upstream-radar 0.4.0

package/dist/src/dsh-plugin.d.ts

@@ -0,0 +1,45 @@
+import type { AnalysisTask, RadarState } from './radar-types.js';
+export declare const name = "upstream-radar";
+export declare const inject: string[];
+export interface Config {
+    configFile?: string;
+    stateFile?: string;
+    intervalSeconds?: number;
+    osvBaseUrl?: string;
+    runOnStart?: boolean;
+}
+export interface DshRadarMessage {
+    id: string;
+    role: 'user';
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    source: {
+        kind: 'plugin';
+        plugin: 'upstream-radar';
+        form: 'notice';
+        summary: string;
+    };
+}
+interface DshAgentLike {
+    followup(message: DshRadarMessage): void;
+}
+interface DshRadarContext {
+    agents: {
+        roots(): DshAgentLike[];
+    };
+    logger: {
+        info(message: string): void;
+        warn(message: string): void;
+    };
+    effect(setup: () => void | (() => void | Promise<void>), label?: string): void;
+    on(event: 'agent/created', listener: () => void): () => void;
+}
+export declare function createDshRadarMessage(task: AnalysisTask): DshRadarMessage;
+/** Synchronous follow-up admission is the acknowledgement boundary; failures stay queued. */
+export declare function deliverPendingAnalysisTasks(state: RadarState, agent: DshAgentLike): RadarState;
+/** Cordis function-plugin entrypoint. The polling loop stays deterministic; DSH receives only matched tasks. */
+export declare function apply(ctx: DshRadarContext, config?: Config): void;
+export {};
+//# sourceMappingURL=dsh-plugin.d.ts.map

package/dist/src/dsh-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsh-plugin.d.ts","sourceRoot":"","sources":["../../src/dsh-plugin.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAEhE,eAAO,MAAM,IAAI,mBAAmB,CAAA;AACpC,eAAO,MAAM,MAAM,UAAa,CAAA;AAEhC,MAAM,WAAW,MAAM;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9C,MAAM,EAAE;QACN,IAAI,EAAE,QAAQ,CAAA;QACd,MAAM,EAAE,gBAAgB,CAAA;QACxB,IAAI,EAAE,QAAQ,CAAA;QACd,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,UAAU,YAAY;IACpB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAAA;CACzC;AAED,UAAU,eAAe;IACvB,MAAM,EAAE;QACN,KAAK,IAAI,YAAY,EAAE,CAAA;KACxB,CAAA;IACD,MAAM,EAAE;QACN,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;QAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAC5B,CAAA;IACD,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9E,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAA;CAC7D;AAcD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY,GAAG,eAAe,CAYzE;AAED,6FAA6F;AAC7F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,GAAG,UAAU,CAY9F;AAaD,gHAAgH;AAChH,wBAAgB,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,GAAE,MAAW,GAAG,IAAI,CAqDrE"}

package/dist/src/dsh-plugin.js

@@ -0,0 +1,121 @@
+import { randomUUID } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { renderAgentAnalysisPrompt } from './dsh-analysis.js';
+import { parseRadarConfig } from './inventory.js';
+import { OsvClient } from './osv.js';
+import { NpmReleaseClient } from './npm-release.js';
+import { pollRadar } from './radar.js';
+import { loadRadarState, saveRadarState } from './radar-state.js';
+export const name = 'upstream-radar';
+export const inject = ['agents'];
+function safeMessage(error) {
+    const value = error instanceof Error ? error.message : String(error);
+    return value.replace(/[\u0000-\u001f\u007f-\u009f]/g, '?').slice(0, 2_048);
+}
+function taskSummary(task) {
+    const project = task.event.project.name.slice(0, 60);
+    return task.event.kind === 'compatibility'
+        ? `Compatibility change for ${project}`
+        : `${task.event.kind === 'malware' ? 'Malicious package' : 'Vulnerability'} for ${project}`;
+}
+export function createDshRadarMessage(task) {
+    return Object.freeze({
+        id: randomUUID(),
+        role: 'user',
+        content: [{ type: 'text', text: renderAgentAnalysisPrompt(task) }],
+        source: {
+            kind: 'plugin',
+            plugin: 'upstream-radar',
+            form: 'notice',
+            summary: taskSummary(task),
+        },
+    });
+}
+/** Synchronous follow-up admission is the acknowledgement boundary; failures stay queued. */
+export function deliverPendingAnalysisTasks(state, agent) {
+    let delivered = 0;
+    for (const task of state.pendingAnalysisTasks) {
+        try {
+            agent.followup(createDshRadarMessage(task));
+            delivered += 1;
+        }
+        catch {
+            break;
+        }
+    }
+    if (delivered === 0)
+        return state;
+    return { ...state, pendingAnalysisTasks: state.pendingAnalysisTasks.slice(delivered) };
+}
+async function readConfig(path) {
+    const contents = await readFile(path, 'utf8');
+    if (Buffer.byteLength(contents) > 256 * 1024 * 1024)
+        throw new Error('radar config exceeds the file size limit');
+    try {
+        return parseRadarConfig(JSON.parse(contents));
+    }
+    catch (error) {
+        if (error instanceof SyntaxError)
+            throw new Error('radar config is not valid JSON');
+        throw error;
+    }
+}
+/** Cordis function-plugin entrypoint. The polling loop stays deterministic; DSH receives only matched tasks. */
+export function apply(ctx, config = {}) {
+    if (config.configFile === undefined || config.configFile.trim() === '') {
+        ctx.logger.warn('upstream-radar: UPSTREAM_RADAR_CONFIG is not set; monitoring is dormant');
+        return;
+    }
+    const configFile = resolve(config.configFile);
+    const stateFile = resolve(config.stateFile ?? `${configFile}.state.json`);
+    const intervalSeconds = config.intervalSeconds ?? 1_800;
+    if (!Number.isSafeInteger(intervalSeconds) || intervalSeconds < 300 || intervalSeconds > 86_400) {
+        throw new Error('upstream-radar intervalSeconds must be between 300 and 86400');
+    }
+    const source = new OsvClient({ ...(config.osvBaseUrl === undefined ? {} : { baseUrl: config.osvBaseUrl }) });
+    const releases = new NpmReleaseClient();
+    ctx.effect(() => {
+        let stopped = false;
+        let serial = Promise.resolve();
+        const run = (poll) => {
+            serial = serial.then(async () => {
+                if (stopped)
+                    return;
+                let state = await loadRadarState(stateFile);
+                if (poll) {
+                    const radarConfig = await readConfig(configFile);
+                    const result = await pollRadar(radarConfig.projects, state, source, new Date(), releases);
+                    state = result.state;
+                    // Persist before model delivery. A crash may duplicate a task, but cannot silently lose it.
+                    await saveRadarState(stateFile, state);
+                    if (result.events.length > 0) {
+                        ctx.logger.info(`upstream-radar: ${result.events.length} change(s), ${result.analysisTasks.length} analysis task(s)`);
+                    }
+                    for (const error of result.sourceErrors) {
+                        ctx.logger.warn(`upstream-radar: ${error.source}: ${safeMessage(error.message)}`);
+                    }
+                }
+                const agent = ctx.agents.roots()[0];
+                if (agent === undefined || state.pendingAnalysisTasks.length === 0)
+                    return;
+                const next = deliverPendingAnalysisTasks(state, agent);
+                if (next !== state)
+                    await saveRadarState(stateFile, next);
+            }).catch((error) => {
+                ctx.logger.warn(`upstream-radar: cycle failed: ${safeMessage(error)}`);
+            });
+        };
+        const stopCreated = ctx.on('agent/created', () => { run(false); });
+        if (config.runOnStart !== false)
+            run(true);
+        const timer = setInterval(() => { run(true); }, intervalSeconds * 1_000);
+        return async () => {
+            stopped = true;
+            clearInterval(timer);
+            stopCreated();
+            await serial;
+        };
+    }, 'upstream-radar.lifecycle()');
+}
+//# sourceMappingURL=dsh-plugin.js.map

package/dist/src/dsh-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsh-plugin.js","sourceRoot":"","sources":["../../src/dsh-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGjE,MAAM,CAAC,MAAM,IAAI,GAAG,gBAAgB,CAAA;AACpC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;AAsChC,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpE,OAAO,KAAK,CAAC,OAAO,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;AAC5E,CAAC;AAED,SAAS,WAAW,CAAC,IAAkB;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACpD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe;QACxC,CAAC,CAAC,4BAA4B,OAAO,EAAE;QACvC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,QAAQ,OAAO,EAAE,CAAA;AAC/F,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAkB;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,UAAU,EAAE;QAChB,IAAI,EAAE,MAAe;QACrB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,EAAE;YACN,IAAI,EAAE,QAAiB;YACvB,MAAM,EAAE,gBAAyB;YACjC,IAAI,EAAE,QAAiB;YACvB,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC;SAC3B;KACF,CAAC,CAAA;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,2BAA2B,CAAC,KAAiB,EAAE,KAAmB;IAChF,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAA;YAC3C,SAAS,IAAI,CAAC,CAAA;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,MAAK;QACP,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACjC,OAAO,EAAE,GAAG,KAAK,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAA;AACxF,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC7C,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAChH,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAY,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnF,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,KAAK,CAAC,GAAoB,EAAE,MAAM,GAAW,EAAE;IAC7D,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAA;QAC1F,OAAM;IACR,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,UAAU,aAAa,CAAC,CAAA;IACzE,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,KAAK,CAAA;IACvD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,eAAe,GAAG,GAAG,IAAI,eAAe,GAAG,MAAM,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,CAAA;IAC5G,MAAM,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAA;IAEvC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;QACd,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,IAAI,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QAC9B,MAAM,GAAG,GAAG,CAAC,IAAa,EAAQ,EAAE;YAClC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAC9B,IAAI,OAAO;oBAAE,OAAM;gBACnB,IAAI,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAA;gBAC3C,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAA;oBAChD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAA;oBACzF,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;oBACpB,4FAA4F;oBAC5F,MAAM,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;oBACtC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC7B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,MAAM,CAAC,MAAM,eAAe,MAAM,CAAC,aAAa,CAAC,MAAM,mBAAmB,CAAC,CAAA;oBACvH,CAAC;oBACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;wBACxC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;oBACnF,CAAC;gBACH,CAAC;gBACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;gBACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAM;gBAC1E,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;gBACtD,IAAI,IAAI,KAAK,KAAK;oBAAE,MAAM,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAC3D,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC1B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACxE,CAAC,CAAC,CAAA;QACJ,CAAC,CAAA;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACjE,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC,CAAA;QACvE,OAAO,KAAK,IAAI,EAAE;YAChB,OAAO,GAAG,IAAI,CAAA;YACd,aAAa,CAAC,KAAK,CAAC,CAAA;YACpB,WAAW,EAAE,CAAA;YACb,MAAM,MAAM,CAAA;QACd,CAAC,CAAA;IACH,CAAC,EAAE,4BAA4B,CAAC,CAAA;AAClC,CAAC"}

package/dist/src/graph.d.ts

@@ -0,0 +1,14 @@
+import { type DependencyGraph, type DependencyNode } from './radar-types.js';
+interface RootPackage {
+    name: string;
+    version: string;
+}
+/** Parse the exact package tree produced by npm package-lock v2/v3 without executing package code. */
+export declare function parseNpmLockGraph(lockfile: unknown, rootPackage: RootPackage): DependencyGraph;
+/** Return bounded, cycle-safe root-to-node paths for an alert. */
+export declare function findDependencyPaths(graph: DependencyGraph, targetNodeId: string, options?: {
+    maxPaths?: number;
+    maxDepth?: number;
+}): DependencyNode[][];
+export {};
+//# sourceMappingURL=graph.d.ts.map

package/dist/src/graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../src/graph.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,eAAe,EAEpB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAA;AAEzB,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAmED,sGAAsG;AACtG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,GAAG,eAAe,CA8E9F;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACrD,cAAc,EAAE,EAAE,CA0CpB"}

package/dist/src/graph.js

@@ -0,0 +1,198 @@
+import { createHash } from 'node:crypto';
+import { DEPENDENCY_GRAPH_SCHEMA, } from './radar-types.js';
+function asRecord(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return undefined;
+    return value;
+}
+function asStringRecord(value) {
+    const record = asRecord(value);
+    if (record === undefined)
+        return {};
+    const result = {};
+    for (const [key, item] of Object.entries(record)) {
+        if (typeof item === 'string')
+            result[key] = item;
+    }
+    return result;
+}
+function packageNameFromPath(path) {
+    const marker = 'node_modules/';
+    const offset = path.lastIndexOf(marker);
+    if (offset < 0)
+        return undefined;
+    const remainder = path.slice(offset + marker.length);
+    const parts = remainder.split('/');
+    if (parts[0]?.startsWith('@')) {
+        return parts[0] !== undefined && parts[1] !== undefined ? `${parts[0]}/${parts[1]}` : undefined;
+    }
+    return parts[0] === '' ? undefined : parts[0];
+}
+function candidateDependencyPaths(parentPath, dependencyName) {
+    const candidates = [`${parentPath}/node_modules/${dependencyName}`];
+    let cursor = parentPath;
+    while (true) {
+        const boundary = cursor.lastIndexOf('/node_modules/');
+        if (boundary < 0)
+            break;
+        cursor = cursor.slice(0, boundary);
+        candidates.push(`${cursor}/node_modules/${dependencyName}`);
+    }
+    candidates.push(`node_modules/${dependencyName}`);
+    return [...new Set(candidates)];
+}
+function dependencyEntries(item) {
+    const selected = new Map();
+    const add = (value, kind) => {
+        for (const [name, spec] of Object.entries(asStringRecord(value)))
+            selected.set(name, { spec, kind });
+    };
+    add(item.devDependencies, 'development');
+    add(item.dependencies, 'runtime');
+    add(item.peerDependencies, 'peer');
+    add(item.optionalDependencies, 'optional');
+    return [...selected.entries()].map(([name, value]) => ({ name, ...value }));
+}
+function graphDigest(nodes, edges) {
+    const hash = createHash('sha256');
+    for (const node of [...nodes].sort((left, right) => left.id.localeCompare(right.id))) {
+        hash.update(`node\0${node.id}\0${node.name}\0${node.version}\n`);
+    }
+    for (const edge of [...edges].sort((left, right) => (left.from.localeCompare(right.from) || left.to.localeCompare(right.to) || left.kind.localeCompare(right.kind)))) {
+        hash.update(`edge\0${edge.from}\0${edge.to}\0${edge.kind}\n`);
+    }
+    return `sha256:${hash.digest('hex')}`;
+}
+/** Parse the exact package tree produced by npm package-lock v2/v3 without executing package code. */
+export function parseNpmLockGraph(lockfile, rootPackage) {
+    const root = asRecord(lockfile);
+    const rawPackages = asRecord(root?.packages);
+    if (rawPackages === undefined)
+        throw new Error('npm lockfile does not contain a packages map');
+    if (Object.keys(rawPackages).length > 100_000)
+        throw new Error('npm lockfile exceeds the 100000 package limit');
+    const records = new Map();
+    const allNodes = new Map();
+    for (const [path, rawItem] of Object.entries(rawPackages)) {
+        if (path === '')
+            continue;
+        const item = asRecord(rawItem);
+        if (item === undefined)
+            continue;
+        records.set(path, item);
+        const version = typeof item.version === 'string' ? item.version : undefined;
+        const name = typeof item.name === 'string' ? item.name : packageNameFromPath(path);
+        if (name === undefined || version === undefined)
+            continue;
+        allNodes.set(path, { id: path, name, version });
+    }
+    const roots = [...allNodes.values()]
+        .filter(node => node.name === rootPackage.name && node.version === rootPackage.version)
+        .sort((left, right) => left.id.length - right.id.length || left.id.localeCompare(right.id));
+    const rootNode = roots[0];
+    if (rootNode === undefined) {
+        throw new Error(`requested root package is not present in npm lockfile: ${rootPackage.name}@${rootPackage.version}`);
+    }
+    const allEdges = [];
+    const unresolved = [];
+    for (const [parentPath, parentNode] of allNodes) {
+        const item = records.get(parentPath);
+        if (item === undefined)
+            continue;
+        for (const dependency of dependencyEntries(item)) {
+            const targetPath = candidateDependencyPaths(parentPath, dependency.name)
+                .find(candidate => allNodes.has(candidate));
+            if (targetPath === undefined) {
+                unresolved.push({ from: parentNode.id, ...dependency });
+                continue;
+            }
+            allEdges.push({ from: parentNode.id, to: targetPath, kind: dependency.kind });
+        }
+    }
+    const outgoing = new Map();
+    for (const edge of allEdges) {
+        const list = outgoing.get(edge.from) ?? [];
+        list.push(edge);
+        outgoing.set(edge.from, list);
+    }
+    const reachable = new Set([rootNode.id]);
+    const queue = [rootNode.id];
+    while (queue.length > 0) {
+        const next = queue.shift();
+        if (next === undefined)
+            break;
+        for (const edge of outgoing.get(next) ?? []) {
+            if (reachable.has(edge.to))
+                continue;
+            reachable.add(edge.to);
+            queue.push(edge.to);
+        }
+    }
+    const nodes = [...reachable]
+        .map(id => allNodes.get(id))
+        .filter((node) => node !== undefined)
+        .sort((left, right) => left.id === rootNode.id ? -1 : right.id === rootNode.id ? 1 : left.id.localeCompare(right.id));
+    const edges = allEdges
+        .filter(edge => reachable.has(edge.from) && reachable.has(edge.to))
+        .sort((left, right) => left.from.localeCompare(right.from) || left.to.localeCompare(right.to) || left.kind.localeCompare(right.kind));
+    const reachableUnresolved = unresolved.filter(item => reachable.has(item.from));
+    return {
+        schema: DEPENDENCY_GRAPH_SCHEMA,
+        rootNodeId: rootNode.id,
+        nodes,
+        edges,
+        digest: graphDigest(nodes, edges),
+        ...(reachableUnresolved.length === 0 ? {} : { unresolved: reachableUnresolved }),
+    };
+}
+/** Return bounded, cycle-safe root-to-node paths for an alert. */
+export function findDependencyPaths(graph, targetNodeId, options = {}) {
+    const maxPaths = options.maxPaths ?? 20;
+    const maxDepth = options.maxDepth ?? 64;
+    if (!Number.isSafeInteger(maxPaths) || maxPaths < 1 || maxPaths > 1_000)
+        throw new Error('maxPaths must be between 1 and 1000');
+    if (!Number.isSafeInteger(maxDepth) || maxDepth < 1 || maxDepth > 1_000)
+        throw new Error('maxDepth must be between 1 and 1000');
+    const nodes = new Map(graph.nodes.map(node => [node.id, node]));
+    if (!nodes.has(graph.rootNodeId))
+        throw new Error('dependency graph root node is missing');
+    if (!nodes.has(targetNodeId))
+        return [];
+    const outgoing = new Map();
+    for (const edge of graph.edges) {
+        if (!nodes.has(edge.from) || !nodes.has(edge.to))
+            throw new Error('dependency graph edge references a missing node');
+        const list = outgoing.get(edge.from) ?? [];
+        list.push(edge);
+        outgoing.set(edge.from, list);
+    }
+    for (const list of outgoing.values()) {
+        list.sort((left, right) => {
+            const leftNode = nodes.get(left.to);
+            const rightNode = nodes.get(right.to);
+            return `${leftNode?.name ?? ''}@${leftNode?.version ?? ''}:${left.to}`
+                .localeCompare(`${rightNode?.name ?? ''}@${rightNode?.version ?? ''}:${right.to}`);
+        });
+    }
+    const found = [];
+    const visit = (current, path, seen) => {
+        if (found.length >= maxPaths || path.length > maxDepth)
+            return;
+        if (current === targetNodeId) {
+            const resolved = path.map(id => nodes.get(id)).filter((node) => node !== undefined);
+            if (resolved.length === path.length)
+                found.push(resolved);
+            return;
+        }
+        for (const edge of outgoing.get(current) ?? []) {
+            if (seen.has(edge.to))
+                continue;
+            seen.add(edge.to);
+            visit(edge.to, [...path, edge.to], seen);
+            seen.delete(edge.to);
+        }
+    };
+    visit(graph.rootNodeId, [graph.rootNodeId], new Set([graph.rootNodeId]));
+    return found;
+}
+//# sourceMappingURL=graph.js.map

package/dist/src/graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../src/graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EACL,uBAAuB,GAKxB,MAAM,kBAAkB,CAAA;AAOzB,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACzF,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;IAClD,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,eAAe,CAAA;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACjG,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC/C,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAkB,EAAE,cAAsB;IAC1E,MAAM,UAAU,GAAa,CAAC,GAAG,UAAU,iBAAiB,cAAc,EAAE,CAAC,CAAA;IAC7E,IAAI,MAAM,GAAG,UAAU,CAAA;IACvB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAA;QACrD,IAAI,QAAQ,GAAG,CAAC;YAAE,MAAK;QACvB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;QAClC,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,iBAAiB,cAAc,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,gBAAgB,cAAc,EAAE,CAAC,CAAA;IACjD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA6B;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkD,CAAA;IAC1E,MAAM,GAAG,GAAG,CAAC,KAAc,EAAE,IAAoB,EAAQ,EAAE;QACzD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACtG,CAAC,CAAA;IACD,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,CAAA;IACxC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;IACjC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAA;IAClC,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAA;IAC1C,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,KAAgC,EAAE,KAAgC;IACrF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACjC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;IAClE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAClD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAC9G,CAAC,EAAE,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AACvC,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,iBAAiB,CAAC,QAAiB,EAAE,WAAwB;IAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC/B,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC5C,IAAI,WAAW,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IAC9F,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAE/G,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAA;IAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAA;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,IAAI,IAAI,KAAK,EAAE;YAAE,SAAQ;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC9B,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAChC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACvB,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;QAC3E,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;QAClF,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;YAAE,SAAQ;QACzD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IACjD,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;SACjC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO,CAAC;SACtF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7F,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,0DAA0D,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC,CAAA;IACtH,CAAC;IAED,MAAM,QAAQ,GAAqB,EAAE,CAAA;IACrC,MAAM,UAAU,GAA+C,EAAE,CAAA;IACjE,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAChC,KAAK,MAAM,UAAU,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,wBAAwB,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC;iBACrE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;YAC7C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAA;gBACvD,SAAQ;YACV,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAA;IACpD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACf,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC/B,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IAChD,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC3B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,CAAA;QAC1B,IAAI,IAAI,KAAK,SAAS;YAAE,MAAK;QAC7B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,SAAQ;YACpC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,SAAS,CAAC;SACzB,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SAC3B,MAAM,CAAC,CAAC,IAAI,EAA0B,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SAC5D,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IACvH,MAAM,KAAK,GAAG,QAAQ;SACnB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAClE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACvI,MAAM,mBAAmB,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAE/E,OAAO;QACL,MAAM,EAAE,uBAAuB;QAC/B,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,KAAK;QACL,KAAK;QACL,MAAM,EAAE,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC;QACjC,GAAG,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC;KACjF,CAAA;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CACjC,KAAsB,EACtB,YAAoB,EACpB,OAAO,GAA6C,EAAE;IAEtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAA;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAA;IACvC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAC/H,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAE/H,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IAC/D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IAC1F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAA;IACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAA;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpH,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACf,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC/B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACnC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACrC,OAAO,GAAG,QAAQ,EAAE,IAAI,IAAI,EAAE,IAAI,QAAQ,EAAE,OAAO,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE;iBACnE,aAAa,CAAC,GAAG,SAAS,EAAE,IAAI,IAAI,EAAE,IAAI,SAAS,EAAE,OAAO,IAAI,EAAE,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QACtF,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,KAAK,GAAuB,EAAE,CAAA;IACpC,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,IAAc,EAAE,IAAiB,EAAQ,EAAE;QACzE,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ;YAAE,OAAM;QAC9D,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAA0B,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;YAC3G,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACzD,OAAM;QACR,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,SAAQ;YAC/B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACjB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;YACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtB,CAAC;IACH,CAAC,CAAA;IACD,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACxE,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/src/index.d.ts

@@ -0,0 +1,19 @@
+export { decideVerdict, stricterVerdict, verdictAtLeast } from './policy.js';
+export { inspectNpmPackage, parseNpmSpec, verifyIntegrity, verifyRegistrySignatures, type InspectNpmOptions, type IntegrityResult, type ParsedNpmSpec, } from './npm.js';
+export { renderTextReport } from './render.js';
+export { findDependencyPaths, parseNpmLockGraph } from './graph.js';
+export { OsvClient, packageKey, type OsvClientOptions } from './osv.js';
+export { NpmReleaseClient, type NpmReleaseClientOptions, type NpmReleaseObservation } from './npm-release.js';
+export { emptyRadarState, pollRadar, type AdvisorySource, type RadarPollResult, type ReleaseSource } from './radar.js';
+export { assessCompatibilityChange, assessCompatibilityChanges, type CompatibilityChangeInput } from './compatibility.js';
+export { createAnalysisTask, renderAgentAnalysisPrompt, renderDshAnalysisPrompt } from './dsh-analysis.js';
+export { parsePackageManifestSnapshot, parseRadarConfig } from './inventory.js';
+export { loadRadarState, parseRadarState, saveRadarState } from './radar-state.js';
+export { renderRadarEvent, renderRadarEvents } from './radar-render.js';
+export { crossesBreakingVersionBoundary, parseSemver, satisfiesSemverRange } from './semver.js';
+export { scanDirectory, type ScanOptions } from './scan.js';
+export { parseNpmTarball, type ParsedNpmTarball, type TarEntry, type TarOptions } from './tar.js';
+export { TOOL_VERSION } from './version.js';
+export { REPORT_SCHEMA, type CheckStatus, type Coverage, type CoverageVerdict, type DependencyEvidence, type DshEvidence, type Finding, type LifecycleScriptEvidence, type NpmEvidence, type NpmProvenanceEvidence, type ScanReport, type Severity, type Verdict, type VulnerabilitySummary, } from './types.js';
+export { ANALYSIS_TASK_SCHEMA, DEPENDENCY_GRAPH_SCHEMA, INVENTORY_SCHEMA, RADAR_EVENT_SCHEMA, RADAR_CONFIG_SCHEMA, RADAR_STATE_SCHEMA, type AdvisoryMatch, type AnalysisTask, type CompatibilityEvent, type CompatibilitySignal, type DependencyEdge, type DependencyGraph, type DependencyKind, type DependencyNode, type EventRoute, type PackageCoordinate, type PackageManifestSnapshot, type PluginInstallation, type ProjectInventory, type ProjectReference, type RadarEvent, type RadarConfig, type RadarSeverity, type RadarState, type VulnerabilityAdvisory, type VulnerabilityEvent, } from './radar-types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,UAAU,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAC7G,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAA;AACtH,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,KAAK,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AACzH,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC1G,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EACL,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,KAAK,oBAAoB,GAC1B,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAA"}

package/dist/src/index.js

@@ -0,0 +1,19 @@
+export { decideVerdict, stricterVerdict, verdictAtLeast } from './policy.js';
+export { inspectNpmPackage, parseNpmSpec, verifyIntegrity, verifyRegistrySignatures, } from './npm.js';
+export { renderTextReport } from './render.js';
+export { findDependencyPaths, parseNpmLockGraph } from './graph.js';
+export { OsvClient, packageKey } from './osv.js';
+export { NpmReleaseClient } from './npm-release.js';
+export { emptyRadarState, pollRadar } from './radar.js';
+export { assessCompatibilityChange, assessCompatibilityChanges } from './compatibility.js';
+export { createAnalysisTask, renderAgentAnalysisPrompt, renderDshAnalysisPrompt } from './dsh-analysis.js';
+export { parsePackageManifestSnapshot, parseRadarConfig } from './inventory.js';
+export { loadRadarState, parseRadarState, saveRadarState } from './radar-state.js';
+export { renderRadarEvent, renderRadarEvents } from './radar-render.js';
+export { crossesBreakingVersionBoundary, parseSemver, satisfiesSemverRange } from './semver.js';
+export { scanDirectory } from './scan.js';
+export { parseNpmTarball } from './tar.js';
+export { TOOL_VERSION } from './version.js';
+export { REPORT_SCHEMA, } from './types.js';
+export { ANALYSIS_TASK_SCHEMA, DEPENDENCY_GRAPH_SCHEMA, INVENTORY_SCHEMA, RADAR_EVENT_SCHEMA, RADAR_CONFIG_SCHEMA, RADAR_STATE_SCHEMA, } from './radar-types.js';
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,wBAAwB,GAIzB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAyB,MAAM,UAAU,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAA4D,MAAM,kBAAkB,CAAA;AAC7G,OAAO,EAAE,eAAe,EAAE,SAAS,EAAiE,MAAM,YAAY,CAAA;AACtH,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAiC,MAAM,oBAAoB,CAAA;AACzH,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC1G,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,EAAE,aAAa,EAAoB,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAyD,MAAM,UAAU,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EACL,aAAa,GAcd,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,GAqBnB,MAAM,kBAAkB,CAAA"}

package/dist/src/inventory.d.ts

@@ -0,0 +1,4 @@
+import { type PackageManifestSnapshot, type RadarConfig } from './radar-types.js';
+export declare function parsePackageManifestSnapshot(value: unknown): PackageManifestSnapshot;
+export declare function parseRadarConfig(value: unknown): RadarConfig;
+//# sourceMappingURL=inventory.d.ts.map

package/dist/src/inventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory.d.ts","sourceRoot":"","sources":["../../src/inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,uBAAuB,EAG5B,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAA;AAsEzB,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAIpF;AA4FD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAU5D"}