upstream-radar 0.34.0 → 0.35.0

package/README.md

@@ -4,27 +4,74 @@
 [![npm](https://img.shields.io/npm/v/upstream-radar)](https://www.npmjs.com/package/upstream-radar)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 
-**Dependency evidence and upstream-change monitoring for [DeepSeek Harness (DSH)](https://github.com/deepseek-ai/deepseek-harness) plugins.**
+**The upstream dependency radar built into [DeepSeek Harness (DSH)](https://github.com/deepseek-ai/deepseek-harness) plugins.**
 
-Upstream Radar answers a practical question before a plugin enters a DSH profile:
+Upstream Radar is not another package-name vulnerability scanner. It follows one DSH plugin from admission to maintenance:
 
-> Which exact dependency versions does this plugin bring in, which vulnerability or upstream release changed them, and which other plugins will be affected?
+| Product job | What Radar establishes |
+| --- | --- |
+| **DSH compatibility / admission** | Whether the exact published bundle can be registered and loaded by the DSH releases you care about. |
+| **Real dependency graph** | Which exact package versions and physical paths the plugin brings into the DSH profile, including unresolved edges. |
+| **Continuous upstream monitoring** | Whether an advisory, npm release, DSH/Cordis change, or breaking signal changes the old → new situation. |
+| **Author-facing repair** | Which plugin, dependency path, version, lockfile, or DSH declaration gives the author a concrete next fix. |
+
+The deterministic scanner establishes package, graph, advisory, and compatibility facts. Only a meaningful affected change is handed to the DSH Agent for read-only, project-specific analysis; the model does not guess version matches or replace the evidence.
+
+## The product loop
+
+```mermaid
+flowchart TD
+  A["DSH plugin source or exact npm artifact"] --> B["DSH compatibility / admission check"]
+  B --> C["Build the real plugin → dependency graph"]
+  C --> D["Monitor advisories, npm, DSH and Cordis changes"]
+  D --> E{"Meaningful affected change?"}
+  E -- "No" --> F["Update observation point and stay quiet"]
+  E -- "Yes" --> G["Calculate exact old → new impact paths"]
+  G --> H["Send bounded evidence to the DSH Agent"]
+  H --> I["Return a repairable action to the plugin author"]
+```
+
+This is the boundary: Radar decides **what changed and which exact path is involved**; DSH decides **what that means for the project**. A later website can visualize the saved graph, but the evidence and impact index are already useful without one.
+
+## The upstream/downstream alignment IR
 
-It reads source trees, lockfiles, exact npm artifacts, saved DSH reports, and public advisory feeds. It does not install a plugin or execute its business code during static review.
+Every observer snapshot now carries a small, machine-readable alignment record:
+
+```text
+upstream:   Git commit + package.json coordinate
+downstream: npm coordinate + lockfile graph root + graph coverage
+result:     aligned | mismatch | unknown
+```
+
+This catches a class of problems that a vulnerability scanner cannot: the source
+package, published package, and dependency graph may no longer describe the
+same thing. For example, the public DSH/Feishu target currently reports:
+
+```text
+source:    dsh-lark-bot@0.15.8
+published: dsh-feishu-bot@0.15.8
+graph root: dsh-lark-bot@0.15.8
+result:    mismatch
+```
+
+That is not a claim of malware or runtime incompatibility. It is an evidence
+gap: Radar cannot safely say that the source it watched produced the artifact
+users install. The IR is stored in `observations.json`, rendered in the first
+baseline report, and defined in [`schemas/upstream-downstream-ir.schema.json`](schemas/upstream-downstream-ir.schema.json).
 
 ## Try it in 60 seconds
 
 ```bash
 # No DSH profile, API key, or network state required
-npx --yes upstream-radar@0.34.0 demo
+npx --yes upstream-radar@0.35.0 demo
 
 # Scan a public DSH plugin repository without installing it
-npx --yes upstream-radar@0.34.0 scan \
+npx --yes upstream-radar@0.35.0 scan \
   https://github.com/PlutoKeating/dsh-lark-bot \
   --fail-on never
 
-# Review the exact package users would install, then check two DSH releases
-npx --yes upstream-radar@0.34.0 review dsh-plugin dsh-feishu-bot@0.15.8 \
+# Review a real browser plugin users would install, then check two DSH releases
+npx --yes upstream-radar@0.35.0 review dsh-plugin dsh-cloudflare-browser-run@0.1.1 \
   --dsh-version 0.1.0-rc.6,0.1.0-rc.7
 ```
 
@@ -36,6 +83,7 @@ These are real, reproducible cases in this repository—not synthetic “vulnera
 
 | Case | Finding | Why it matters |
 | --- | --- | --- |
+| [`dsh-cloudflare-browser-run@0.1.1`](examples/reports/dsh-cloudflare-browser-run-0.1.1.txt) | 18 resolved packages, 2 unresolved optional Cordis edges, 0 known vulnerabilities, and DSH rc.6/rc.7 both loaded the bundle | A real browser plugin demonstrates the DSH admission boundary and why incomplete edges stay visible. |
 | [50-plugin batch](examples/dsh/reports/dsh-batch-50-2026-08-17.md) | 0 confirmed runtime dependency vulnerabilities; 3 lockfile root-version mismatches | Monitoring can be wrong even when the vulnerability count is zero. |
 | [`dsh-feishu-bot@0.15.8`](examples/dsh/reports/dsh-feishu-bot-0.15.8-review-2026-08-18.md) | 89-package graph, 12 unresolved optional edges, reachable `protobufjs` `postinstall`, DSH rc.6/rc.7 compatible | “No known CVE” is not the same as “no installation trust boundary.” |
 | [DSH-TUI source vs npm](examples/dsh/reports/dsh-tui-source-vs-npm-2026-08-18.md) | Source has `prepare`; published artifact does not | Source-only and artifact-only reviews answer different questions. |
@@ -43,30 +91,27 @@ These are real, reproducible cases in this repository—not synthetic “vulnera
 
 We report a confirmed vulnerability only when the affected exact version and runtime path are supported by the available evidence. Development-only hits, missing data, and advisory-source outages remain visibly different states.
 
-## The core workflow
+## The dependency graph behind every alert
 
 ```text
-DSH plugin source / npm artifact
-          ↓
-exact dependency graph + DSH compatibility evidence
-          ↓
-saved observation point
-          ↓
-upstream commit, package, or advisory changes
-          ↓
-affected-plugin paths and author-facing next action
-          ↓
-optional DSH Agent analysis only when a meaningful change exists
+plugin@1.0.0
+├── framework@2.4.7
+│   ├── parser@3.2.1
+│   └── archive@1.8.0
+└── logger@4.0.2
+    └── parser@2.9.0  ← the affected physical node
 ```
 
+Two copies of `parser` are different nodes. An alert names the exact version and path that entered the DSH profile; it does not page every plugin that happens to use the same package name.
+
 For a collection of saved reports, build the reverse index that turns an upstream package update into affected plugins:
 
 ```bash
-npx --yes upstream-radar@0.34.0 graph reverse ./reports \
+npx --yes upstream-radar@0.35.0 graph reverse ./reports \
   --output reverse-dependency-index.json
 
 # Ask: which plugins currently depend on this exact package?
-npx --yes upstream-radar@0.34.0 graph reverse ./reports \
+npx --yes upstream-radar@0.35.0 graph reverse ./reports \
   --package parser@2.9.0
 ```
 
@@ -83,7 +128,7 @@ It also preserves whether the graph is complete or has unresolved optional/peer
 The repository already contains a reusable, composite Action in [`action.yml`](action.yml). It runs the same frozen Radar check in CI and writes a short Job Summary.
 
 ```yaml
-- uses: MicroMilo/upstream-radar@v0.34.0
+- uses: MicroMilo/upstream-radar@v0.35.0
   with:
     config: upstream-radar.config.json
     fail-on: high
@@ -107,7 +152,7 @@ See the [consumer workflow](examples/github-actions/consumer/README.md) for conf
 pnpm add upstream-radar
 
 # Generate a reviewable DSH profile inventory from the installed profile
-npx --yes upstream-radar@0.34.0 setup
+npx --yes upstream-radar@0.35.0 setup
 ```
 
 For Feishu/webhook routing, DSH Agent handoff, observer state, report schemas, and troubleshooting, use the [full Chinese guide](docs/README.zh-CN.md). The [architecture notes](docs/architecture.md) explain the boundaries and evidence model.

package/dist/src/index.d.ts

@@ -23,6 +23,7 @@ export { DSH_CASE_SCHEMA, createDshCaseReport, renderDshCase, type DshCaseCheck,
 export { QUICKSTART_SCHEMA, createQuickstartReport, renderQuickstartReport, type QuickstartEffect, type QuickstartMode, type QuickstartOptions, type QuickstartReport, type QuickstartStep, } from './quickstart.js';
 export { extractAnalysisTaskIds, parseAgentAnalysisResult, renderAnalysisTaskMarker, } from './dsh-analysis-result.js';
 export { parsePackageManifestSnapshot, parseRadarConfig } from './inventory.js';
+export { UPSTREAM_DOWNSTREAM_IR_SCHEMA, buildUpstreamDownstreamIR, parseUpstreamDownstreamIR, type AlignmentCheck, type AlignmentCheckCode, type AlignmentCoordinate, type AlignmentGraphStatus, type AlignmentStatus, type UpstreamDownstreamAlignmentInput, type UpstreamDownstreamIR, } from './upstream-alignment.js';
 export { OBSERVER_REPORT_SCHEMA, OBSERVER_TARGETS_SCHEMA, OBSERVATION_STATE_SCHEMA, UPSTREAM_CHANGE_TASK_SCHEMA, UpstreamObserverClient, createUpstreamChangeTask, emptyObservationState, loadObservationState, parseObservationState, parseObserverConfig, parseObserverConfigText, renderObserverReport, renderUpstreamChangeAgentPrompt, runDshAgentCommand, runOpenAiCompatibleAgent, runObserver, saveObservationState, type ObserverAgentCommandOptions, type OpenAiCompatibleAgentOptions, type ObserverAgentInvocation, type ObserverChange, type ObserverConfig, type ObserverEcosystem, type ObserverGraphChange, type ObserverLockfileType, type ObserverManifestChange, type ObserverPackageObservation, type ObserverReport, type ObserverSnapshot, type ObserverSnapshotSummary, type ObserverSource, type ObserverSourceChange, type ObserverSourceObservation, type ObserverTarget, type ObservationState, type RunObserverOptions, type UpstreamChangeTask, type UpstreamObserverClientOptions, } from './upstream-observer.js';
 export { countPolicyHeldAnalysisTasks, createNotificationPolicyMap, decideProjectRadarNotification, decideRadarNotification, filterNotifiableRadarEvents, isRadarIncidentMuted, type NotificationDecision, type NotificationSuppressionReason, } from './notification-policy.js';
 export { createRadarConfigFromDshProfile, createRadarConfigFromNpmLock, createRadarConfigFromPnpmLock, discoverDshProfiles, refreshRadarConfigFromConfiguredProfile, refreshRadarConfigFromDshProfile, resolveDshProfileDirectory, writeDshPatch, writeRadarConfig, type DshInitOptions, type NpmLockInitOptions, type PnpmLockInitOptions, type InitInspector, type WriteDshPatchOptions, type WriteRadarConfigOptions, } from './init.js';

package/dist/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,yBAAyB,EACzB,eAAe,EACf,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,aAAa,GACnB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC9G,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,0BAA0B,EAC1B,kCAAkC,EAClC,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,kCAAkC,EACvC,KAAK,oBAAoB,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EACL,sCAAsC,EACtC,yBAAyB,EACzB,kCAAkC,EAClC,iDAAiD,GAClD,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,UAAU,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,KAAK,yBAAyB,EAAE,KAAK,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAC7I,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,KAAK,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AACvH,OAAO,EAAE,mBAAmB,EAAE,KAAK,0BAA0B,EAAE,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACtI,OAAO,EAAE,oBAAoB,EAAE,KAAK,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAC7F,OAAO,EACL,aAAa,EACb,UAAU,EACV,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,eAAe,EACf,SAAS,EACT,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,KAAK,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AACzH,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,EACf,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,yBAAyB,EACzB,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,GAClC,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC1I,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAA;AACvG,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,+BAA+B,EAC/B,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,GACnC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,6BAA6B,GACnC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,EACnB,uCAAuC,EACvC,gCAAgC,EAChC,0BAA0B,EAC1B,aAAa,EACb,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,+BAA+B,EAC/B,uCAAuC,EACvC,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,EAChB,yBAAyB,EACzB,6BAA6B,EAC7B,qCAAqC,EACrC,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,KAAK,6BAA6B,EAAE,MAAM,6BAA6B,CAAA;AACpI,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACpH,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EACL,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,KAAK,oBAAoB,GAC1B,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,6BAA6B,EAClC,KAAK,mCAAmC,EACxC,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,kBAAkB,EACvB,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,qCAAqC,EAC1C,KAAK,2CAA2C,EAChD,KAAK,gCAAgC,EACrC,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,WAAW,EAChB,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,yBAAyB,EACzB,eAAe,EACf,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,aAAa,GACnB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC9G,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,0BAA0B,EAC1B,kCAAkC,EAClC,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,kCAAkC,EACvC,KAAK,oBAAoB,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EACL,sCAAsC,EACtC,yBAAyB,EACzB,kCAAkC,EAClC,iDAAiD,GAClD,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,UAAU,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,KAAK,yBAAyB,EAAE,KAAK,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAC7I,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,KAAK,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AACvH,OAAO,EAAE,mBAAmB,EAAE,KAAK,0BAA0B,EAAE,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACtI,OAAO,EAAE,oBAAoB,EAAE,KAAK,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAC7F,OAAO,EACL,aAAa,EACb,UAAU,EACV,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,eAAe,EACf,SAAS,EACT,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,KAAK,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AACzH,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,EACf,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,yBAAyB,EACzB,KAAK,gCAAgC,EACrC,KAAK,4BAA4B,GAClC,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC1I,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAA;AACvG,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC/E,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,gCAAgC,EACrC,KAAK,oBAAoB,GAC1B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,+BAA+B,EAC/B,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,GACnC,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,6BAA6B,GACnC,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,EACnB,uCAAuC,EACvC,gCAAgC,EAChC,0BAA0B,EAC1B,aAAa,EACb,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,+BAA+B,EAC/B,uCAAuC,EACvC,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,EAChB,yBAAyB,EACzB,6BAA6B,EAC7B,qCAAqC,EACrC,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,KAAK,6BAA6B,EAAE,MAAM,6BAA6B,CAAA;AACpI,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACpH,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EACL,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,KAAK,oBAAoB,GAC1B,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,6BAA6B,EAClC,KAAK,mCAAmC,EACxC,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,kBAAkB,EACvB,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,qCAAqC,EAC1C,KAAK,2CAA2C,EAChD,KAAK,gCAAgC,EACrC,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,WAAW,EAChB,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAA"}

package/dist/src/index.js

@@ -23,6 +23,7 @@ export { DSH_CASE_SCHEMA, createDshCaseReport, renderDshCase, } from './dsh-case
 export { QUICKSTART_SCHEMA, createQuickstartReport, renderQuickstartReport, } from './quickstart.js';
 export { extractAnalysisTaskIds, parseAgentAnalysisResult, renderAnalysisTaskMarker, } from './dsh-analysis-result.js';
 export { parsePackageManifestSnapshot, parseRadarConfig } from './inventory.js';
+export { UPSTREAM_DOWNSTREAM_IR_SCHEMA, buildUpstreamDownstreamIR, parseUpstreamDownstreamIR, } from './upstream-alignment.js';
 export { OBSERVER_REPORT_SCHEMA, OBSERVER_TARGETS_SCHEMA, OBSERVATION_STATE_SCHEMA, UPSTREAM_CHANGE_TASK_SCHEMA, UpstreamObserverClient, createUpstreamChangeTask, emptyObservationState, loadObservationState, parseObservationState, parseObserverConfig, parseObserverConfigText, renderObserverReport, renderUpstreamChangeAgentPrompt, runDshAgentCommand, runOpenAiCompatibleAgent, runObserver, saveObservationState, } from './upstream-observer.js';
 export { countPolicyHeldAnalysisTasks, createNotificationPolicyMap, decideProjectRadarNotification, decideRadarNotification, filterNotifiableRadarEvents, isRadarIncidentMuted, } from './notification-policy.js';
 export { createRadarConfigFromDshProfile, createRadarConfigFromNpmLock, createRadarConfigFromPnpmLock, discoverDshProfiles, refreshRadarConfigFromConfiguredProfile, refreshRadarConfigFromDshProfile, resolveDshProfileDirectory, writeDshPatch, writeRadarConfig, } from './init.js';

package/dist/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,yBAAyB,EACzB,eAAe,EACf,wBAAwB,GAKzB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC9G,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,0BAA0B,EAC1B,kCAAkC,GASnC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EACL,sCAAsC,EACtC,yBAAyB,EACzB,kCAAkC,EAClC,iDAAiD,GAClD,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAyB,MAAM,UAAU,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAA4F,MAAM,kBAAkB,CAAA;AAC7I,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAuC,MAAM,oBAAoB,CAAA;AACvH,OAAO,EAAE,mBAAmB,EAA+E,MAAM,qBAAqB,CAAA;AACtI,OAAO,EAAE,oBAAoB,EAAoC,MAAM,sBAAsB,CAAA;AAC7F,OAAO,EACL,aAAa,EACb,UAAU,EACV,uBAAuB,GAKxB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,eAAe,EACf,SAAS,GAMV,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAiC,MAAM,oBAAoB,CAAA;AACzH,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,GASxB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,GAKhB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,yBAAyB,GAG1B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC1I,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,qBAAqB,EACrB,4BAA4B,GAU7B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,EAAmB,MAAM,WAAW,CAAA;AACvG,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,aAAa,GAId,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,GAMvB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,+BAA+B,EAC/B,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,oBAAoB,GAsBrB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,GAGrB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,EACnB,uCAAuC,EACvC,gCAAgC,EAChC,0BAA0B,EAC1B,aAAa,EACb,gBAAgB,GAOjB,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,+BAA+B,EAC/B,uCAAuC,EACvC,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,EAChB,yBAAyB,EACzB,6BAA6B,EAC7B,qCAAqC,GAMtC,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,GAItB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GAUpB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,GAG5B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,2BAA2B,EAAE,qBAAqB,EAAsC,MAAM,6BAA6B,CAAA;AACpI,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,GAMd,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACpH,OAAO,EAAE,aAAa,EAAoB,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAyD,MAAM,UAAU,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EACL,aAAa,GAed,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GAmDxB,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,yBAAyB,EACzB,eAAe,EACf,wBAAwB,GAKzB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC9G,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,0BAA0B,EAC1B,kCAAkC,GASnC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EACL,sCAAsC,EACtC,yBAAyB,EACzB,kCAAkC,EAClC,iDAAiD,GAClD,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAyB,MAAM,UAAU,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAA4F,MAAM,kBAAkB,CAAA;AAC7I,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAuC,MAAM,oBAAoB,CAAA;AACvH,OAAO,EAAE,mBAAmB,EAA+E,MAAM,qBAAqB,CAAA;AACtI,OAAO,EAAE,oBAAoB,EAAoC,MAAM,sBAAsB,CAAA;AAC7F,OAAO,EACL,aAAa,EACb,UAAU,EACV,uBAAuB,GAKxB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,eAAe,EACf,SAAS,GAMV,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAiC,MAAM,oBAAoB,CAAA;AACzH,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,GASxB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,GAKhB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,yBAAyB,GAG1B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC1I,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,qBAAqB,EACrB,4BAA4B,GAU7B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,EAAmB,MAAM,WAAW,CAAA;AACvG,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,aAAa,GAId,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,GAMvB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC/E,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,GAQ1B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,+BAA+B,EAC/B,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,oBAAoB,GAsBrB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,GAGrB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,EACnB,uCAAuC,EACvC,gCAAgC,EAChC,0BAA0B,EAC1B,aAAa,EACb,gBAAgB,GAOjB,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,+BAA+B,EAC/B,uCAAuC,EACvC,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,EAChB,yBAAyB,EACzB,6BAA6B,EAC7B,qCAAqC,GAMtC,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,GAItB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GAUpB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,GAG5B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,2BAA2B,EAAE,qBAAqB,EAAsC,MAAM,6BAA6B,CAAA;AACpI,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,GAMd,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACpH,OAAO,EAAE,aAAa,EAAoB,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAyD,MAAM,UAAU,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EACL,aAAa,GAed,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GAmDxB,MAAM,kBAAkB,CAAA"}

package/dist/src/upstream-alignment.d.ts

@@ -0,0 +1,67 @@
+import type { DependencyGraph, PackageManifestSnapshot } from './radar-types.js';
+/**
+ * The small, machine-readable boundary between source and what downstream
+ * users actually consume. It deliberately describes evidence and alignment;
+ * it is not a security verdict.
+ */
+export declare const UPSTREAM_DOWNSTREAM_IR_SCHEMA: 'upstream-radar.upstream-downstream-ir/v1alpha1';
+export type AlignmentStatus = 'aligned' | 'mismatch' | 'unknown';
+export type AlignmentGraphStatus = 'complete' | 'incomplete' | 'unavailable';
+export type AlignmentCheckCode = 'source-published-identity' | 'source-graph-root' | 'published-graph-root' | 'dependency-graph-coverage';
+export interface AlignmentCoordinate {
+    name: string;
+    version: string;
+}
+export interface AlignmentCheck {
+    code: AlignmentCheckCode;
+    status: AlignmentStatus;
+    summary: string;
+    upstream?: string;
+    downstream?: string;
+    remediation?: string;
+}
+export interface UpstreamDownstreamIR {
+    schema: typeof UPSTREAM_DOWNSTREAM_IR_SCHEMA;
+    targetId: string;
+    ecosystem: 'dsh' | 'codex' | 'pi';
+    upstream: {
+        repository: string;
+        commit: string;
+        packagePath: string;
+        coordinate: AlignmentCoordinate;
+    };
+    downstream: {
+        published?: AlignmentCoordinate;
+        graph: {
+            status: AlignmentGraphStatus;
+            root?: AlignmentCoordinate;
+            digest?: string;
+            nodes: number;
+            edges: number;
+            unresolved: number;
+        };
+    };
+    status: AlignmentStatus;
+    checks: AlignmentCheck[];
+}
+export interface UpstreamDownstreamAlignmentInput {
+    targetId: string;
+    ecosystem: 'dsh' | 'codex' | 'pi';
+    source: {
+        repository: string;
+        commit: string;
+        packagePath: string;
+    };
+    manifest: PackageManifestSnapshot;
+    package?: {
+        name: string;
+        version: string;
+    };
+    graph?: DependencyGraph;
+    graphError?: string;
+}
+/** Build the IR without fetching, installing, or executing anything. */
+export declare function buildUpstreamDownstreamIR(input: UpstreamDownstreamAlignmentInput): UpstreamDownstreamIR;
+/** Validate persisted IR before it is exposed to reports or an Agent prompt. */
+export declare function parseUpstreamDownstreamIR(value: unknown, label?: string): UpstreamDownstreamIR;
+//# sourceMappingURL=upstream-alignment.d.ts.map

package/dist/src/upstream-alignment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-alignment.d.ts","sourceRoot":"","sources":["../../src/upstream-alignment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAEhF;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAG,gDAAyD,CAAA;AAEtG,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAA;AAChE,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,YAAY,GAAG,aAAa,CAAA;AAC5E,MAAM,MAAM,kBAAkB,GAC1B,2BAA2B,GAC3B,mBAAmB,GACnB,sBAAsB,GACtB,2BAA2B,CAAA;AAE/B,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAA;IACxB,MAAM,EAAE,eAAe,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,OAAO,6BAA6B,CAAA;IAC5C,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,KAAK,GAAG,OAAO,GAAG,IAAI,CAAA;IACjC,QAAQ,EAAE;QACR,UAAU,EAAE,MAAM,CAAA;QAClB,MAAM,EAAE,MAAM,CAAA;QACd,WAAW,EAAE,MAAM,CAAA;QACnB,UAAU,EAAE,mBAAmB,CAAA;KAChC,CAAA;IACD,UAAU,EAAE;QACV,SAAS,CAAC,EAAE,mBAAmB,CAAA;QAC/B,KAAK,EAAE;YACL,MAAM,EAAE,oBAAoB,CAAA;YAC5B,IAAI,CAAC,EAAE,mBAAmB,CAAA;YAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;YACf,KAAK,EAAE,MAAM,CAAA;YACb,KAAK,EAAE,MAAM,CAAA;YACb,UAAU,EAAE,MAAM,CAAA;SACnB,CAAA;KACF,CAAA;IACD,MAAM,EAAE,eAAe,CAAA;IACvB,MAAM,EAAE,cAAc,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,KAAK,GAAG,OAAO,GAAG,IAAI,CAAA;IACjC,MAAM,EAAE;QACN,UAAU,EAAE,MAAM,CAAA;QAClB,MAAM,EAAE,MAAM,CAAA;QACd,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,QAAQ,EAAE,uBAAuB,CAAA;IACjC,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,KAAK,CAAC,EAAE,eAAe,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAwBD,wEAAwE;AACxE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,gCAAgC,GAAG,oBAAoB,CA0IvG;AAuBD,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAc,GAAG,oBAAoB,CAmEnG"}

package/dist/src/upstream-alignment.js

@@ -0,0 +1,263 @@
+/**
+ * The small, machine-readable boundary between source and what downstream
+ * users actually consume. It deliberately describes evidence and alignment;
+ * it is not a security verdict.
+ */
+export const UPSTREAM_DOWNSTREAM_IR_SCHEMA = 'upstream-radar.upstream-downstream-ir/v1alpha1';
+function coordinateText(value) {
+    return value === undefined ? 'unknown' : `${value.name}@${value.version}`;
+}
+function coordinateFromManifest(manifest) {
+    return { name: manifest.name, version: manifest.version };
+}
+function coordinateFromNode(value) {
+    return value === undefined ? undefined : { name: value.name, version: value.version };
+}
+function sameCoordinate(left, right) {
+    return left?.name === right?.name && left?.version === right?.version;
+}
+function overallStatus(checks) {
+    if (checks.some(check => check.status === 'mismatch'))
+        return 'mismatch';
+    if (checks.some(check => check.status === 'unknown'))
+        return 'unknown';
+    return 'aligned';
+}
+/** Build the IR without fetching, installing, or executing anything. */
+export function buildUpstreamDownstreamIR(input) {
+    const upstream = coordinateFromManifest(input.manifest);
+    const published = input.package === undefined
+        ? undefined
+        : { name: input.package.name, version: input.package.version };
+    const graphRoot = input.graph === undefined
+        ? undefined
+        : coordinateFromNode(input.graph.nodes.find(node => node.id === input.graph?.rootNodeId));
+    const unresolved = input.graph?.unresolved?.length ?? 0;
+    const graphStatus = input.graph === undefined
+        ? 'unavailable'
+        : unresolved > 0 || input.graphError !== undefined
+            ? 'incomplete'
+            : 'complete';
+    const checks = [];
+    if (published === undefined) {
+        checks.push({
+            code: 'source-published-identity',
+            status: 'unknown',
+            summary: 'The published npm package was not observed, so source identity cannot be matched to downstream bytes.',
+            upstream: coordinateText(upstream),
+            remediation: 'Confirm the exact npm package name and make the registry observation available before treating source and artifact as one release.',
+        });
+    }
+    else if (sameCoordinate(upstream, published)) {
+        checks.push({
+            code: 'source-published-identity',
+            status: 'aligned',
+            summary: 'The source manifest and observed npm package have the same name and version.',
+            upstream: coordinateText(upstream),
+            downstream: coordinateText(published),
+        });
+    }
+    else {
+        checks.push({
+            code: 'source-published-identity',
+            status: 'mismatch',
+            summary: 'The source manifest and observed npm package do not identify the same name and version.',
+            upstream: coordinateText(upstream),
+            downstream: coordinateText(published),
+            remediation: 'Align package.json, the published npm package, and the observer target; if the names intentionally differ, document the build and publish mapping.',
+        });
+    }
+    if (graphRoot === undefined) {
+        checks.push({
+            code: 'source-graph-root',
+            status: 'unknown',
+            summary: input.graphError === undefined
+                ? 'No dependency graph root was observed.'
+                : `The dependency graph could not be established: ${input.graphError}`,
+            upstream: coordinateText(upstream),
+            remediation: 'Commit a supported lockfile or correct the configured package path/importer so the root can be verified.',
+        });
+    }
+    else if (sameCoordinate(upstream, graphRoot)) {
+        checks.push({
+            code: 'source-graph-root',
+            status: 'aligned',
+            summary: 'The lockfile graph root matches the source manifest.',
+            upstream: coordinateText(upstream),
+            downstream: coordinateText(graphRoot),
+        });
+    }
+    else {
+        checks.push({
+            code: 'source-graph-root',
+            status: 'mismatch',
+            summary: 'The lockfile graph root does not match the source manifest.',
+            upstream: coordinateText(upstream),
+            downstream: coordinateText(graphRoot),
+            remediation: 'Regenerate the lockfile from the intended package path and ensure its root name and version match package.json.',
+        });
+    }
+    if (published === undefined || graphRoot === undefined) {
+        checks.push({
+            code: 'published-graph-root',
+            status: 'unknown',
+            summary: 'The published package cannot be compared with the dependency graph root.',
+            upstream: coordinateText(published),
+            downstream: coordinateText(graphRoot),
+            remediation: 'Observe both the exact npm package and a complete lockfile graph before using the graph as downstream evidence.',
+        });
+    }
+    else if (sameCoordinate(published, graphRoot)) {
+        checks.push({
+            code: 'published-graph-root',
+            status: 'aligned',
+            summary: 'The dependency graph root matches the observed npm package.',
+            upstream: coordinateText(published),
+            downstream: coordinateText(graphRoot),
+        });
+    }
+    else {
+        checks.push({
+            code: 'published-graph-root',
+            status: 'mismatch',
+            summary: 'The dependency graph root does not identify the observed npm package.',
+            upstream: coordinateText(published),
+            downstream: coordinateText(graphRoot),
+            remediation: 'Fix the package/lockfile mapping before using this graph to describe the published artifact.',
+        });
+    }
+    checks.push({
+        code: 'dependency-graph-coverage',
+        status: graphStatus === 'complete' ? 'aligned' : 'unknown',
+        summary: graphStatus === 'complete'
+            ? 'All observed dependency edges are resolved.'
+            : graphStatus === 'incomplete'
+                ? `The dependency graph is incomplete${unresolved > 0 ? ` (${unresolved} unresolved edge${unresolved === 1 ? '' : 's'})` : ''}.`
+                : 'The dependency graph is unavailable.',
+        downstream: `${graphStatus}; ${input.graph?.nodes.length ?? 0} nodes, ${input.graph?.edges.length ?? 0} edges`,
+        ...(graphStatus === 'complete' ? {} : {
+            remediation: 'Resolve the missing lockfile or peer/optional edges; an empty vulnerability result is not complete coverage while this remains unknown.',
+        }),
+    });
+    return {
+        schema: UPSTREAM_DOWNSTREAM_IR_SCHEMA,
+        targetId: input.targetId,
+        ecosystem: input.ecosystem,
+        upstream: {
+            repository: input.source.repository,
+            commit: input.source.commit,
+            packagePath: input.source.packagePath,
+            coordinate: upstream,
+        },
+        downstream: {
+            ...(published === undefined ? {} : { published }),
+            graph: {
+                status: graphStatus,
+                ...(graphRoot === undefined ? {} : { root: graphRoot }),
+                ...(input.graph?.digest === undefined ? {} : { digest: input.graph.digest }),
+                nodes: input.graph?.nodes.length ?? 0,
+                edges: input.graph?.edges.length ?? 0,
+                unresolved,
+            },
+        },
+        status: overallStatus(checks),
+        checks,
+    };
+}
+function boundedString(value, label, max = 4_096) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > max)
+        throw new Error(`${label} must be a non-empty bounded string`);
+    return value;
+}
+function record(value, label) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new Error(`${label} must be an object`);
+    return value;
+}
+function alignmentStatus(value, label) {
+    const status = boundedString(value, label, 16);
+    if (status !== 'aligned' && status !== 'mismatch' && status !== 'unknown')
+        throw new Error(`${label} has an invalid status`);
+    return status;
+}
+function parseCoordinate(value, label) {
+    const source = record(value, label);
+    return { name: boundedString(source.name, `${label}.name`, 512), version: boundedString(source.version, `${label}.version`, 512) };
+}
+/** Validate persisted IR before it is exposed to reports or an Agent prompt. */
+export function parseUpstreamDownstreamIR(value, label = 'alignment') {
+    const source = record(value, label);
+    if (source.schema !== UPSTREAM_DOWNSTREAM_IR_SCHEMA)
+        throw new Error(`${label} has an unsupported schema`);
+    const targetId = boundedString(source.targetId, `${label}.targetId`, 128);
+    const ecosystem = boundedString(source.ecosystem, `${label}.ecosystem`, 16);
+    if (ecosystem !== 'dsh' && ecosystem !== 'codex' && ecosystem !== 'pi')
+        throw new Error(`${label}.ecosystem is invalid`);
+    const upstreamValue = record(source.upstream, `${label}.upstream`);
+    const upstreamSource = {
+        repository: boundedString(upstreamValue.repository, `${label}.upstream.repository`, 4_096),
+        commit: boundedString(upstreamValue.commit, `${label}.upstream.commit`, 256),
+        packagePath: boundedString(upstreamValue.packagePath, `${label}.upstream.packagePath`, 512),
+        coordinate: parseCoordinate(upstreamValue.coordinate, `${label}.upstream.coordinate`),
+    };
+    const downstreamValue = record(source.downstream, `${label}.downstream`);
+    const published = downstreamValue.published === undefined ? undefined : parseCoordinate(downstreamValue.published, `${label}.downstream.published`);
+    const graphValue = record(downstreamValue.graph, `${label}.downstream.graph`);
+    const graphStatus = boundedString(graphValue.status, `${label}.downstream.graph.status`, 16);
+    if (graphStatus !== 'complete' && graphStatus !== 'incomplete' && graphStatus !== 'unavailable')
+        throw new Error(`${label}.downstream.graph.status is invalid`);
+    const root = graphValue.root === undefined ? undefined : parseCoordinate(graphValue.root, `${label}.downstream.graph.root`);
+    const numberValue = (valueToCheck, field) => {
+        if (!Number.isSafeInteger(valueToCheck) || valueToCheck < 0 || valueToCheck > 1_000_000)
+            throw new Error(`${field} must be a bounded non-negative integer`);
+        return valueToCheck;
+    };
+    const digest = graphValue.digest === undefined ? undefined : boundedString(graphValue.digest, `${label}.downstream.graph.digest`, 512);
+    const checksValue = source.checks;
+    if (!Array.isArray(checksValue) || checksValue.length === 0 || checksValue.length > 32)
+        throw new Error(`${label}.checks must contain between 1 and 32 entries`);
+    const checks = checksValue.map((valueToCheck, index) => {
+        const check = record(valueToCheck, `${label}.checks[${index}]`);
+        const code = boundedString(check.code, `${label}.checks[${index}].code`, 64);
+        if (code !== 'source-published-identity' && code !== 'source-graph-root' && code !== 'published-graph-root' && code !== 'dependency-graph-coverage') {
+            throw new Error(`${label}.checks[${index}].code is invalid`);
+        }
+        const upstreamText = check.upstream === undefined ? undefined : boundedString(check.upstream, `${label}.checks[${index}].upstream`, 1_024);
+        const downstreamText = check.downstream === undefined ? undefined : boundedString(check.downstream, `${label}.checks[${index}].downstream`, 1_024);
+        const remediation = check.remediation === undefined ? undefined : boundedString(check.remediation, `${label}.checks[${index}].remediation`, 4_096);
+        return {
+            code,
+            status: alignmentStatus(check.status, `${label}.checks[${index}].status`),
+            summary: boundedString(check.summary, `${label}.checks[${index}].summary`, 4_096),
+            ...(upstreamText === undefined ? {} : { upstream: upstreamText }),
+            ...(downstreamText === undefined ? {} : { downstream: downstreamText }),
+            ...(remediation === undefined ? {} : { remediation }),
+        };
+    });
+    const duplicateCodes = checks.map(check => check.code).filter((code, index, values) => values.indexOf(code) !== index);
+    if (duplicateCodes.length > 0)
+        throw new Error(`${label}.checks must not contain duplicate codes`);
+    const parsedOverallStatus = alignmentStatus(source.status, `${label}.status`);
+    if (parsedOverallStatus !== overallStatus(checks))
+        throw new Error(`${label}.status does not match its check statuses`);
+    return {
+        schema: UPSTREAM_DOWNSTREAM_IR_SCHEMA,
+        targetId,
+        ecosystem,
+        upstream: upstreamSource,
+        downstream: {
+            ...(published === undefined ? {} : { published }),
+            graph: {
+                status: graphStatus,
+                ...(root === undefined ? {} : { root }),
+                ...(digest === undefined ? {} : { digest }),
+                nodes: numberValue(graphValue.nodes, `${label}.downstream.graph.nodes`),
+                edges: numberValue(graphValue.edges, `${label}.downstream.graph.edges`),
+                unresolved: numberValue(graphValue.unresolved, `${label}.downstream.graph.unresolved`),
+            },
+        },
+        status: parsedOverallStatus,
+        checks,
+    };
+}
+//# sourceMappingURL=upstream-alignment.js.map

package/dist/src/upstream-alignment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-alignment.js","sourceRoot":"","sources":["../../src/upstream-alignment.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,gDAAyD,CAAA;AAkEtG,SAAS,cAAc,CAAC,KAAsC;IAC5D,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAA;AAC3E,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAiC;IAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAA;AAC3D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAoD;IAC9E,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;AACvF,CAAC;AAED,SAAS,cAAc,CAAC,IAAqC,EAAE,KAAsC;IACnG,OAAO,IAAI,EAAE,IAAI,KAAK,KAAK,EAAE,IAAI,IAAI,IAAI,EAAE,OAAO,KAAK,KAAK,EAAE,OAAO,CAAA;AACvE,CAAC;AAED,SAAS,aAAa,CAAC,MAAiC;IACtD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC;QAAE,OAAO,UAAU,CAAA;IACxE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IACtE,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,yBAAyB,CAAC,KAAuC;IAC/E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACvD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS;QAC3C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IAChE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS;QACzC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAA;IAC3F,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,CAAA;IACvD,MAAM,WAAW,GAAyB,KAAK,CAAC,KAAK,KAAK,SAAS;QACjE,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,UAAU,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAChD,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,UAAU,CAAA;IAChB,MAAM,MAAM,GAAqB,EAAE,CAAA;IAEnC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,uGAAuG;YAChH,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;YAClC,WAAW,EAAE,oIAAoI;SAClJ,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,8EAA8E;YACvF,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;YAClC,UAAU,EAAE,cAAc,CAAC,SAAS,CAAC;SACtC,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,yFAAyF;YAClG,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;YAClC,UAAU,EAAE,cAAc,CAAC,SAAS,CAAC;YACrC,WAAW,EAAE,oJAAoJ;SAClK,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,KAAK,CAAC,UAAU,KAAK,SAAS;gBACrC,CAAC,CAAC,wCAAwC;gBAC1C,CAAC,CAAC,kDAAkD,KAAK,CAAC,UAAU,EAAE;YACxE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;YAClC,WAAW,EAAE,0GAA0G;SACxH,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,sDAAsD;YAC/D,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;YAClC,UAAU,EAAE,cAAc,CAAC,SAAS,CAAC;SACtC,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,6DAA6D;YACtE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;YAClC,UAAU,EAAE,cAAc,CAAC,SAAS,CAAC;YACrC,WAAW,EAAE,iHAAiH;SAC/H,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,0EAA0E;YACnF,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC;YACnC,UAAU,EAAE,cAAc,CAAC,SAAS,CAAC;YACrC,WAAW,EAAE,iHAAiH;SAC/H,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,6DAA6D;YACtE,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC;YACnC,UAAU,EAAE,cAAc,CAAC,SAAS,CAAC;SACtC,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,uEAAuE;YAChF,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC;YACnC,UAAU,EAAE,cAAc,CAAC,SAAS,CAAC;YACrC,WAAW,EAAE,8FAA8F;SAC5G,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC1D,OAAO,EAAE,WAAW,KAAK,UAAU;YACjC,CAAC,CAAC,6CAA6C;YAC/C,CAAC,CAAC,WAAW,KAAK,YAAY;gBAC5B,CAAC,CAAC,qCAAqC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,mBAAmB,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;gBAChI,CAAC,CAAC,sCAAsC;QAC5C,UAAU,EAAE,GAAG,WAAW,KAAK,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,WAAW,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ;QAC9G,GAAG,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACpC,WAAW,EAAE,yIAAyI;SACvJ,CAAC;KACH,CAAC,CAAA;IAEF,OAAO;QACL,MAAM,EAAE,6BAA6B;QACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE;YACR,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;YACnC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;YAC3B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;YACrC,UAAU,EAAE,QAAQ;SACrB;QACD,UAAU,EAAE;YACV,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YACjD,KAAK,EAAE;gBACL,MAAM,EAAE,WAAW;gBACnB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBACvD,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC5E,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;gBACrC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;gBACrC,UAAU;aACX;SACF;QACD,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;QAC7B,MAAM;KACP,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa,EAAE,GAAG,GAAG,KAAK;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAA;IACzI,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAA;IACtH,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAoB,CAAA;IACjE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAA;IAC5H,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACnC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,UAAU,EAAE,GAAG,CAAC,EAAE,CAAA;AACpI,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,yBAAyB,CAAC,KAAc,EAAE,KAAK,GAAG,WAAW;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACnC,IAAI,MAAM,CAAC,MAAM,KAAK,6BAA6B;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAA;IAC1G,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,EAAE,GAAG,CAAC,CAAA;IACzE,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,CAAsC,CAAA;IAChH,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAA;IACxH,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC,CAAA;IAClE,MAAM,cAAc,GAAG;QACrB,UAAU,EAAE,aAAa,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,KAAK,sBAAsB,EAAE,KAAK,CAAC;QAC1F,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,KAAK,kBAAkB,EAAE,GAAG,CAAC;QAC5E,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,KAAK,uBAAuB,EAAE,GAAG,CAAC;QAC3F,UAAU,EAAE,eAAe,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,KAAK,sBAAsB,CAAC;KACtF,CAAA;IACD,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,KAAK,aAAa,CAAC,CAAA;IACxE,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAA;IACnJ,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAA;IAC7E,MAAM,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,KAAK,0BAA0B,EAAE,EAAE,CAAyB,CAAA;IACpH,IAAI,WAAW,KAAK,UAAU,IAAI,WAAW,KAAK,YAAY,IAAI,WAAW,KAAK,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAA;IAC/J,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,KAAK,wBAAwB,CAAC,CAAA;IAC3H,MAAM,WAAW,GAAG,CAAC,YAAqB,EAAE,KAAa,EAAU,EAAE;QACnE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAK,YAAuB,GAAG,CAAC,IAAK,YAAuB,GAAG,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAA;QACnL,OAAO,YAAsB,CAAA;IAC/B,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,KAAK,0BAA0B,EAAE,GAAG,CAAC,CAAA;IACtI,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAA;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAA;IAChK,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,GAAG,KAAK,WAAW,KAAK,GAAG,CAAC,CAAA;QAC/D,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,WAAW,KAAK,QAAQ,EAAE,EAAE,CAAuB,CAAA;QAClG,IAAI,IAAI,KAAK,2BAA2B,IAAI,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;YACpJ,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW,KAAK,mBAAmB,CAAC,CAAA;QAC9D,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,KAAK,YAAY,EAAE,KAAK,CAAC,CAAA;QAC1I,MAAM,cAAc,GAAG,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,KAAK,WAAW,KAAK,cAAc,EAAE,KAAK,CAAC,CAAA;QAClJ,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,KAAK,WAAW,KAAK,eAAe,EAAE,KAAK,CAAC,CAAA;QAClJ,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,WAAW,KAAK,UAAU,CAAC;YACzE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,WAAW,KAAK,WAAW,EAAE,KAAK,CAAC;YACjF,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;YACjE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;YACvE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;SACtD,CAAA;IACH,CAAC,CAAC,CAAA;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;IACtH,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0CAA0C,CAAC,CAAA;IAClG,MAAM,mBAAmB,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAA;IAC7E,IAAI,mBAAmB,KAAK,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2CAA2C,CAAC,CAAA;IACvH,OAAO;QACL,MAAM,EAAE,6BAA6B;QACrC,QAAQ;QACR,SAAS;QACT,QAAQ,EAAE,cAAc;QACxB,UAAU,EAAE;YACV,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YACjD,KAAK,EAAE;gBACL,MAAM,EAAE,WAAW;gBACnB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;gBAC3C,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,KAAK,yBAAyB,CAAC;gBACvE,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,KAAK,yBAAyB,CAAC;gBACvE,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,KAAK,8BAA8B,CAAC;aACvF;SACF;QACD,MAAM,EAAE,mBAAmB;QAC3B,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/src/upstream-observer.d.ts

@@ -1,4 +1,5 @@
 import type { DshLoadMatrixReport } from './dsh-probe.js';
+import { type UpstreamDownstreamIR } from './upstream-alignment.js';
 import type { DependencyGraph, PackageManifestSnapshot } from './radar-types.js';
 import type { CoverageVerdict, Finding, NpmEvidence, NpmInstallScriptPackage, ScanReport, Verdict, VulnerabilitySummary } from './types.js';
 export declare const OBSERVER_TARGETS_SCHEMA: 'upstream-radar.observer-targets/v1alpha1';
@@ -54,6 +55,7 @@ export interface ObserverSnapshot {
     graph?: DependencyGraph;
     graphError?: string;
     warnings?: string[];
+    alignment?: UpstreamDownstreamIR;
 }
 export interface ObserverSnapshotSummary {
     commit: string;
@@ -74,6 +76,7 @@ export interface ObserverSnapshotSummary {
     };
     graphError?: string;
     warnings?: string[];
+    alignment?: UpstreamDownstreamIR;
 }
 export interface ObserverSourceChange {
     beforeCommit: string;
@@ -230,6 +233,10 @@ export interface ObserverReport {
     checkedAt: string;
     targetsChecked: number;
     baselineTargets: string[];
+    alignmentFindings: Array<{
+        targetId: string;
+        alignment: UpstreamDownstreamIR;
+    }>;
     changes: ObserverChange[];
     pendingTasks: string[];
     pendingTaskDetails: ObserverPendingTaskSummary[];