upstream-radar 0.32.0 → 0.33.1

package/dist/src/dsh-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dsh-runtime.d.ts","sourceRoot":"","sources":["../../src/dsh-runtime.ts"],"names":[],"mappings":"AA0EA;;;GAGG;AACH,wBAAgB,sCAAsC,CACpD,UAAU,qBAAkB,GAC3B,MAAM,GAAG,SAAS,CAKpB"}
+{"version":3,"file":"dsh-runtime.d.ts","sourceRoot":"","sources":["../../src/dsh-runtime.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AA8EzD;;;GAGG;AACH,wBAAgB,sCAAsC,CACpD,UAAU,qBAAkB,GAC3B,MAAM,GAAG,SAAS,CAKpB;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CACvC,UAAU,qBAAkB,GAC3B,iBAAiB,GAAG,SAAS,CAG/B;AAED,2EAA2E;AAC3E,wBAAgB,kCAAkC,CAChD,UAAU,qBAAkB,GAC3B,MAAM,GAAG,SAAS,CAGpB;AAED,4EAA4E;AAC5E,wBAAgB,iDAAiD,CAC/D,oBAAoB,EAAE,MAAM,GAC3B,iBAAiB,GAAG,SAAS,CAG/B"}

package/dist/src/dsh-runtime.js

@@ -47,6 +47,10 @@ function packageRoot(entrypoint) {
     }
     return undefined;
 }
+function runtimePackage(root) {
+    const manifest = packageManifest(join(root, 'package.json'));
+    return manifest === undefined ? undefined : { ecosystem: 'npm', ...manifest };
+}
 function usableNodeModulesDirectory(path) {
     try {
         const resolved = realpathSync(path);
@@ -89,4 +93,21 @@ export function discoverDshRuntimeNodeModulesDirectory(entrypoint = process.argv
         return undefined;
     return runtimeNodeModulesDirectory(root);
 }
+/** Read the exact DSH executable package without importing or executing DSH. */
+export function discoverDshRuntimePackage(entrypoint = process.argv[1]) {
+    const root = discoverDshRuntimePackageDirectory(entrypoint);
+    return root === undefined ? undefined : runtimePackage(root);
+}
+/** Locate the exact DSH package root without importing or executing it. */
+export function discoverDshRuntimePackageDirectory(entrypoint = process.argv[1]) {
+    if (typeof entrypoint !== 'string' || entrypoint.trim() === '')
+        return undefined;
+    return packageRoot(entrypoint);
+}
+/** Read the exact DSH executable package from a known shared host plane. */
+export function discoverDshRuntimePackageFromNodeModulesDirectory(nodeModulesDirectory) {
+    if (typeof nodeModulesDirectory !== 'string' || nodeModulesDirectory.trim() === '')
+        return undefined;
+    return runtimePackage(join(resolve(nodeModulesDirectory), '@deepseek-ai', 'dsh'));
+}
 //# sourceMappingURL=dsh-runtime.js.map

package/dist/src/dsh-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"dsh-runtime.js","sourceRoot":"","sources":["../../src/dsh-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC3E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAE5D,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAC1C,MAAM,aAAa,GAAG,EAAE,CAAA;AACxB,MAAM,gBAAgB,GAAG,kBAAkB,CAAA;AAE3C,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,kBAAkB;YAAE,OAAO,SAAS,CAAA;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAA;QAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAC5F,MAAM,MAAM,GAAG,MAAiC,CAAA;QAChD,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;eACrE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAClE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;YAChD,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;QAC9D,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC9B,IAAI,MAAM,KAAK,MAAM;YAAE,MAAK;QAC5B,MAAM,GAAG,MAAM,CAAA;IACjB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY;IAC9C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,SAAS,CAAA;QACvD,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9D,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY;IAC/C,MAAM,YAAY,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAA;IAC3E,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,YAAY,CAAA;IAEnD,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,cAAc,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAA;YACtD,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,WAAW,CAAA;QACnD,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC9B,IAAI,MAAM,KAAK,MAAM;YAAE,MAAK;QAC5B,MAAM,GAAG,MAAM,CAAA;IACjB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sCAAsC,CACpD,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAChF,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxC,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAA;AAC1C,CAAC"}
+{"version":3,"file":"dsh-runtime.js","sourceRoot":"","sources":["../../src/dsh-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC3E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAG5D,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAC1C,MAAM,aAAa,GAAG,EAAE,CAAA;AACxB,MAAM,gBAAgB,GAAG,kBAAkB,CAAA;AAE3C,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,kBAAkB;YAAE,OAAO,SAAS,CAAA;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAA;QAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAC5F,MAAM,MAAM,GAAG,MAAiC,CAAA;QAChD,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;eACrE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAClE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;YAChD,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;QAC9D,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC9B,IAAI,MAAM,KAAK,MAAM;YAAE,MAAK;QAC5B,MAAM,GAAG,MAAM,CAAA;IACjB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAA;IAC5D,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAA;AAC/E,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY;IAC9C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,SAAS,CAAA;QACvD,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9D,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY;IAC/C,MAAM,YAAY,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAA;IAC3E,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,YAAY,CAAA;IAEnD,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,cAAc,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAA;YACtD,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,WAAW,CAAA;QACnD,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC9B,IAAI,MAAM,KAAK,MAAM;YAAE,MAAK;QAC5B,MAAM,GAAG,MAAM,CAAA;IACjB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sCAAsC,CACpD,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAChF,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxC,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAA;AAC1C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,yBAAyB,CACvC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5B,MAAM,IAAI,GAAG,kCAAkC,CAAC,UAAU,CAAC,CAAA;IAC3D,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;AAC9D,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kCAAkC,CAChD,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAChF,OAAO,WAAW,CAAC,UAAU,CAAC,CAAA;AAChC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iDAAiD,CAC/D,oBAA4B;IAE5B,IAAI,OAAO,oBAAoB,KAAK,QAAQ,IAAI,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACpG,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAA;AACnF,CAAC"}

package/dist/src/github-advisory.d.ts

@@ -0,0 +1,25 @@
+import type { AdvisoryMatch, PackageCoordinate } from './radar-types.js';
+type FetchLike = (input: string | URL, init?: RequestInit) => Promise<Response>;
+export interface GitHubAdvisoryClientOptions {
+    /** GitHub API base URL; useful for GitHub Enterprise or a deterministic test server. */
+    baseUrl?: string;
+    /** An optional token read from the caller's environment; never persisted by the client. */
+    token?: string;
+    fetch?: FetchLike;
+    timeoutMs?: number;
+    /** Query unreviewed advisories in addition to GitHub-reviewed advisories. */
+    includeUnreviewed?: boolean;
+}
+export declare class GitHubAdvisoryClient {
+    private readonly baseUrl;
+    private readonly token;
+    private readonly fetcher;
+    private readonly timeoutMs;
+    private readonly types;
+    constructor(options?: GitHubAdvisoryClientOptions);
+    private fetchPage;
+    private fetchAdvisories;
+    query(input: readonly PackageCoordinate[]): Promise<Map<string, AdvisoryMatch[]>>;
+}
+export {};
+//# sourceMappingURL=github-advisory.d.ts.map

package/dist/src/github-advisory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-advisory.d.ts","sourceRoot":"","sources":["../../src/github-advisory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,iBAAiB,EAGlB,MAAM,kBAAkB,CAAA;AAiBzB,KAAK,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAE/E,MAAM,WAAW,2BAA2B;IAC1C,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2FAA2F;IAC3F,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAyOD,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IAEzC,YAAY,OAAO,GAAE,2BAAgC,EAUpD;YAEa,SAAS;YA2BT,eAAe;IAyBvB,KAAK,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,CAsBtF;CACF"}

package/dist/src/github-advisory.js

@@ -0,0 +1,340 @@
+import { packageKey } from './osv.js';
+import { compareSemverValues, satisfiesSemverRange } from './semver.js';
+import { TOOL_VERSION } from './version.js';
+const DEFAULT_GITHUB_API_BASE_URL = 'https://api.github.com/';
+const GITHUB_API_VERSION = '2022-11-28';
+const MAX_RESPONSE_BYTES = 16 * 1024 * 1024;
+const MAX_PACKAGES = 10_000;
+const MAX_AFFECTS_PER_REQUEST = 100;
+const MAX_URL_LENGTH = 6_000;
+const MAX_PAGES_PER_QUERY = 20;
+const MAX_ADVISORIES = 10_000;
+const MAX_FETCH_ATTEMPTS = 2;
+const TRANSIENT_RETRY_DELAY_MS = 250;
+const ADVISORY_TYPES = ['reviewed', 'unreviewed'];
+function asRecord(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return undefined;
+    return value;
+}
+function asString(value, maxLength) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > maxLength)
+        return undefined;
+    return value;
+}
+function normalizeBaseUrl(input) {
+    const url = new URL(input);
+    if (url.protocol !== 'https:')
+        throw new Error('GitHub advisory base URL must use HTTPS');
+    if (url.username !== '' || url.password !== '' || url.search !== '' || url.hash !== '') {
+        throw new Error('GitHub advisory base URL must not contain credentials, a query string or a fragment');
+    }
+    if (!url.pathname.endsWith('/'))
+        url.pathname += '/';
+    return url.toString();
+}
+function severity(value) {
+    if (typeof value !== 'string')
+        return 'unknown';
+    switch (value.toLowerCase()) {
+        case 'low': return 'low';
+        case 'moderate':
+        case 'medium': return 'medium';
+        case 'high': return 'high';
+        case 'critical': return 'critical';
+        default: return 'unknown';
+    }
+}
+function safeUrl(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' && url.protocol !== 'http:')
+            return undefined;
+        if (url.username !== '' || url.password !== '')
+            return undefined;
+        return url.toString();
+    }
+    catch {
+        return undefined;
+    }
+}
+async function boundedJson(response) {
+    if (!response.ok)
+        throw new Error(`GitHub advisories returned HTTP ${response.status}`);
+    const declared = response.headers.get('content-length');
+    if (declared !== null && Number(declared) > MAX_RESPONSE_BYTES) {
+        throw new Error('GitHub advisories response exceeds the byte limit');
+    }
+    if (response.body === null)
+        throw new Error('GitHub advisories returned an empty response');
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    while (true) {
+        const next = await reader.read();
+        if (next.done)
+            break;
+        const chunk = Buffer.from(next.value);
+        total += chunk.length;
+        if (total > MAX_RESPONSE_BYTES) {
+            await reader.cancel('GitHub advisories response exceeded byte limit');
+            throw new Error('GitHub advisories response exceeds the byte limit');
+        }
+        chunks.push(chunk);
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks, total).toString('utf8'));
+    }
+    catch {
+        throw new Error('GitHub advisories returned invalid JSON');
+    }
+}
+function nextLink(response) {
+    const link = response.headers.get('link');
+    if (link === null)
+        return undefined;
+    const match = /<([^>]+)>\s*;\s*rel="next"/.exec(link);
+    return match?.[1];
+}
+function parsePatchedVersion(value) {
+    if (typeof value === 'string')
+        return asString(value, 256);
+    return asString(asRecord(value)?.identifier, 256);
+}
+function parseVulnerabilities(value) {
+    if (!Array.isArray(value))
+        throw new Error('GitHub advisory is missing its vulnerabilities list');
+    return value.slice(0, MAX_ADVISORIES).flatMap((raw) => {
+        const item = asRecord(raw);
+        const packageName = asString(asRecord(item?.package)?.name, 512);
+        if (packageName === undefined)
+            return [];
+        const vulnerableRange = asString(item?.vulnerable_version_range, 2_048);
+        const firstPatchedVersion = parsePatchedVersion(item?.first_patched_version);
+        return [{
+                packageName,
+                ...(vulnerableRange === undefined ? {} : { vulnerableRange }),
+                ...(firstPatchedVersion === undefined ? {} : { firstPatchedVersion }),
+            }];
+    });
+}
+function parseAdvisory(value) {
+    const root = asRecord(value);
+    if (root === undefined)
+        throw new Error('GitHub advisory is not an object');
+    const id = asString(root.ghsa_id, 512);
+    if (id === undefined || !/^GHSA-[A-Za-z0-9-]+$/.test(id))
+        throw new Error('GitHub advisory has an invalid ghsa_id');
+    const summary = asString(root.summary, 8_192) ?? '(no summary supplied)';
+    const details = asString(root.description, 64 * 1_024) ?? '';
+    const published = asString(root.published_at, 256);
+    const modified = asString(root.updated_at, 256) ?? published;
+    if (modified === undefined)
+        throw new Error(`GitHub advisory ${id} is missing updated_at/published_at`);
+    const withdrawn = root.withdrawn_at === null ? undefined : asString(root.withdrawn_at, 256);
+    const aliases = new Set();
+    const cve = asString(root.cve_id, 256);
+    if (cve !== undefined && cve !== id)
+        aliases.add(cve);
+    if (Array.isArray(root.identifiers)) {
+        for (const rawIdentifier of root.identifiers) {
+            const identifier = asString(asRecord(rawIdentifier)?.value, 256);
+            if (identifier !== undefined && identifier !== id)
+                aliases.add(identifier);
+        }
+    }
+    const references = new Set();
+    const htmlUrl = safeUrl(root.html_url);
+    if (htmlUrl !== undefined)
+        references.add(htmlUrl);
+    if (Array.isArray(root.references)) {
+        for (const rawReference of root.references) {
+            const reference = safeUrl(rawReference);
+            if (reference !== undefined)
+                references.add(reference);
+        }
+    }
+    return {
+        id,
+        aliases: [...aliases].sort(),
+        summary,
+        details,
+        severity: severity(root.severity),
+        ...(published === undefined ? {} : { published }),
+        modified,
+        ...(withdrawn === undefined ? {} : { withdrawn }),
+        references: [...references].slice(0, 100),
+        vulnerabilities: parseVulnerabilities(root.vulnerabilities),
+    };
+}
+function advisoryForPackage(advisory, coordinate) {
+    const vulnerabilities = advisory.vulnerabilities.filter(item => {
+        if (item.packageName !== coordinate.name)
+            return false;
+        if (item.vulnerableRange !== undefined && satisfiesSemverRange(coordinate.version, item.vulnerableRange) === false)
+            return false;
+        if (item.firstPatchedVersion !== undefined) {
+            const comparison = compareSemverValues(coordinate.version, item.firstPatchedVersion);
+            if (comparison !== undefined && comparison >= 0)
+                return false;
+        }
+        return true;
+    });
+    if (vulnerabilities.length === 0)
+        return undefined;
+    return {
+        id: advisory.id,
+        aliases: [...advisory.aliases],
+        summary: advisory.summary,
+        details: advisory.details,
+        severity: advisory.severity,
+        ...(advisory.published === undefined ? {} : { published: advisory.published }),
+        modified: advisory.modified,
+        ...(advisory.withdrawn === undefined ? {} : { withdrawn: advisory.withdrawn }),
+        fixedVersions: [...new Set(vulnerabilities
+                .flatMap(item => item.firstPatchedVersion === undefined ? [] : [item.firstPatchedVersion]))].sort(),
+        references: [...advisory.references],
+        sources: ['github-advisories'],
+    };
+}
+function packageChunks(packages, baseUrl, type) {
+    const chunks = [];
+    let current = [];
+    for (const item of packages) {
+        const candidate = [...current, item];
+        const url = new URL('advisories', baseUrl);
+        url.searchParams.set('ecosystem', 'npm');
+        url.searchParams.set('type', type);
+        url.searchParams.set('per_page', '100');
+        url.searchParams.set('affects', candidate.map(packageKeyCoordinate).join(','));
+        if (current.length > 0 && (candidate.length > MAX_AFFECTS_PER_REQUEST || url.toString().length > MAX_URL_LENGTH)) {
+            chunks.push(current);
+            current = [item];
+        }
+        else {
+            current = candidate;
+        }
+    }
+    if (current.length > 0)
+        chunks.push(current);
+    return chunks;
+}
+function packageKeyCoordinate(item) {
+    return `${item.name}@${item.version}`;
+}
+function sameOrigin(value, baseUrl) {
+    try {
+        return new URL(value).origin === new URL(baseUrl).origin;
+    }
+    catch {
+        return false;
+    }
+}
+function retryableFetchError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message === 'fetch failed'
+        || /^GitHub advisories returned HTTP (408|425|429|500|502|503|504)$/u.test(message);
+}
+export class GitHubAdvisoryClient {
+    baseUrl;
+    token;
+    fetcher;
+    timeoutMs;
+    types;
+    constructor(options = {}) {
+        this.baseUrl = normalizeBaseUrl(options.baseUrl ?? DEFAULT_GITHUB_API_BASE_URL);
+        const token = options.token?.trim();
+        this.token = token === undefined || token.length === 0 ? undefined : token;
+        this.fetcher = options.fetch ?? fetch;
+        this.timeoutMs = options.timeoutMs ?? 20_000;
+        if (!Number.isSafeInteger(this.timeoutMs) || this.timeoutMs < 1_000 || this.timeoutMs > 120_000) {
+            throw new Error('GitHub advisory timeout must be between 1000 and 120000 milliseconds');
+        }
+        this.types = options.includeUnreviewed === false ? ['reviewed'] : [...ADVISORY_TYPES];
+    }
+    async fetchPage(url) {
+        for (let attempt = 1; attempt <= MAX_FETCH_ATTEMPTS; attempt += 1) {
+            try {
+                const response = await this.fetcher(url, {
+                    headers: {
+                        accept: 'application/vnd.github+json',
+                        'user-agent': `upstream-radar/${TOOL_VERSION}`,
+                        'x-github-api-version': GITHUB_API_VERSION,
+                        ...(this.token === undefined ? {} : { authorization: `Bearer ${this.token}` }),
+                    },
+                    redirect: 'error',
+                    signal: AbortSignal.timeout(this.timeoutMs),
+                });
+                const value = await boundedJson(response);
+                const next = nextLink(response);
+                if (next !== undefined && !sameOrigin(next, this.baseUrl)) {
+                    throw new Error('GitHub advisory pagination escaped the configured API origin');
+                }
+                return { value, ...(next === undefined ? {} : { next }) };
+            }
+            catch (error) {
+                if (attempt >= MAX_FETCH_ATTEMPTS || !retryableFetchError(error))
+                    throw error;
+                await new Promise(resolve => setTimeout(resolve, TRANSIENT_RETRY_DELAY_MS * attempt));
+            }
+        }
+        throw new Error('GitHub advisory request did not complete');
+    }
+    async fetchAdvisories(packages, type) {
+        const records = [];
+        for (const chunk of packageChunks(packages, this.baseUrl, type)) {
+            const url = new URL('advisories', this.baseUrl);
+            url.searchParams.set('ecosystem', 'npm');
+            url.searchParams.set('type', type);
+            url.searchParams.set('per_page', '100');
+            url.searchParams.set('affects', chunk.map(packageKeyCoordinate).join(','));
+            let next = url.toString();
+            let pages = 0;
+            while (next !== undefined) {
+                const page = await this.fetchPage(next);
+                if (!Array.isArray(page.value))
+                    throw new Error('GitHub advisory response is not an array');
+                for (const raw of page.value)
+                    records.push(parseAdvisory(raw));
+                next = page.next;
+                pages += 1;
+                if (pages >= MAX_PAGES_PER_QUERY && next !== undefined) {
+                    throw new Error('GitHub advisory pagination exceeds the page limit');
+                }
+            }
+        }
+        if (records.length > MAX_ADVISORIES)
+            throw new Error(`GitHub advisory query exceeds the ${MAX_ADVISORIES} advisory limit`);
+        return records;
+    }
+    async query(input) {
+        const unique = [...new Map(input.map(item => [packageKey(item), item])).values()];
+        if (unique.length > MAX_PACKAGES)
+            throw new Error(`GitHub advisory query exceeds the ${MAX_PACKAGES} package limit`);
+        for (const item of unique) {
+            if (item.ecosystem !== 'npm' || item.name.length === 0 || item.version.length === 0) {
+                throw new Error('GitHub advisory queries require exact npm package names and versions');
+            }
+        }
+        const records = [];
+        for (const type of this.types)
+            records.push(...await this.fetchAdvisories(unique, type));
+        const result = new Map();
+        for (const coordinate of unique) {
+            const matches = new Map();
+            for (const advisory of records) {
+                if (advisory.withdrawn !== undefined)
+                    continue;
+                const parsed = advisoryForPackage(advisory, coordinate);
+                if (parsed === undefined)
+                    continue;
+                matches.set(parsed.id, { package: { ...coordinate }, advisory: parsed });
+            }
+            result.set(packageKey(coordinate), [...matches.values()].sort((left, right) => left.advisory.id.localeCompare(right.advisory.id)));
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=github-advisory.js.map

package/dist/src/github-advisory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-advisory.js","sourceRoot":"","sources":["../../src/github-advisory.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE3C,MAAM,2BAA2B,GAAG,yBAAyB,CAAA;AAC7D,MAAM,kBAAkB,GAAG,YAAY,CAAA;AACvC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAC3C,MAAM,YAAY,GAAG,MAAM,CAAA;AAC3B,MAAM,uBAAuB,GAAG,GAAG,CAAA;AACnC,MAAM,cAAc,GAAG,KAAK,CAAA;AAC5B,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAC9B,MAAM,cAAc,GAAG,MAAM,CAAA;AAC7B,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAC5B,MAAM,wBAAwB,GAAG,GAAG,CAAA;AACpC,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,YAAY,CAAU,CAAA;AAkC1D,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACzF,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,SAAiB;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,SAAS,CAAA;IACjG,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IACzF,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAA;IACxG,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAA;IACpD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC/C,QAAQ,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5B,KAAK,KAAK,EAAE,OAAO,KAAK,CAAA;QACxB,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ,EAAE,OAAO,QAAQ,CAAA;QAC9B,KAAK,MAAM,EAAE,OAAO,MAAM,CAAA;QAC1B,KAAK,UAAU,EAAE,OAAO,UAAU,CAAA;QAClC,SAAS,OAAO,SAAS,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,SAAS,CAAA;QAC3E,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;YAAE,OAAO,SAAS,CAAA;QAChE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAkB;IAC3C,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACvF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACvD,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,kBAAkB,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IAC3F,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;IACxC,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAChC,IAAI,IAAI,CAAC,IAAI;YAAE,MAAK;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAA;QACrB,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;YAC/B,MAAM,MAAM,CAAC,MAAM,CAAC,gDAAgD,CAAC,CAAA;YACrE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;QACtE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAA;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAAkB;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACnC,MAAM,KAAK,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC1D,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACjG,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC1B,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QAChE,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,EAAE,CAAA;QACxC,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,EAAE,wBAAwB,EAAE,KAAK,CAAC,CAAA;QACvE,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;QAC5E,OAAO,CAAC;gBACN,WAAW;gBACX,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;gBAC7D,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;aACtE,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC5B,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAC3E,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACtC,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IACnH,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,uBAAuB,CAAA;IACxE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5D,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,SAAS,CAAA;IAC5D,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,qCAAqC,CAAC,CAAA;IACvG,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;IAC3F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,KAAK,MAAM,aAAa,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;YAChE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE;gBAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtC,IAAI,OAAO,KAAK,SAAS;QAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;YACvC,IAAI,SAAS,KAAK,SAAS;gBAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACxD,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;QAC5B,OAAO;QACP,OAAO;QACP,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QACjD,QAAQ;QACR,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QACjD,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACzC,eAAe,EAAE,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC;KAC5D,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,QAA8B,EAC9B,UAA6B;IAE7B,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAC7D,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;QACtD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,oBAAoB,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QAChI,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAA;YACpF,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAA;QAC/D,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IACF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAClD,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC9B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC9E,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC9E,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe;iBACvC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QACrG,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC;QACpC,OAAO,EAAE,CAAC,mBAAmB,CAAC;KAC/B,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,QAAsC,EAAE,OAAe,EAAE,IAAY;IAC1F,MAAM,MAAM,GAA0B,EAAE,CAAA;IACxC,IAAI,OAAO,GAAwB,EAAE,CAAA;IACrC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,CAAA;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QAC9E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,uBAAuB,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC;YACjH,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACpB,OAAO,GAAG,CAAC,IAAI,CAAC,CAAA;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,SAAS,CAAA;QACrB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5C,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAuB;IACnD,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAA;AACvC,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,OAAe;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtE,OAAO,OAAO,KAAK,cAAc;WAC5B,kEAAkE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AACvF,CAAC;AAED,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAQ;IACf,KAAK,CAAoB;IACzB,OAAO,CAAW;IAClB,SAAS,CAAQ;IACjB,KAAK,CAAmB;IAEzC,YAAY,OAAO,GAAgC,EAAE;QACnD,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,IAAI,2BAA2B,CAAC,CAAA;QAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAA;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;QAC1E,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;QACrC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAA;QAC5C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,KAAK,IAAI,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,CAAC;YAChG,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;QACzF,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAA;IACvF,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,GAAW;QACjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,kBAAkB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;oBACvC,OAAO,EAAE;wBACP,MAAM,EAAE,6BAA6B;wBACrC,YAAY,EAAE,kBAAkB,YAAY,EAAE;wBAC9C,sBAAsB,EAAE,kBAAkB;wBAC1C,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;qBAC/E;oBACD,QAAQ,EAAE,OAAO;oBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;iBAC5C,CAAC,CAAA;gBACF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAA;gBACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;gBAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;gBACjF,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;YAC3D,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,OAAO,IAAI,kBAAkB,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAA;gBAC7E,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,CAAC,CAAA;YACvF,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC7D,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,QAAsC,EAAE,IAAY;QAChF,MAAM,OAAO,GAA2B,EAAE,CAAA;QAC1C,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAChE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;YAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;YACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;YACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YAC1E,IAAI,IAAI,GAAuB,GAAG,CAAC,QAAQ,EAAE,CAAA;YAC7C,IAAI,KAAK,GAAG,CAAC,CAAA;YACb,OAAO,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;gBACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;gBAC3F,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK;oBAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC9D,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;gBAChB,KAAK,IAAI,CAAC,CAAA;gBACV,IAAI,KAAK,IAAI,mBAAmB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;gBACtE,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,cAAc,iBAAiB,CAAC,CAAA;QAC1H,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAmC;QAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;QACjF,IAAI,MAAM,CAAC,MAAM,GAAG,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,YAAY,gBAAgB,CAAC,CAAA;QACpH,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;YACzF,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAA2B,EAAE,CAAA;QAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QACxF,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAA;QACjD,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAA;YAChD,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;gBAC/B,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;oBAAE,SAAQ;gBAC9C,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;gBACvD,IAAI,MAAM,KAAK,SAAS;oBAAE,SAAQ;gBAClC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YAC1E,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACpI,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;CACF"}

package/dist/src/graph.d.ts

@@ -6,6 +6,8 @@ interface RootPackage {
 export declare function dependencyGraphDigest(nodes: readonly DependencyNode[], edges: readonly DependencyEdge[]): string;
 /** Parse the exact package tree produced by npm package-lock v2/v3 without executing package code. */
 export declare function parseNpmLockGraph(lockfile: unknown, rootPackage: RootPackage): DependencyGraph;
+/** Parse pnpm lockfile v6/v9 package snapshots without installing or executing package code. */
+export declare function parsePnpmLockGraph(text: string, rootPackage: RootPackage): DependencyGraph;
 /** Return bounded, cycle-safe root-to-node paths for an alert. */
 export declare function findDependencyPaths(graph: DependencyGraph, targetNodeId: string, options?: {
     maxPaths?: number;

package/dist/src/graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../src/graph.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EAEpB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAA;AAEzB,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAiED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAWhH;AAED,sGAAsG;AACtG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,GAAG,eAAe,CA+E9F;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACrD,cAAc,EAAE,EAAE,CA0CpB"}
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../src/graph.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EAEpB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAA;AAEzB,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAiED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAWhH;AAED,sGAAsG;AACtG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,GAAG,eAAe,CA0F9F;AA2aD,gGAAgG;AAChG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,eAAe,CA+H1F;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACrD,cAAc,EAAE,EAAE,CA0CpB"}