upstream-radar 0.34.0 → 0.36.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +87 -24
- package/dist/src/cli.js +12 -4
- package/dist/src/cli.js.map +1 -1
- package/dist/src/dependency-index.d.ts +32 -0
- package/dist/src/dependency-index.d.ts.map +1 -1
- package/dist/src/dependency-index.js +230 -0
- package/dist/src/dependency-index.js.map +1 -1
- package/dist/src/index.d.ts +2 -1
- package/dist/src/index.d.ts.map +1 -1
- package/dist/src/index.js +2 -1
- package/dist/src/index.js.map +1 -1
- package/dist/src/upstream-alignment.d.ts +67 -0
- package/dist/src/upstream-alignment.d.ts.map +1 -0
- package/dist/src/upstream-alignment.js +263 -0
- package/dist/src/upstream-alignment.js.map +1 -0
- package/dist/src/upstream-observer.d.ts +20 -0
- package/dist/src/upstream-observer.d.ts.map +1 -1
- package/dist/src/upstream-observer.js +156 -4
- package/dist/src/upstream-observer.js.map +1 -1
- package/dist/src/version.d.ts +1 -1
- package/dist/src/version.js +1 -1
- package/docs/README.zh-CN.md +54 -18
- package/package.json +1 -1
- package/schemas/reverse-dependency-index.schema.json +132 -0
- package/schemas/upstream-downstream-ir.schema.json +87 -0
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "upstream-radar",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.36.0",
|
|
4
4
|
"description": "Always-on dependency security monitoring for DeepSeek Harness (DSH) plugins: find exact installed or candidate transitive vulnerable paths and breaking updates, then route evidence to a DSH Agent.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -0,0 +1,132 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3
|
+
"$id": "https://github.com/MicroMilo/upstream-radar/blob/main/schemas/reverse-dependency-index.schema.json",
|
|
4
|
+
"title": "Upstream Radar reverse dependency index",
|
|
5
|
+
"description": "A deterministic index from exact npm dependency coordinates to downstream plugin graphs.",
|
|
6
|
+
"type": "object",
|
|
7
|
+
"additionalProperties": false,
|
|
8
|
+
"required": ["schema", "generatedAt", "observations", "inputs", "coverage", "plugins", "dependencies"],
|
|
9
|
+
"properties": {
|
|
10
|
+
"schema": { "const": "upstream-radar.reverse-dependency-index/v1alpha1" },
|
|
11
|
+
"generatedAt": { "type": "string", "minLength": 1, "maxLength": 128, "format": "date-time" },
|
|
12
|
+
"observations": { "type": "integer", "minimum": 0 },
|
|
13
|
+
"inputs": { "$ref": "#/$defs/inputs" },
|
|
14
|
+
"coverage": { "$ref": "#/$defs/coverage" },
|
|
15
|
+
"plugins": {
|
|
16
|
+
"type": "array",
|
|
17
|
+
"items": { "$ref": "#/$defs/plugin" }
|
|
18
|
+
},
|
|
19
|
+
"dependencies": {
|
|
20
|
+
"type": "array",
|
|
21
|
+
"items": { "$ref": "#/$defs/dependency" }
|
|
22
|
+
}
|
|
23
|
+
},
|
|
24
|
+
"$defs": {
|
|
25
|
+
"coordinate": {
|
|
26
|
+
"type": "object",
|
|
27
|
+
"additionalProperties": false,
|
|
28
|
+
"required": ["ecosystem", "name", "version"],
|
|
29
|
+
"properties": {
|
|
30
|
+
"ecosystem": { "const": "npm" },
|
|
31
|
+
"name": { "type": "string", "minLength": 1, "maxLength": 512 },
|
|
32
|
+
"version": { "type": "string", "minLength": 1, "maxLength": 512 }
|
|
33
|
+
}
|
|
34
|
+
},
|
|
35
|
+
"project": {
|
|
36
|
+
"type": "object",
|
|
37
|
+
"additionalProperties": false,
|
|
38
|
+
"required": ["id", "name"],
|
|
39
|
+
"properties": {
|
|
40
|
+
"id": { "type": "string", "minLength": 1, "maxLength": 256 },
|
|
41
|
+
"name": { "type": "string", "minLength": 1, "maxLength": 512 }
|
|
42
|
+
}
|
|
43
|
+
},
|
|
44
|
+
"path": {
|
|
45
|
+
"type": "object",
|
|
46
|
+
"additionalProperties": false,
|
|
47
|
+
"required": ["nodes", "kinds"],
|
|
48
|
+
"properties": {
|
|
49
|
+
"nodes": { "type": "array", "minItems": 2, "items": { "type": "string", "minLength": 1, "maxLength": 1024 } },
|
|
50
|
+
"kinds": {
|
|
51
|
+
"type": "array",
|
|
52
|
+
"items": { "enum": ["runtime", "development", "optional", "peer", "host-runtime"] }
|
|
53
|
+
}
|
|
54
|
+
}
|
|
55
|
+
},
|
|
56
|
+
"use": {
|
|
57
|
+
"type": "object",
|
|
58
|
+
"additionalProperties": false,
|
|
59
|
+
"required": ["pluginId", "plugin", "sources", "coverage", "paths"],
|
|
60
|
+
"properties": {
|
|
61
|
+
"pluginId": { "type": "string", "minLength": 1, "maxLength": 1024 },
|
|
62
|
+
"plugin": { "$ref": "#/$defs/coordinate" },
|
|
63
|
+
"project": { "$ref": "#/$defs/project" },
|
|
64
|
+
"sources": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 4096 } },
|
|
65
|
+
"coverage": { "enum": ["complete", "incomplete"] },
|
|
66
|
+
"paths": { "type": "array", "items": { "$ref": "#/$defs/path" } }
|
|
67
|
+
}
|
|
68
|
+
},
|
|
69
|
+
"dependency": {
|
|
70
|
+
"type": "object",
|
|
71
|
+
"additionalProperties": false,
|
|
72
|
+
"required": ["dependency", "dependents"],
|
|
73
|
+
"properties": {
|
|
74
|
+
"dependency": { "$ref": "#/$defs/coordinate" },
|
|
75
|
+
"dependents": { "type": "array", "items": { "$ref": "#/$defs/use" } }
|
|
76
|
+
}
|
|
77
|
+
},
|
|
78
|
+
"pluginObservation": {
|
|
79
|
+
"type": "object",
|
|
80
|
+
"additionalProperties": false,
|
|
81
|
+
"required": ["source", "coverage", "unresolved"],
|
|
82
|
+
"properties": {
|
|
83
|
+
"source": { "type": "string", "minLength": 1, "maxLength": 4096 },
|
|
84
|
+
"graphDigest": { "type": "string", "minLength": 1, "maxLength": 512 },
|
|
85
|
+
"coverage": { "enum": ["complete", "incomplete"] },
|
|
86
|
+
"unresolved": { "type": "integer", "minimum": 0 }
|
|
87
|
+
}
|
|
88
|
+
},
|
|
89
|
+
"plugin": {
|
|
90
|
+
"type": "object",
|
|
91
|
+
"additionalProperties": false,
|
|
92
|
+
"required": ["id", "plugin", "observations"],
|
|
93
|
+
"properties": {
|
|
94
|
+
"id": { "type": "string", "minLength": 1, "maxLength": 1024 },
|
|
95
|
+
"plugin": { "$ref": "#/$defs/coordinate" },
|
|
96
|
+
"project": { "$ref": "#/$defs/project" },
|
|
97
|
+
"observations": { "type": "array", "items": { "$ref": "#/$defs/pluginObservation" } }
|
|
98
|
+
}
|
|
99
|
+
},
|
|
100
|
+
"inputs": {
|
|
101
|
+
"type": "object",
|
|
102
|
+
"additionalProperties": false,
|
|
103
|
+
"required": ["files", "loadedFiles", "skipped"],
|
|
104
|
+
"properties": {
|
|
105
|
+
"files": { "type": "integer", "minimum": 0 },
|
|
106
|
+
"loadedFiles": { "type": "integer", "minimum": 0 },
|
|
107
|
+
"skipped": {
|
|
108
|
+
"type": "array",
|
|
109
|
+
"items": {
|
|
110
|
+
"type": "object",
|
|
111
|
+
"additionalProperties": false,
|
|
112
|
+
"required": ["source", "reason"],
|
|
113
|
+
"properties": {
|
|
114
|
+
"source": { "type": "string", "minLength": 1, "maxLength": 4096 },
|
|
115
|
+
"reason": { "type": "string", "minLength": 1, "maxLength": 2048 }
|
|
116
|
+
}
|
|
117
|
+
}
|
|
118
|
+
}
|
|
119
|
+
}
|
|
120
|
+
},
|
|
121
|
+
"coverage": {
|
|
122
|
+
"type": "object",
|
|
123
|
+
"additionalProperties": false,
|
|
124
|
+
"required": ["completeObservations", "incompleteObservations", "unresolvedEdges"],
|
|
125
|
+
"properties": {
|
|
126
|
+
"completeObservations": { "type": "integer", "minimum": 0 },
|
|
127
|
+
"incompleteObservations": { "type": "integer", "minimum": 0 },
|
|
128
|
+
"unresolvedEdges": { "type": "integer", "minimum": 0 }
|
|
129
|
+
}
|
|
130
|
+
}
|
|
131
|
+
}
|
|
132
|
+
}
|
|
@@ -0,0 +1,87 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3
|
+
"$id": "https://github.com/MicroMilo/upstream-radar/blob/main/schemas/upstream-downstream-ir.schema.json",
|
|
4
|
+
"title": "Upstream Radar upstream/downstream alignment IR",
|
|
5
|
+
"description": "Evidence-only alignment between a source package and the published package/dependency graph consumed downstream.",
|
|
6
|
+
"type": "object",
|
|
7
|
+
"additionalProperties": false,
|
|
8
|
+
"required": ["schema", "targetId", "ecosystem", "upstream", "downstream", "status", "checks"],
|
|
9
|
+
"properties": {
|
|
10
|
+
"schema": { "const": "upstream-radar.upstream-downstream-ir/v1alpha1" },
|
|
11
|
+
"targetId": { "type": "string", "minLength": 1, "maxLength": 128 },
|
|
12
|
+
"ecosystem": { "enum": ["dsh", "codex", "pi"] },
|
|
13
|
+
"upstream": {
|
|
14
|
+
"$ref": "#/$defs/upstream"
|
|
15
|
+
},
|
|
16
|
+
"downstream": {
|
|
17
|
+
"$ref": "#/$defs/downstream"
|
|
18
|
+
},
|
|
19
|
+
"status": { "$ref": "#/$defs/status" },
|
|
20
|
+
"checks": {
|
|
21
|
+
"type": "array",
|
|
22
|
+
"minItems": 1,
|
|
23
|
+
"maxItems": 32,
|
|
24
|
+
"items": { "$ref": "#/$defs/check" }
|
|
25
|
+
}
|
|
26
|
+
},
|
|
27
|
+
"$defs": {
|
|
28
|
+
"status": {
|
|
29
|
+
"enum": ["aligned", "mismatch", "unknown"]
|
|
30
|
+
},
|
|
31
|
+
"coordinate": {
|
|
32
|
+
"type": "object",
|
|
33
|
+
"additionalProperties": false,
|
|
34
|
+
"required": ["name", "version"],
|
|
35
|
+
"properties": {
|
|
36
|
+
"name": { "type": "string", "minLength": 1, "maxLength": 512 },
|
|
37
|
+
"version": { "type": "string", "minLength": 1, "maxLength": 512 }
|
|
38
|
+
}
|
|
39
|
+
},
|
|
40
|
+
"upstream": {
|
|
41
|
+
"type": "object",
|
|
42
|
+
"additionalProperties": false,
|
|
43
|
+
"required": ["repository", "commit", "packagePath", "coordinate"],
|
|
44
|
+
"properties": {
|
|
45
|
+
"repository": { "type": "string", "minLength": 1, "maxLength": 4096 },
|
|
46
|
+
"commit": { "type": "string", "minLength": 1, "maxLength": 256 },
|
|
47
|
+
"packagePath": { "type": "string", "minLength": 1, "maxLength": 512 },
|
|
48
|
+
"coordinate": { "$ref": "#/$defs/coordinate" }
|
|
49
|
+
}
|
|
50
|
+
},
|
|
51
|
+
"graph": {
|
|
52
|
+
"type": "object",
|
|
53
|
+
"additionalProperties": false,
|
|
54
|
+
"required": ["status", "nodes", "edges", "unresolved"],
|
|
55
|
+
"properties": {
|
|
56
|
+
"status": { "enum": ["complete", "incomplete", "unavailable"] },
|
|
57
|
+
"root": { "$ref": "#/$defs/coordinate" },
|
|
58
|
+
"digest": { "type": "string", "minLength": 1, "maxLength": 512 },
|
|
59
|
+
"nodes": { "type": "integer", "minimum": 0, "maximum": 1000000 },
|
|
60
|
+
"edges": { "type": "integer", "minimum": 0, "maximum": 1000000 },
|
|
61
|
+
"unresolved": { "type": "integer", "minimum": 0, "maximum": 1000000 }
|
|
62
|
+
}
|
|
63
|
+
},
|
|
64
|
+
"downstream": {
|
|
65
|
+
"type": "object",
|
|
66
|
+
"additionalProperties": false,
|
|
67
|
+
"required": ["graph"],
|
|
68
|
+
"properties": {
|
|
69
|
+
"published": { "$ref": "#/$defs/coordinate" },
|
|
70
|
+
"graph": { "$ref": "#/$defs/graph" }
|
|
71
|
+
}
|
|
72
|
+
},
|
|
73
|
+
"check": {
|
|
74
|
+
"type": "object",
|
|
75
|
+
"additionalProperties": false,
|
|
76
|
+
"required": ["code", "status", "summary"],
|
|
77
|
+
"properties": {
|
|
78
|
+
"code": { "enum": ["source-published-identity", "source-graph-root", "published-graph-root", "dependency-graph-coverage"] },
|
|
79
|
+
"status": { "$ref": "#/$defs/status" },
|
|
80
|
+
"summary": { "type": "string", "minLength": 1, "maxLength": 4096 },
|
|
81
|
+
"upstream": { "type": "string", "minLength": 1, "maxLength": 1024 },
|
|
82
|
+
"downstream": { "type": "string", "minLength": 1, "maxLength": 1024 },
|
|
83
|
+
"remediation": { "type": "string", "minLength": 1, "maxLength": 4096 }
|
|
84
|
+
}
|
|
85
|
+
}
|
|
86
|
+
}
|
|
87
|
+
}
|