upstream-radar 0.33.12 → 0.35.0

package/dist/src/dependency-index.js

@@ -0,0 +1,199 @@
+import { findDependencyPaths } from './graph.js';
+export const REVERSE_DEPENDENCY_INDEX_SCHEMA = 'upstream-radar.reverse-dependency-index/v1alpha1';
+const MAX_PATHS_PER_DEPENDENCY = 8;
+const MAX_PATH_DEPTH = 64;
+function asRecord(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return undefined;
+    return value;
+}
+function asString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function asGraph(value) {
+    const graph = asRecord(value);
+    if (graph === undefined || graph.schema !== 'upstream-radar.dependency-graph/v1alpha1')
+        return undefined;
+    if (typeof graph.rootNodeId !== 'string' || !Array.isArray(graph.nodes) || !Array.isArray(graph.edges))
+        return undefined;
+    return graph;
+}
+function graphFromScanReport(value) {
+    const evidence = asRecord(value.evidence);
+    const npm = asRecord(evidence?.npm);
+    const audit = asRecord(npm?.dependencyAudit);
+    return asGraph(evidence?.dependencyGraph) ?? asGraph(audit?.graph);
+}
+function packageFromScanReport(value) {
+    const target = asRecord(value.target);
+    const name = asString(target?.name);
+    const version = asString(target?.version);
+    if (name === undefined || version === undefined)
+        return undefined;
+    return { ecosystem: 'npm', name, version };
+}
+function observationsFromScan(value, source, project) {
+    const plugin = packageFromScanReport(value);
+    const graph = graphFromScanReport(value);
+    if (plugin === undefined || graph === undefined)
+        return [];
+    const pluginId = project === undefined ? `${plugin.name}@${plugin.version}` : `${project.id}:${plugin.name}@${plugin.version}`;
+    return [{ source, pluginId, plugin, ...(project === undefined ? {} : { project }), graph }];
+}
+/** Convert supported scan, exact-review, or Radar config JSON into index observations. */
+export function parseReverseDependencyObservations(value, source) {
+    const record = asRecord(value);
+    if (record === undefined)
+        throw new Error(`${source} is not a JSON object`);
+    const schema = asString(record.schema);
+    if (schema === 'upstream-radar.scan/v1alpha1')
+        return observationsFromScan(record, source);
+    if (schema === 'upstream-radar.dsh-plugin-review/v1alpha1') {
+        const inspection = asRecord(record.inspection);
+        return inspection === undefined ? [] : observationsFromScan(inspection, `${source}#inspection`);
+    }
+    if (schema === 'upstream-radar.radar-config/v1alpha1') {
+        if (!Array.isArray(record.projects))
+            throw new Error(`${source} has no projects array`);
+        const observations = [];
+        for (const [projectIndex, projectValue] of record.projects.entries()) {
+            const projectRecord = asRecord(projectValue);
+            const project = asRecord(projectRecord?.project);
+            const projectId = asString(project?.id);
+            const projectName = asString(project?.name);
+            if (projectId === undefined || projectName === undefined)
+                throw new Error(`${source} project ${projectIndex} has no id/name`);
+            const plugins = Array.isArray(projectRecord?.plugins) ? projectRecord.plugins : [];
+            for (const [pluginIndex, pluginValue] of plugins.entries()) {
+                const pluginRecord = asRecord(pluginValue);
+                const packageRecord = asRecord(pluginRecord?.package);
+                const name = asString(packageRecord?.name);
+                const version = asString(packageRecord?.version);
+                const graph = asGraph(pluginRecord?.graph);
+                if (name === undefined || version === undefined || graph === undefined) {
+                    throw new Error(`${source} project ${projectIndex} plugin ${pluginIndex} is missing an exact package or graph`);
+                }
+                observations.push({
+                    source: `${source}#projects/${projectIndex}/plugins/${pluginIndex}`,
+                    pluginId: `${projectId}:${name}@${version}`,
+                    plugin: { ecosystem: 'npm', name, version },
+                    project: { id: projectId, name: projectName },
+                    graph,
+                });
+            }
+        }
+        return observations;
+    }
+    throw new Error(`${source} has unsupported schema ${schema ?? '(missing)'}`);
+}
+function packageKey(packageCoordinate) {
+    return `${packageCoordinate.name}@${packageCoordinate.version}`;
+}
+function pathKinds(graph, path) {
+    const kinds = [];
+    for (let index = 0; index < path.length - 1; index += 1) {
+        const edge = graph.edges
+            .filter(candidate => candidate.from === path[index] && candidate.to === path[index + 1])
+            .sort((left, right) => left.kind.localeCompare(right.kind))[0];
+        if (edge === undefined)
+            throw new Error('dependency graph path references a missing edge');
+        kinds.push(edge.kind);
+    }
+    return kinds;
+}
+function labelsForPath(path) {
+    return path.map(node => `${node.name}@${node.version}`);
+}
+function addUnique(items, value) {
+    if (!items.some(item => JSON.stringify(item) === JSON.stringify(value)))
+        items.push(value);
+}
+/** Build a deterministic dependency -> plugin index from bounded graph observations. */
+export function buildReverseDependencyIndex(observations, options = {}) {
+    const dependencies = new Map();
+    const plugins = new Map();
+    let completeObservations = 0;
+    let incompleteObservations = 0;
+    let unresolvedEdges = 0;
+    for (const observation of observations) {
+        const unresolved = observation.graph.unresolved?.length ?? 0;
+        const coverage = unresolved === 0 ? 'complete' : 'incomplete';
+        if (coverage === 'complete')
+            completeObservations += 1;
+        else
+            incompleteObservations += 1;
+        unresolvedEdges += unresolved;
+        const plugin = plugins.get(observation.pluginId) ?? {
+            id: observation.pluginId,
+            plugin: observation.plugin,
+            ...(observation.project === undefined ? {} : { project: observation.project }),
+            observations: [],
+        };
+        plugin.observations.push({
+            source: observation.source,
+            ...(observation.graph.digest === undefined ? {} : { graphDigest: observation.graph.digest }),
+            coverage,
+            unresolved,
+        });
+        plugins.set(observation.pluginId, plugin);
+        const root = observation.graph.nodes.find(node => node.id === observation.graph.rootNodeId);
+        if (root === undefined)
+            throw new Error(`${observation.source} graph root node is missing`);
+        for (const node of observation.graph.nodes) {
+            if (node.id === observation.graph.rootNodeId)
+                continue;
+            const paths = findDependencyPaths(observation.graph, node.id, {
+                maxPaths: MAX_PATHS_PER_DEPENDENCY,
+                maxDepth: MAX_PATH_DEPTH,
+            });
+            if (paths.length === 0)
+                continue;
+            const dependency = { ecosystem: 'npm', name: node.name, version: node.version };
+            const dependencyEntry = dependencies.get(packageKey(dependency)) ?? { dependency, dependents: [] };
+            const dependent = dependencyEntry.dependents.find(item => item.pluginId === observation.pluginId);
+            const target = dependent ?? {
+                pluginId: observation.pluginId,
+                plugin: observation.plugin,
+                ...(observation.project === undefined ? {} : { project: observation.project }),
+                sources: [],
+                coverage,
+                paths: [],
+            };
+            addUnique(target.sources, observation.source);
+            if (coverage === 'incomplete')
+                target.coverage = 'incomplete';
+            for (const path of paths) {
+                const labels = labelsForPath(path);
+                addUnique(target.paths, { nodes: labels, kinds: pathKinds(observation.graph, path.map(item => item.id)) });
+            }
+            if (dependent === undefined)
+                dependencyEntry.dependents.push(target);
+            dependencies.set(packageKey(dependency), dependencyEntry);
+        }
+    }
+    for (const plugin of plugins.values()) {
+        plugin.observations.sort((left, right) => left.source.localeCompare(right.source));
+    }
+    const sortedPlugins = [...plugins.values()].sort((left, right) => left.id.localeCompare(right.id));
+    const sortedDependencies = [...dependencies.values()].sort((left, right) => packageKey(left.dependency).localeCompare(packageKey(right.dependency)));
+    for (const dependency of sortedDependencies) {
+        dependency.dependents.sort((left, right) => left.pluginId.localeCompare(right.pluginId));
+        for (const dependent of dependency.dependents) {
+            dependent.sources.sort();
+            dependent.paths.sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
+        }
+    }
+    return {
+        schema: REVERSE_DEPENDENCY_INDEX_SCHEMA,
+        generatedAt: options.generatedAt ?? new Date().toISOString(),
+        observations: observations.length,
+        inputs: options.inputs ?? { files: observations.length, loadedFiles: observations.length, skipped: [] },
+        coverage: { completeObservations, incompleteObservations, unresolvedEdges },
+        plugins: sortedPlugins,
+        dependencies: sortedDependencies,
+    };
+}
+export function findReverseDependencyEntry(index, packageCoordinate) {
+    return index.dependencies.find(item => packageKey(item.dependency) === packageKey(packageCoordinate));
+}
+//# sourceMappingURL=dependency-index.js.map

package/dist/src/dependency-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-index.js","sourceRoot":"","sources":["../../src/dependency-index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGhD,MAAM,CAAC,MAAM,+BAA+B,GAAG,kDAA2D,CAAA;AAE1G,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAClC,MAAM,cAAc,GAAG,EAAE,CAAA;AAiEzB,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACzF,OAAO,KAAmB,CAAA;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1E,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,0CAA0C;QAAE,OAAO,SAAS,CAAA;IACxG,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACxH,OAAO,KAAmC,CAAA;AAC5C,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAiB;IAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;IAC5C,OAAO,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AACpE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAiB;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACzC,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACjE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAiB,EAAE,MAAc,EAAE,OAAsC;IACrG,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACxC,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAC1D,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAA;IAC9H,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;AAC7F,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kCAAkC,CAAC,KAAc,EAAE,MAAc;IAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,uBAAuB,CAAC,CAAA;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,MAAM,KAAK,8BAA8B;QAAE,OAAO,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1F,IAAI,MAAM,KAAK,2CAA2C,EAAE,CAAC;QAC3D,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC9C,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,UAAU,EAAE,GAAG,MAAM,aAAa,CAAC,CAAA;IACjG,CAAC;IACD,IAAI,MAAM,KAAK,sCAAsC,EAAE,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,wBAAwB,CAAC,CAAA;QACvF,MAAM,YAAY,GAAmC,EAAE,CAAA;QACvD,KAAK,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACrE,MAAM,aAAa,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAA;YAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;YAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;YACvC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC3C,IAAI,SAAS,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,YAAY,YAAY,iBAAiB,CAAC,CAAA;YAC7H,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;YAClF,KAAK,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAA;gBAC1C,MAAM,aAAa,GAAG,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;gBACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;gBAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;gBAChD,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;gBAC1C,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACvE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,YAAY,YAAY,WAAW,WAAW,uCAAuC,CAAC,CAAA;gBACjH,CAAC;gBACD,YAAY,CAAC,IAAI,CAAC;oBAChB,MAAM,EAAE,GAAG,MAAM,aAAa,YAAY,YAAY,WAAW,EAAE;oBACnE,QAAQ,EAAE,GAAG,SAAS,IAAI,IAAI,IAAI,OAAO,EAAE;oBAC3C,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE;oBAC3C,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE;oBAC7C,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,2BAA2B,MAAM,IAAI,WAAW,EAAE,CAAC,CAAA;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,iBAAoC;IACtD,OAAO,GAAG,iBAAiB,CAAC,IAAI,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAA;AACjE,CAAC;AAED,SAAS,SAAS,CAAC,KAAsB,EAAE,IAAc;IACvD,MAAM,KAAK,GAAqB,EAAE,CAAA;IAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK;aACrB,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;aACvF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAChE,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAC1F,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAA8C;IACnE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,SAAS,CAAI,KAAU,EAAE,KAAQ;IACxC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC5F,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,2BAA2B,CACzC,YAAqD,EACrD,OAAO,GAAoE,EAAE;IAE7E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkC,CAAA;IAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAA;IAC1D,IAAI,oBAAoB,GAAG,CAAC,CAAA;IAC5B,IAAI,sBAAsB,GAAG,CAAC,CAAA;IAC9B,IAAI,eAAe,GAAG,CAAC,CAAA;IAEvB,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAA;QAC5D,MAAM,QAAQ,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAA;QAC7D,IAAI,QAAQ,KAAK,UAAU;YAAE,oBAAoB,IAAI,CAAC,CAAA;;YACjD,sBAAsB,IAAI,CAAC,CAAA;QAChC,eAAe,IAAI,UAAU,CAAA;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI;YAClD,EAAE,EAAE,WAAW,CAAC,QAAQ;YACxB,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,GAAG,CAAC,WAAW,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;YAC9E,YAAY,EAAE,EAAE;SACjB,CAAA;QACD,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;YACvB,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5F,QAAQ;YACR,UAAU;SACX,CAAC,CAAA;QACF,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAEzC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAC3F,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,CAAC,MAAM,6BAA6B,CAAC,CAAA;QAC3F,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW,CAAC,KAAK,CAAC,UAAU;gBAAE,SAAQ;YACtD,MAAM,KAAK,GAAG,mBAAmB,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE;gBAC5D,QAAQ,EAAE,wBAAwB;gBAClC,QAAQ,EAAE,cAAc;aACzB,CAAC,CAAA;YACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ;YAChC,MAAM,UAAU,GAAG,EAAE,SAAS,EAAE,KAAc,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;YACxF,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;YAClG,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ,CAAC,CAAA;YACjG,MAAM,MAAM,GAAG,SAAS,IAAI;gBAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,GAAG,CAAC,WAAW,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;gBAC9E,OAAO,EAAE,EAAE;gBACX,QAAQ;gBACR,KAAK,EAAE,EAAE;aACV,CAAA;YACD,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YAC7C,IAAI,QAAQ,KAAK,YAAY;gBAAE,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAA;YAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;gBAClC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;YAC5G,CAAC;YACD,IAAI,SAAS,KAAK,SAAS;gBAAE,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpE,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IAClG,MAAM,kBAAkB,GAAG,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACpJ,KAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,CAAC;QAC5C,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;QACxF,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC9C,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;YACxB,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAClG,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,+BAA+B;QACvC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5D,YAAY,EAAE,YAAY,CAAC,MAAM;QACjC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;QACvG,QAAQ,EAAE,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,eAAe,EAAE;QAC3E,OAAO,EAAE,aAAa;QACtB,YAAY,EAAE,kBAAkB;KACjC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAA6B,EAC7B,iBAAoC;IAEpC,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAA;AACvG,CAAC"}

package/dist/src/dsh-case.d.ts

@@ -0,0 +1,50 @@
+import { type DshProfileCheckReport } from './dsh-profile-check.js';
+export declare const DSH_CASE_SCHEMA: 'upstream-radar.dsh-case/v1alpha1';
+declare const CASE_ID = "dsh-web-ui";
+export interface DshCaseFinding {
+    code: string;
+    severity: string;
+    summary: string;
+    detail: string;
+    remediation: string;
+}
+export interface DshCaseCheck {
+    id: 'before' | 'manual-add' | 'fixed';
+    status: DshProfileCheckReport['status'];
+    packageManager: DshProfileCheckReport['packageManager'];
+    lockfile?: string;
+    dependencyNodes: number;
+    loaderEntries: DshProfileCheckReport['loaderEntries'];
+    findings: DshCaseFinding[];
+}
+export interface DshCaseReport {
+    schema: typeof DSH_CASE_SCHEMA;
+    case: typeof CASE_ID;
+    source: string;
+    networkFree: true;
+    checks: DshCaseCheck[];
+    conclusion: {
+        rootCause: string;
+        userImpact: string;
+        maintainerFix: string;
+        whyMonitoringMatters: string;
+        confidence: 'high';
+    };
+    execution: {
+        network: false;
+        installs: false;
+        pluginCode: false;
+        dshStart: false;
+        dshAgent: false;
+        llm: false;
+    };
+}
+/**
+ * Replay one real DSH profile failure and its maintainer fix from packaged
+ * static fixtures. This is intentionally independent of DSH and any model so
+ * the first-use command always produces a useful result.
+ */
+export declare function createDshCaseReport(): Promise<DshCaseReport>;
+export declare function renderDshCase(report: DshCaseReport): string;
+export {};
+//# sourceMappingURL=dsh-case.d.ts.map

package/dist/src/dsh-case.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsh-case.d.ts","sourceRoot":"","sources":["../../src/dsh-case.ts"],"names":[],"mappings":"AAGA,OAAO,EAAmB,KAAK,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAEpF,eAAO,MAAM,eAAe,EAAG,kCAA2C,CAAA;AAE1E,QAAA,MAAM,OAAO,eAAe,CAAA;AAS5B,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAA;IACrC,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IACvC,cAAc,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,CAAA;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAA;IACrD,QAAQ,EAAE,cAAc,EAAE,CAAA;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,OAAO,eAAe,CAAA;IAC9B,IAAI,EAAE,OAAO,OAAO,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,IAAI,CAAA;IACjB,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB,UAAU,EAAE;QACV,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;QACrB,oBAAoB,EAAE,MAAM,CAAA;QAC5B,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;IACD,SAAS,EAAE;QACT,OAAO,EAAE,KAAK,CAAA;QACd,QAAQ,EAAE,KAAK,CAAA;QACf,UAAU,EAAE,KAAK,CAAA;QACjB,QAAQ,EAAE,KAAK,CAAA;QACf,QAAQ,EAAE,KAAK,CAAA;QACf,GAAG,EAAE,KAAK,CAAA;KACX,CAAA;CACF;AAoBD;;;;GAIG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC,CAuClE;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CA0B3D"}

package/dist/src/dsh-case.js

@@ -0,0 +1,88 @@
+import { realpath } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { dirname, join, resolve } from 'node:path';
+import { checkDshProfile } from './dsh-profile-check.js';
+export const DSH_CASE_SCHEMA = 'upstream-radar.dsh-case/v1alpha1';
+const CASE_ID = 'dsh-web-ui';
+const CASE_SOURCE = 'dsh-web-ui issues #71 and #35';
+const FIXTURE_DIRECTORY = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', 'examples/cases/dsh-web-ui-issue-71');
+function compactCheck(id, report) {
+    return {
+        id,
+        status: report.status,
+        packageManager: report.packageManager,
+        ...(report.lockfile === undefined ? {} : { lockfile: report.lockfile }),
+        dependencyNodes: report.dependencyGraph?.nodes.length ?? 0,
+        loaderEntries: report.loaderEntries,
+        findings: report.findings.map(finding => ({
+            code: finding.code,
+            severity: finding.severity,
+            summary: finding.summary,
+            detail: finding.detail,
+            remediation: finding.remediation,
+        })),
+    };
+}
+/**
+ * Replay one real DSH profile failure and its maintainer fix from packaged
+ * static fixtures. This is intentionally independent of DSH and any model so
+ * the first-use command always produces a useful result.
+ */
+export async function createDshCaseReport() {
+    const fixtureDirectory = await realpath(FIXTURE_DIRECTORY);
+    const checkedAt = [
+        '2026-08-17T08:00:00.000Z',
+        '2026-08-17T08:01:00.000Z',
+        '2026-08-17T08:02:00.000Z',
+    ];
+    const ids = ['before', 'manual-add', 'fixed'];
+    const checks = [];
+    for (const [index, id] of ids.entries()) {
+        const report = await checkDshProfile({
+            profileDirectory: join(fixtureDirectory, id),
+            checkedAt: checkedAt[index],
+        });
+        checks.push(compactCheck(id, report));
+    }
+    return {
+        schema: DSH_CASE_SCHEMA,
+        case: CASE_ID,
+        source: CASE_SOURCE,
+        networkFree: true,
+        checks,
+        conclusion: {
+            rootCause: 'minimumReleaseAge kept the profile on an older bundle layout while the generated patch still inserted a standalone skin loader that the bundled carrier already owned.',
+            userImpact: 'The profile is blocked before DSH starts; manually adding the missing package creates a duplicate loader id instead of fixing the profile.',
+            maintainerFix: 'Upgrade the related @linxin666 packages, activate the bundled loader row, remove the standalone insert, and exempt the intended packages from the release-age cooling window.',
+            whyMonitoringMatters: 'The same static check catches the broken profile, the misleading manual workaround, and the repaired configuration before plugin code runs.',
+            confidence: 'high',
+        },
+        execution: {
+            network: false,
+            installs: false,
+            pluginCode: false,
+            dshStart: false,
+            dshAgent: false,
+            llm: false,
+        },
+    };
+}
+export function renderDshCase(report) {
+    const lines = [
+        'Upstream Radar case — DSH web-ui #71',
+        'Network-free; no install, plugin execution, DSH start, Agent, or LLM.',
+        '',
+    ];
+    for (const check of report.checks) {
+        const findings = check.findings.map(finding => finding.code).join(', ');
+        const label = check.id === 'before'
+            ? 'Before DSH starts'
+            : check.id === 'manual-add'
+                ? 'Manual package workaround'
+                : 'Maintainer fix replay';
+        lines.push(`${label}: ${check.status.toUpperCase()} — ${findings === '' ? 'no findings' : findings}`);
+    }
+    lines.push('', `Root cause: ${report.conclusion.rootCause}`, `User impact: ${report.conclusion.userImpact}`, `Author fix: ${report.conclusion.maintainerFix}`, `Why monitor: ${report.conclusion.whyMonitoringMatters}`, '', 'This is a local evidence replay. It does not claim that the referenced upstream issue is a live vulnerability.', '');
+    return `${lines.join('\n')}`;
+}
+//# sourceMappingURL=dsh-case.js.map

package/dist/src/dsh-case.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsh-case.js","sourceRoot":"","sources":["../../src/dsh-case.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,eAAe,EAA8B,MAAM,wBAAwB,CAAA;AAEpF,MAAM,CAAC,MAAM,eAAe,GAAG,kCAA2C,CAAA;AAE1E,MAAM,OAAO,GAAG,YAAY,CAAA;AAC5B,MAAM,WAAW,GAAG,+BAA+B,CAAA;AACnD,MAAM,iBAAiB,GAAG,OAAO,CAC/B,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,IAAI,EACJ,IAAI,EACJ,oCAAoC,CACrC,CAAA;AA2CD,SAAS,YAAY,CAAC,EAAsB,EAAE,MAA6B;IACzE,OAAO;QACL,EAAE;QACF,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;QAC1D,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACxC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;KACJ,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG;QAChB,0BAA0B;QAC1B,0BAA0B;QAC1B,0BAA0B;KAClB,CAAA;IACV,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAU,CAAA;IACtD,MAAM,MAAM,GAAmB,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC5C,SAAS,EAAE,SAAS,CAAC,KAAK,CAAE;SAC7B,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,OAAO;QACL,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,WAAW;QACnB,WAAW,EAAE,IAAI;QACjB,MAAM;QACN,UAAU,EAAE;YACV,SAAS,EAAE,wKAAwK;YACnL,UAAU,EAAE,4IAA4I;YACxJ,aAAa,EAAE,+KAA+K;YAC9L,oBAAoB,EAAE,6IAA6I;YACnK,UAAU,EAAE,MAAM;SACnB;QACD,SAAS,EAAE;YACT,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,KAAK;YACf,GAAG,EAAE,KAAK;SACX;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,MAAM,KAAK,GAAG;QACZ,sCAAsC;QACtC,uEAAuE;QACvE,EAAE;KACH,CAAA;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,KAAK,QAAQ;YACjC,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,YAAY;gBACzB,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,uBAAuB,CAAA;QAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IACvG,CAAC;IACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,eAAe,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,EAC5C,gBAAgB,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,EAC9C,eAAe,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,EAChD,gBAAgB,MAAM,CAAC,UAAU,CAAC,oBAAoB,EAAE,EACxD,EAAE,EACF,gHAAgH,EAChH,EAAE,CACH,CAAA;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;AAC9B,CAAC"}

package/dist/src/dsh-review.d.ts

@@ -0,0 +1,46 @@
+import { type InspectNpmOptions } from './npm.js';
+import { type DshLoadMatrixOptions, type DshLoadMatrixReport } from './dsh-probe.js';
+import type { ScanReport } from './types.js';
+export declare const DSH_PLUGIN_REVIEW_SCHEMA: 'upstream-radar.dsh-plugin-review/v1alpha1';
+export type DshPluginReviewStatus = 'allow' | 'warn' | 'review' | 'block' | 'incompatible' | 'unknown';
+export interface DshPluginReviewArtifact {
+    path: string;
+    cleanup?: () => Promise<void>;
+}
+export interface DshPluginReviewOptions {
+    dshVersions: readonly string[];
+    registry?: string;
+    timeoutMs?: number;
+    inspect?: (input: string, options?: InspectNpmOptions) => Promise<ScanReport>;
+    pack?: (input: string, options: {
+        registry?: string;
+        timeoutMs: number;
+    }) => Promise<DshPluginReviewArtifact>;
+    probe?: (options: DshLoadMatrixOptions) => Promise<DshLoadMatrixReport>;
+}
+export interface DshPluginReviewReport {
+    schema: typeof DSH_PLUGIN_REVIEW_SCHEMA;
+    target: {
+        name: string;
+        version: string;
+        spec: string;
+    };
+    inspection: ScanReport;
+    compatibility: DshLoadMatrixReport;
+    artifact: {
+        inspectionDigest: string;
+        probeSha256: string;
+        matched: boolean;
+    };
+    status: DshPluginReviewStatus;
+    nextStep: string;
+    execution: {
+        npmPackLifecycleScripts: false;
+        pluginCode: false;
+        dshBusinessActions: false;
+        llm: false;
+    };
+}
+export declare function reviewDshPlugin(input: string, options: DshPluginReviewOptions): Promise<DshPluginReviewReport>;
+export declare function renderDshPluginReview(report: DshPluginReviewReport): string;
+//# sourceMappingURL=dsh-review.d.ts.map

package/dist/src/dsh-review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsh-review.d.ts","sourceRoot":"","sources":["../../src/dsh-review.ts"],"names":[],"mappings":"AAIA,OAAO,EAAmC,KAAK,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAClF,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAA;AACvB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,eAAO,MAAM,wBAAwB,EAAG,2CAAoD,CAAA;AAE5F,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,cAAc,GAAG,SAAS,CAAA;AAEtG,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAA;IAC7E,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAC7G,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAA;CACxE;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,OAAO,wBAAwB,CAAA;IACvC,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,aAAa,EAAE,mBAAmB,CAAA;IAClC,QAAQ,EAAE;QACR,gBAAgB,EAAE,MAAM,CAAA;QACxB,WAAW,EAAE,MAAM,CAAA;QACnB,OAAO,EAAE,OAAO,CAAA;KACjB,CAAA;IACD,MAAM,EAAE,qBAAqB,CAAA;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE;QACT,uBAAuB,EAAE,KAAK,CAAA;QAC9B,UAAU,EAAE,KAAK,CAAA;QACjB,kBAAkB,EAAE,KAAK,CAAA;QACzB,GAAG,EAAE,KAAK,CAAA;KACX,CAAA;CACF;AAyID,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA4CpH;AAMD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAmC3E"}

package/dist/src/dsh-review.js

@@ -0,0 +1,209 @@
+import { mkdtemp, readdir, rm } from 'node:fs/promises';
+import { spawn } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { join, resolve, sep } from 'node:path';
+import { inspectNpmPackage, parseNpmSpec } from './npm.js';
+import { probeDshLoadMatrix, } from './dsh-probe.js';
+export const DSH_PLUGIN_REVIEW_SCHEMA = 'upstream-radar.dsh-plugin-review/v1alpha1';
+const MAX_PACK_OUTPUT_BYTES = 256 * 1024;
+function bounded(value, maxLength = 2_048) {
+    const normalized = value.replace(/[\u0000-\u001f\u007f-\u009f]/g, character => (`\\u${character.codePointAt(0)?.toString(16).padStart(4, '0') ?? '0000'}`));
+    return normalized.length <= maxLength ? normalized : `${normalized.slice(0, maxLength - 1)}…`;
+}
+function runCommand(command, args, timeoutMs) {
+    return new Promise(resolveResult => {
+        const child = spawn(command, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+        const stdout = [];
+        const stderr = [];
+        let stdoutBytes = 0;
+        let stderrBytes = 0;
+        let timedOut = false;
+        const collect = (target, chunk, current, assign) => {
+            if (current >= MAX_PACK_OUTPUT_BYTES)
+                return;
+            const remaining = MAX_PACK_OUTPUT_BYTES - current;
+            target.push(chunk.subarray(0, remaining));
+            assign(current + Math.min(chunk.length, remaining));
+        };
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill('SIGTERM');
+        }, timeoutMs);
+        child.stdout.on('data', chunk => collect(stdout, Buffer.from(chunk), stdoutBytes, value => { stdoutBytes = value; }));
+        child.stderr.on('data', chunk => collect(stderr, Buffer.from(chunk), stderrBytes, value => { stderrBytes = value; }));
+        child.on('error', () => {
+            clearTimeout(timer);
+            resolveResult({ code: null, stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8'), timedOut });
+        });
+        child.on('close', code => {
+            clearTimeout(timer);
+            resolveResult({ code, stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8'), timedOut });
+        });
+    });
+}
+async function packNpmArtifact(input, options) {
+    const directory = await mkdtemp(join(tmpdir(), 'upstream-radar-dsh-review-'));
+    const command = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+    const args = ['pack', '--ignore-scripts', '--json', '--pack-destination', directory, input];
+    if (options.registry !== undefined)
+        args.push('--registry', options.registry);
+    const result = await runCommand(command, args, options.timeoutMs);
+    if (result.code !== 0 || result.timedOut) {
+        await rm(directory, { recursive: true, force: true }).catch(() => undefined);
+        const detail = result.timedOut ? 'npm pack timed out' : `npm pack exited with ${result.code}`;
+        throw new Error(`${detail}: ${bounded([result.stdout, result.stderr].filter(Boolean).join('\n'))}`);
+    }
+    const files = (await readdir(directory)).filter(file => file.endsWith('.tgz'));
+    if (files.length !== 1) {
+        await rm(directory, { recursive: true, force: true }).catch(() => undefined);
+        throw new Error(`npm pack produced ${files.length} tarballs; expected exactly one`);
+    }
+    const path = resolve(directory, files[0]);
+    if (!path.startsWith(`${resolve(directory)}${sep}`)) {
+        await rm(directory, { recursive: true, force: true }).catch(() => undefined);
+        throw new Error('npm pack returned an artifact outside its temporary directory');
+    }
+    return {
+        path,
+        cleanup: async () => rm(directory, { recursive: true, force: true, maxRetries: 2 }).catch(() => undefined),
+    };
+}
+function statusFromReports(inspection, compatibility, artifactMatched) {
+    if (!artifactMatched)
+        return 'unknown';
+    if (compatibility.result === 'incompatible')
+        return 'incompatible';
+    if (compatibility.result === 'unknown')
+        return 'unknown';
+    return inspection.verdict;
+}
+function nextStepFor(status, inspection, compatibility, artifactMatched) {
+    if (!artifactMatched)
+        return 'The inspected and probed bytes differ; stop and repeat the review against one exact artifact.';
+    if (status === 'incompatible')
+        return 'Do not admit this bundle to the affected DSH release; inspect the failed matrix stage and compare the plugin patch with the DSH release.';
+    if (status === 'unknown')
+        return 'Resolve the incomplete artifact, dependency, or DSH load evidence before treating this plugin as compatible.';
+    if (status === 'block')
+        return 'Do not install this artifact until the blocking finding is resolved.';
+    if (inspection.coverageVerdict === 'incomplete' && inspection.findings.length === 0) {
+        const unresolved = inspection.evidence.npm?.dependencyAudit.graph?.unresolved ?? [];
+        const provenance = inspection.evidence.npm?.provenance.status;
+        const gaps = [
+            ...(unresolved.length === 0 ? [] : [`${unresolved.length} unresolved dependency edge(s)`]),
+            ...(provenance !== undefined && provenance !== 'verified' ? [`npm provenance ${provenance}`] : []),
+        ];
+        return gaps.length === 0
+            ? 'No implemented risk finding was reported, but coverage is incomplete; inspect the raw evidence before treating the result as a clean approval.'
+            : `No implemented risk finding was reported; complete ${gaps.join(' and ')} before treating the result as a clean approval.`;
+    }
+    if (inspection.coverageVerdict === 'incomplete')
+        return 'Review the findings and complete the missing dependency or provenance evidence before treating the result as a clean approval.';
+    if (status === 'review' || status === 'warn')
+        return 'Review the listed findings before admitting the plugin; the DSH load matrix alone is not a security approval.';
+    return `The bundle loaded on all ${compatibility.summary.total} requested DSH versions; continue with normal dependency monitoring before upgrading production.`;
+}
+function renderDependencyCoverage(lines, inspection) {
+    const npm = inspection.evidence.npm;
+    const audit = npm?.dependencyAudit;
+    if (audit === undefined)
+        return;
+    lines.push(`Dependency graph: ${audit.packages ?? 'not resolved'} packages`, `Unresolved dependency edges: ${audit.graph?.unresolved?.length ?? 0}`, `npm registry signature: ${npm?.registrySignature.status ?? 'not-checked'}`, `npm provenance: ${npm?.provenance.status ?? 'not-checked'}`);
+    const unresolved = audit.graph?.unresolved ?? [];
+    if (unresolved.length === 0)
+        return;
+    const nodes = new Map((audit.graph?.nodes ?? []).map(node => [node.id, node]));
+    for (const edge of unresolved.slice(0, 3)) {
+        const parent = nodes.get(edge.from);
+        const parentLabel = parent === undefined ? edge.from : `${parent.name}@${parent.version}`;
+        lines.push(`  Unresolved: ${display(parentLabel, 512)} -> ${display(`${edge.name}@${edge.spec}`, 512)} [${display(edge.kind, 32)}]`);
+    }
+    if (unresolved.length > 3)
+        lines.push(`  ... ${unresolved.length - 3} more unresolved edge(s)`);
+}
+export async function reviewDshPlugin(input, options) {
+    const spec = parseNpmSpec(input);
+    const timeoutMs = options.timeoutMs ?? 120_000;
+    const inspect = options.inspect ?? inspectNpmPackage;
+    const pack = options.pack ?? packNpmArtifact;
+    const probe = options.probe ?? probeDshLoadMatrix;
+    const inspection = await inspect(spec.canonical, {
+        deep: true,
+        ...(options.registry === undefined ? {} : { registry: options.registry }),
+        timeoutMs,
+    });
+    const artifact = await pack(spec.canonical, {
+        ...(options.registry === undefined ? {} : { registry: options.registry }),
+        timeoutMs,
+    });
+    try {
+        const compatibility = await probe({
+            packagePath: artifact.path,
+            dshVersions: options.dshVersions,
+            timeoutMs,
+        });
+        const inspectionDigest = inspection.target.artifactDigest;
+        const probeSha256 = compatibility.artifact.sha256;
+        const artifactMatched = typeof probeSha256 === 'string'
+            && inspectionDigest === `sha256:${probeSha256}`;
+        const status = statusFromReports(inspection, compatibility, artifactMatched);
+        return {
+            schema: DSH_PLUGIN_REVIEW_SCHEMA,
+            target: { name: spec.name, version: spec.version, spec: spec.canonical },
+            inspection,
+            compatibility,
+            artifact: { inspectionDigest, probeSha256: probeSha256 ?? 'unknown', matched: artifactMatched },
+            status,
+            nextStep: nextStepFor(status, inspection, compatibility, artifactMatched),
+            execution: {
+                npmPackLifecycleScripts: false,
+                pluginCode: false,
+                dshBusinessActions: false,
+                llm: false,
+            },
+        };
+    }
+    finally {
+        await artifact.cleanup?.();
+    }
+}
+function display(value, maxLength = 1_024) {
+    return bounded(value, maxLength);
+}
+export function renderDshPluginReview(report) {
+    const vulnerabilities = report.inspection.evidence.npm?.dependencyAudit.vulnerabilities;
+    const installScriptPackages = report.inspection.evidence.npm?.dependencyAudit.installScriptPackages;
+    const installScriptDetails = report.inspection.evidence.npm?.dependencyAudit.installScriptDetails;
+    const lines = [
+        'Upstream Radar — DSH plugin review',
+        `Plugin: ${display(`${report.target.name}@${report.target.version}`)}`,
+        `Overall: ${report.status.toUpperCase()}`,
+        `Exact artifact: ${report.artifact.matched ? 'same bytes for inspection and DSH probe' : 'MISMATCH'}`,
+        `Dependency review: ${report.inspection.verdict.toUpperCase()} (coverage ${report.inspection.coverageVerdict})`,
+        `Known vulnerabilities: ${vulnerabilities === null || vulnerabilities === undefined ? 'not checked' : vulnerabilities.total}`,
+        `Install-time dependency scripts: ${installScriptPackages === undefined ? 'not checked' : installScriptPackages.length === 0 ? '0' : installScriptPackages.join(', ')}`,
+        `DSH load matrix: ${report.compatibility.result.toUpperCase()} (${report.compatibility.summary.compatible}/${report.compatibility.summary.total} versions loaded)`,
+    ];
+    renderDependencyCoverage(lines, report.inspection);
+    for (const item of report.compatibility.reports) {
+        lines.push(`  DSH ${display(item.dshVersion, 128)}: ${item.result.toUpperCase()} — ${display(item.reason, 1_024)}`);
+    }
+    for (const detail of installScriptDetails ?? []) {
+        for (const script of detail.scripts)
+            lines.push(`  ${display(`${detail.package} ${script.name}: ${script.command}`, 2_048)}`);
+    }
+    if (report.inspection.findings.length === 0) {
+        lines.push('Findings: none in the implemented static checks');
+    }
+    else {
+        lines.push(`Findings: ${report.inspection.findings.length}`);
+        for (const finding of report.inspection.findings.slice(0, 8)) {
+            lines.push(`  [${finding.severity.toUpperCase()}] ${display(finding.code)}: ${display(finding.summary)}`);
+            if (finding.remediation !== undefined)
+                lines.push(`  Fix: ${display(finding.remediation, 2_048)}`);
+        }
+    }
+    lines.push(`Next: ${display(report.nextStep, 2_048)}`, 'Boundary: lifecycle scripts disabled; plugin code and business actions not executed; no LLM called.');
+    return `${lines.join('\n')}\n`;
+}
+//# sourceMappingURL=dsh-review.js.map