SAAS,UAAU,CACjB,KAAiB,EACjB,SAAwB,EACxB,MAAqB;IAErB,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAClC,CAAC,OAAO,EAAE,EAAE,CACV,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI;QAC9B,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI;QACnC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;QAC3B,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAChC,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,GAAG,EAAU,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjF,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B,SAAS,EAAE,MAAM,CAAC,OAAO;YACzB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,oBAAoB,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;YAC1D,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,sGAAsG;QACtG,MAAM,UAAU,GACd,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,IAAI,QAAQ,EAAE,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC;QACtF,IACE,KAAK,CAAC,MAAM;YACZ,QAAQ;YACR,CAAC,UAAU;YACX,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAC1D,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;QACrC,MAAM,WAAW,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAE,CAAC,OAAO,CAAC;QACvF,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC;QACjC,MAAM,IAAI,GAAkB;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW;YACX,SAAS;YACT,KAAK,EAAE,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,OAAO;YAC9D,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO;YAC9E,KAAK,EAAE,QAAQ,GAAG,CAAC;YACnB,EAAE,EAAE,MAAM,CAAC,MAAM;SAClB,CAAC;QACF,IAAI,MAAM,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}