upstream-radar 0.4.0

package/dist/src/radar-types.d.ts

@@ -0,0 +1,163 @@
+export declare const DEPENDENCY_GRAPH_SCHEMA: 'upstream-radar.dependency-graph/v1alpha1';
+export declare const INVENTORY_SCHEMA: 'upstream-radar.inventory/v1alpha1';
+export declare const RADAR_EVENT_SCHEMA: 'upstream-radar.event/v1alpha1';
+export declare const RADAR_STATE_SCHEMA: 'upstream-radar.radar-state/v1alpha1';
+export declare const ANALYSIS_TASK_SCHEMA: 'upstream-radar.analysis-task/v1alpha1';
+export declare const RADAR_CONFIG_SCHEMA: 'upstream-radar.radar-config/v1alpha1';
+export type PackageEcosystem = 'npm';
+export interface PackageCoordinate {
+    ecosystem: PackageEcosystem;
+    name: string;
+    version: string;
+}
+export type DependencyKind = 'runtime' | 'development' | 'optional' | 'peer';
+/** One physical package location. Duplicate name/version pairs remain distinct nodes. */
+export interface DependencyNode {
+    id: string;
+    name: string;
+    version: string;
+}
+export interface DependencyEdge {
+    from: string;
+    to: string;
+    kind: DependencyKind;
+}
+export interface DependencyGraph {
+    schema: typeof DEPENDENCY_GRAPH_SCHEMA;
+    rootNodeId: string;
+    nodes: DependencyNode[];
+    edges: DependencyEdge[];
+    digest?: string;
+    unresolved?: Array<{
+        from: string;
+        name: string;
+        kind: DependencyKind;
+        spec: string;
+    }>;
+}
+export interface PackageManifestSnapshot {
+    name: string;
+    version: string;
+    type?: string;
+    main?: string;
+    exports?: unknown;
+    engines?: Record<string, string>;
+    dependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    dsh?: unknown;
+}
+export interface PluginInstallation {
+    package: PackageCoordinate;
+    graph: DependencyGraph;
+    manifest?: PackageManifestSnapshot;
+}
+export interface ProjectReference {
+    id: string;
+    name: string;
+    repository?: string;
+    workspace?: string;
+    owner?: string;
+    channels?: string[];
+}
+export interface ProjectInventory {
+    schema: typeof INVENTORY_SCHEMA;
+    project: ProjectReference;
+    environment?: {
+        nodeVersion?: string;
+    };
+    plugins: PluginInstallation[];
+}
+export interface RadarConfig {
+    schema: typeof RADAR_CONFIG_SCHEMA;
+    projects: ProjectInventory[];
+}
+export type RadarSeverity = 'unknown' | 'info' | 'low' | 'medium' | 'high' | 'critical';
+export interface VulnerabilityAdvisory {
+    id: string;
+    aliases: string[];
+    summary: string;
+    details: string;
+    severity: RadarSeverity;
+    published?: string;
+    modified: string;
+    withdrawn?: string;
+    fixedVersions: string[];
+    references: string[];
+}
+export interface AdvisoryMatch {
+    package: PackageCoordinate;
+    advisory: VulnerabilityAdvisory;
+}
+export interface EventRoute {
+    owner?: string;
+    channels: string[];
+}
+interface RadarEventBase {
+    schema: typeof RADAR_EVENT_SCHEMA;
+    id: string;
+    /** Stable across new/updated/resolved transitions for one project-specific problem. */
+    incidentId: string;
+    change: 'new' | 'updated' | 'resolved';
+    detectedAt: string;
+    project: ProjectReference;
+    route: EventRoute;
+    plugin: PackageCoordinate;
+}
+export interface VulnerabilityEvent extends RadarEventBase {
+    kind: 'vulnerability' | 'malware';
+    affected: PackageCoordinate;
+    paths: PackageCoordinate[][];
+    advisory: VulnerabilityAdvisory;
+}
+export type CompatibilitySignalConfidence = 'confirmed' | 'strong' | 'needs-analysis';
+export interface CompatibilitySignal {
+    code: string;
+    confidence: CompatibilitySignalConfidence;
+    summary: string;
+    before?: string;
+    after?: string;
+}
+export interface CompatibilityEvent extends RadarEventBase {
+    kind: 'compatibility';
+    installed: PackageCoordinate;
+    candidate: PackageCoordinate;
+    signals: CompatibilitySignal[];
+    releaseNotes?: string;
+}
+export type RadarEvent = VulnerabilityEvent | CompatibilityEvent;
+export interface StoredVulnerabilityMatch {
+    key: string;
+    event: VulnerabilityEvent;
+}
+export interface StoredCompatibilityMatch {
+    key: string;
+    event: CompatibilityEvent;
+}
+export interface RadarState {
+    schema: typeof RADAR_STATE_SCHEMA;
+    activeVulnerabilities: Record<string, StoredVulnerabilityMatch>;
+    activeCompatibility: Record<string, StoredCompatibilityMatch>;
+    pendingAnalysisTasks: AnalysisTask[];
+}
+export interface AnalysisTask {
+    schema: typeof ANALYSIS_TASK_SCHEMA;
+    id: string;
+    createdAt: string;
+    event: RadarEvent;
+    constraints: {
+        sourceMaterialIsUntrusted: true;
+        readOnly: true;
+        requireProjectEvidence: true;
+    };
+    expectedOutput: {
+        project_exposure: 'exposed | likely_exposed | not_exposed | unknown';
+        confidence: 'high | medium | low';
+        evidence: 'array of repository paths, symbols, configuration, or runtime facts';
+        recommended_action: 'project-specific next action';
+        urgency: 'immediate | within_24_hours | planned | monitor';
+        reasoning_summary: 'short explanation separating deterministic facts from model analysis';
+    };
+}
+export {};
+//# sourceMappingURL=radar-types.d.ts.map

package/dist/src/radar-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"radar-types.d.ts","sourceRoot":"","sources":["../../src/radar-types.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,EAAG,0CAAmD,CAAA;AAC1F,eAAO,MAAM,gBAAgB,EAAG,mCAA4C,CAAA;AAC5E,eAAO,MAAM,kBAAkB,EAAG,+BAAwC,CAAA;AAC1E,eAAO,MAAM,kBAAkB,EAAG,qCAA8C,CAAA;AAChF,eAAO,MAAM,oBAAoB,EAAG,uCAAgD,CAAA;AACpF,eAAO,MAAM,mBAAmB,EAAG,sCAA+C,CAAA;AAElF,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAA;AAEpC,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,gBAAgB,CAAA;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,MAAM,CAAA;AAE5E,yFAAyF;AACzF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,cAAc,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,uBAAuB,CAAA;IACtC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAC;QACjB,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,cAAc,CAAA;QACpB,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzC,GAAG,CAAC,EAAE,OAAO,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,iBAAiB,CAAA;IAC1B,KAAK,EAAE,eAAe,CAAA;IACtB,QAAQ,CAAC,EAAE,uBAAuB,CAAA;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,gBAAgB,CAAA;IAC/B,OAAO,EAAE,gBAAgB,CAAA;IACzB,WAAW,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,OAAO,EAAE,kBAAkB,EAAE,CAAA;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,OAAO,mBAAmB,CAAA;IAClC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAC7B;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAEvF,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,aAAa,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,iBAAiB,CAAA;IAC1B,QAAQ,EAAE,qBAAqB,CAAA;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,UAAU,cAAc;IACtB,MAAM,EAAE,OAAO,kBAAkB,CAAA;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,uFAAuF;IACvF,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,KAAK,GAAG,SAAS,GAAG,UAAU,CAAA;IACtC,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,gBAAgB,CAAA;IACzB,KAAK,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,iBAAiB,CAAA;CAC1B;AAED,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,IAAI,EAAE,eAAe,GAAG,SAAS,CAAA;IACjC,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAA;IAC5B,QAAQ,EAAE,qBAAqB,CAAA;CAChC;AAED,MAAM,MAAM,6BAA6B,GAAG,WAAW,GAAG,QAAQ,GAAG,gBAAgB,CAAA;AAErF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,6BAA6B,CAAA;IACzC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,IAAI,EAAE,eAAe,CAAA;IACrB,SAAS,EAAE,iBAAiB,CAAA;IAC5B,SAAS,EAAE,iBAAiB,CAAA;IAC5B,OAAO,EAAE,mBAAmB,EAAE,CAAA;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,UAAU,GAAG,kBAAkB,GAAG,kBAAkB,CAAA;AAEhE,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,kBAAkB,CAAA;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,kBAAkB,CAAA;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,OAAO,kBAAkB,CAAA;IACjC,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;IAC/D,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;IAC7D,oBAAoB,EAAE,YAAY,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,OAAO,oBAAoB,CAAA;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,UAAU,CAAA;IACjB,WAAW,EAAE;QACX,yBAAyB,EAAE,IAAI,CAAA;QAC/B,QAAQ,EAAE,IAAI,CAAA;QACd,sBAAsB,EAAE,IAAI,CAAA;KAC7B,CAAA;IACD,cAAc,EAAE;QACd,gBAAgB,EAAE,kDAAkD,CAAA;QACpE,UAAU,EAAE,qBAAqB,CAAA;QACjC,QAAQ,EAAE,qEAAqE,CAAA;QAC/E,kBAAkB,EAAE,8BAA8B,CAAA;QAClD,OAAO,EAAE,iDAAiD,CAAA;QAC1D,iBAAiB,EAAE,sEAAsE,CAAA;KAC1F,CAAA;CACF"}

package/dist/src/radar-types.js

@@ -0,0 +1,7 @@
+export const DEPENDENCY_GRAPH_SCHEMA = 'upstream-radar.dependency-graph/v1alpha1';
+export const INVENTORY_SCHEMA = 'upstream-radar.inventory/v1alpha1';
+export const RADAR_EVENT_SCHEMA = 'upstream-radar.event/v1alpha1';
+export const RADAR_STATE_SCHEMA = 'upstream-radar.radar-state/v1alpha1';
+export const ANALYSIS_TASK_SCHEMA = 'upstream-radar.analysis-task/v1alpha1';
+export const RADAR_CONFIG_SCHEMA = 'upstream-radar.radar-config/v1alpha1';
+//# sourceMappingURL=radar-types.js.map

package/dist/src/radar-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"radar-types.js","sourceRoot":"","sources":["../../src/radar-types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,0CAAmD,CAAA;AAC1F,MAAM,CAAC,MAAM,gBAAgB,GAAG,mCAA4C,CAAA;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,+BAAwC,CAAA;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,qCAA8C,CAAA;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uCAAgD,CAAA;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,sCAA+C,CAAA"}

package/dist/src/radar.d.ts

@@ -0,0 +1,24 @@
+import type { NpmReleaseObservation } from './npm-release.js';
+import { type AdvisoryMatch, type AnalysisTask, type PackageCoordinate, type ProjectInventory, type RadarEvent, type RadarState } from './radar-types.js';
+export interface AdvisorySource {
+    query(packages: readonly PackageCoordinate[]): Promise<Map<string, AdvisoryMatch[]>>;
+}
+export interface ReleaseSource {
+    query(packages: readonly PackageCoordinate[]): Promise<Map<string, NpmReleaseObservation>>;
+}
+export interface RadarPollResult {
+    checkedAt: string;
+    packagesQueried: number;
+    releasePackagesQueried: number;
+    events: RadarEvent[];
+    analysisTasks: AnalysisTask[];
+    sourceErrors: Array<{
+        source: 'npm-releases';
+        message: string;
+    }>;
+    state: RadarState;
+}
+export declare function emptyRadarState(): RadarState;
+/** Query exact installed versions, calculate affected paths, and emit state transitions only. */
+export declare function pollRadar(inventories: readonly ProjectInventory[], previousState: RadarState, source: AdvisorySource, now?: Date, releaseSource?: ReleaseSource): Promise<RadarPollResult>;
+//# sourceMappingURL=radar.d.ts.map

package/dist/src/radar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"radar.d.ts","sourceRoot":"","sources":["../../src/radar.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAE7D,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,YAAY,EAEjB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,UAAU,EAIhB,MAAM,kBAAkB,CAAA;AAEzB,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;CACrF;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAA;CAC3F;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB,sBAAsB,EAAE,MAAM,CAAA;IAC9B,MAAM,EAAE,UAAU,EAAE,CAAA;IACpB,aAAa,EAAE,YAAY,EAAE,CAAA;IAC7B,YAAY,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChE,KAAK,EAAE,UAAU,CAAA;CAClB;AAiDD,wBAAgB,eAAe,IAAI,UAAU,CAE5C;AAED,iGAAiG;AACjG,wBAAsB,SAAS,CAC7B,WAAW,EAAE,SAAS,gBAAgB,EAAE,EACxC,aAAa,EAAE,UAAU,EACzB,MAAM,EAAE,cAAc,EACtB,GAAG,OAAa,EAChB,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,eAAe,CAAC,CAyL1B"}

package/dist/src/radar.js

@@ -0,0 +1,234 @@
+import { createHash } from 'node:crypto';
+import { createAnalysisTask } from './dsh-analysis.js';
+import { assessCompatibilityChanges } from './compatibility.js';
+import { findDependencyPaths } from './graph.js';
+import { packageKey } from './osv.js';
+import { RADAR_EVENT_SCHEMA, RADAR_STATE_SCHEMA, } from './radar-types.js';
+function hash(value) {
+    return createHash('sha256').update(value).digest('hex').slice(0, 24);
+}
+function route(inventory) {
+    return {
+        ...(inventory.project.owner === undefined ? {} : { owner: inventory.project.owner }),
+        channels: inventory.project.channels === undefined || inventory.project.channels.length === 0
+            ? ['stdout']
+            : [...inventory.project.channels],
+    };
+}
+function coordinate(name, version) {
+    return { ecosystem: 'npm', name, version };
+}
+function matchKey(inventory, plugin, affected, advisoryId) {
+    return [inventory.project.id, packageKey(plugin), packageKey(affected), advisoryId].join('\0');
+}
+function eventId(key, change, detectedAt, modified) {
+    return `event-${hash(`${key}\0${change}\0${detectedAt}\0${modified}`)}`;
+}
+function eventChanged(previous, current) {
+    return JSON.stringify(previous.advisory) !== JSON.stringify(current.advisory)
+        || JSON.stringify(previous.paths) !== JSON.stringify(current.paths)
+        || JSON.stringify(previous.route) !== JSON.stringify(current.route);
+}
+function compatibilityEventChanged(previous, current) {
+    if (previous.kind !== 'compatibility' || current.kind !== 'compatibility')
+        return true;
+    return JSON.stringify(previous.project) !== JSON.stringify(current.project)
+        || JSON.stringify(previous.route) !== JSON.stringify(current.route)
+        || JSON.stringify(previous.plugin) !== JSON.stringify(current.plugin)
+        || JSON.stringify(previous.installed) !== JSON.stringify(current.installed)
+        || JSON.stringify(previous.candidate) !== JSON.stringify(current.candidate)
+        || JSON.stringify(previous.signals) !== JSON.stringify(current.signals)
+        || previous.releaseNotes !== current.releaseNotes;
+}
+export function emptyRadarState() {
+    return { schema: RADAR_STATE_SCHEMA, activeVulnerabilities: {}, activeCompatibility: {}, pendingAnalysisTasks: [] };
+}
+/** Query exact installed versions, calculate affected paths, and emit state transitions only. */
+export async function pollRadar(inventories, previousState, source, now = new Date(), releaseSource) {
+    if (previousState.schema !== RADAR_STATE_SCHEMA)
+        throw new Error('unsupported radar state schema');
+    if (!Number.isFinite(now.getTime()))
+        throw new Error('radar check time is invalid');
+    const checkedAt = now.toISOString();
+    const uniquePackages = new Map();
+    for (const inventory of inventories) {
+        for (const plugin of inventory.plugins) {
+            for (const node of plugin.graph.nodes) {
+                const item = coordinate(node.name, node.version);
+                uniquePackages.set(packageKey(item), item);
+            }
+        }
+    }
+    const matches = await source.query([...uniquePackages.values()]);
+    const current = new Map();
+    for (const inventory of inventories) {
+        for (const plugin of inventory.plugins) {
+            const groupedPaths = new Map();
+            const groupedMatch = new Map();
+            for (const node of plugin.graph.nodes) {
+                const affected = coordinate(node.name, node.version);
+                for (const match of matches.get(packageKey(affected)) ?? []) {
+                    const key = matchKey(inventory, plugin.package, affected, match.advisory.id);
+                    const paths = findDependencyPaths(plugin.graph, node.id).map(path => (path.map(item => coordinate(item.name, item.version))));
+                    if (paths.length === 0)
+                        continue;
+                    const existing = groupedPaths.get(key) ?? [];
+                    const known = new Set(existing.map(path => JSON.stringify(path)));
+                    for (const path of paths) {
+                        const serialized = JSON.stringify(path);
+                        if (!known.has(serialized)) {
+                            existing.push(path);
+                            known.add(serialized);
+                        }
+                    }
+                    groupedPaths.set(key, existing);
+                    groupedMatch.set(key, match);
+                }
+            }
+            for (const [key, paths] of groupedPaths) {
+                const match = groupedMatch.get(key);
+                if (match === undefined)
+                    continue;
+                paths.sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
+                const event = {
+                    schema: RADAR_EVENT_SCHEMA,
+                    id: eventId(key, 'new', checkedAt, match.advisory.modified),
+                    incidentId: `incident-${hash(key)}`,
+                    kind: match.advisory.id.startsWith('MAL-') ? 'malware' : 'vulnerability',
+                    change: 'new',
+                    detectedAt: checkedAt,
+                    project: { ...inventory.project },
+                    route: route(inventory),
+                    plugin: { ...plugin.package },
+                    affected: { ...match.package },
+                    paths,
+                    advisory: { ...match.advisory },
+                };
+                current.set(key, { key, event });
+            }
+        }
+    }
+    const events = [];
+    for (const [key, item] of current) {
+        const previous = previousState.activeVulnerabilities[key];
+        if (previous === undefined) {
+            events.push(item.event);
+            continue;
+        }
+        if (eventChanged(previous.event, item.event)) {
+            events.push({
+                ...item.event,
+                id: eventId(key, 'updated', checkedAt, item.event.advisory.modified),
+                change: 'updated',
+            });
+        }
+    }
+    for (const [key, previous] of Object.entries(previousState.activeVulnerabilities)) {
+        if (current.has(key))
+            continue;
+        events.push({
+            ...previous.event,
+            id: eventId(key, 'resolved', checkedAt, previous.event.advisory.modified),
+            change: 'resolved',
+            detectedAt: checkedAt,
+        });
+    }
+    const releasePackages = new Map();
+    if (releaseSource !== undefined) {
+        for (const inventory of inventories) {
+            for (const plugin of inventory.plugins) {
+                releasePackages.set(packageKey(plugin.package), plugin.package);
+                for (const node of plugin.graph.nodes) {
+                    if (!(node.name.startsWith('@deepseek-ai/dsh-') || node.name === '@deepseek-ai/cordis'))
+                        continue;
+                    const item = coordinate(node.name, node.version);
+                    releasePackages.set(packageKey(item), item);
+                }
+            }
+        }
+    }
+    const sourceErrors = [];
+    let activeCompatibility = previousState.activeCompatibility;
+    if (releaseSource !== undefined) {
+        let releases;
+        let releaseCheckSucceeded = false;
+        try {
+            releases = await releaseSource.query([...releasePackages.values()]);
+            releaseCheckSucceeded = true;
+        }
+        catch (error) {
+            const raw = error instanceof Error ? error.message : String(error);
+            sourceErrors.push({
+                source: 'npm-releases',
+                message: raw.replace(/[\u0000-\u001f\u007f-\u009f]/g, '?').slice(0, 2_048),
+            });
+            releases = new Map();
+        }
+        if (releaseCheckSucceeded) {
+            const currentCompatibility = new Map();
+            for (const inventory of inventories) {
+                for (const observation of releases.values()) {
+                    const compatibilityEvents = assessCompatibilityChanges(inventory, {
+                        previous: observation.previous,
+                        candidate: observation.candidate,
+                        detectedAt: checkedAt,
+                    });
+                    for (const event of compatibilityEvents) {
+                        currentCompatibility.set(event.incidentId, { key: event.incidentId, event });
+                    }
+                }
+            }
+            for (const [key, item] of currentCompatibility) {
+                const previous = previousState.activeCompatibility[key];
+                if (previous === undefined) {
+                    events.push(item.event);
+                    continue;
+                }
+                if (compatibilityEventChanged(previous.event, item.event)) {
+                    events.push({
+                        ...item.event,
+                        id: `event-${hash(`${key}\0updated\0${checkedAt}\0${item.event.candidate.version}`)}`,
+                        change: 'updated',
+                    });
+                }
+            }
+            for (const [key, previous] of Object.entries(previousState.activeCompatibility)) {
+                if (currentCompatibility.has(key))
+                    continue;
+                events.push({
+                    ...previous.event,
+                    id: `event-${hash(`${key}\0resolved\0${checkedAt}`)}`,
+                    change: 'resolved',
+                    detectedAt: checkedAt,
+                });
+            }
+            activeCompatibility = Object.fromEntries(currentCompatibility);
+        }
+    }
+    events.sort((left, right) => left.id.localeCompare(right.id));
+    const analysisTasks = events
+        .filter(event => event.change !== 'resolved')
+        .map(createAnalysisTask);
+    const pending = new Map(previousState.pendingAnalysisTasks.map(task => [task.event.incidentId, task]));
+    for (const event of events) {
+        if (event.change === 'resolved')
+            pending.delete(event.incidentId);
+    }
+    for (const task of analysisTasks)
+        pending.set(task.event.incidentId, task);
+    return {
+        checkedAt,
+        packagesQueried: uniquePackages.size,
+        releasePackagesQueried: releasePackages.size,
+        events,
+        analysisTasks,
+        sourceErrors,
+        state: {
+            schema: RADAR_STATE_SCHEMA,
+            activeVulnerabilities: Object.fromEntries([...current.entries()]),
+            activeCompatibility,
+            pendingAnalysisTasks: [...pending.values()],
+        },
+    };
+}
+//# sourceMappingURL=radar.js.map

package/dist/src/radar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"radar.js","sourceRoot":"","sources":["../../src/radar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAWnB,MAAM,kBAAkB,CAAA;AAoBzB,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACtE,CAAC;AAED,SAAS,KAAK,CAAC,SAA2B;IACxC,OAAO;QACL,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpF,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC3F,CAAC,CAAC,CAAC,QAAQ,CAAC;YACZ,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;KACpC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,OAAe;IAC/C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,QAAQ,CACf,SAA2B,EAC3B,MAAyB,EACzB,QAA2B,EAC3B,UAAkB;IAElB,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAChG,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,MAAoC,EAAE,UAAkB,EAAE,QAAgB;IACtG,OAAO,SAAS,IAAI,CAAC,GAAG,GAAG,KAAK,MAAM,KAAK,UAAU,KAAK,QAAQ,EAAE,CAAC,EAAE,CAAA;AACzE,CAAC;AAED,SAAS,YAAY,CAAC,QAA4B,EAAE,OAA2B;IAC7E,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;WACxE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;WAChE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AACvE,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAoB,EAAE,OAAmB;IAC1E,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAA;IACtF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;WACtE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;WAChE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;WAClE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;WACxE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;WACxE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;WACpE,QAAQ,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,CAAA;AACrD,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAA;AACrH,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,WAAwC,EACxC,aAAyB,EACzB,MAAsB,EACtB,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,aAA6B;IAE7B,IAAI,aAAa,CAAC,MAAM,KAAK,kBAAkB;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IAClG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IACnF,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;IAEnC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA6B,CAAA;IAC3D,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;gBAChD,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAEhE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAA;IAC3D,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAA;YAC7D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyB,CAAA;YACrD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;gBACpD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;oBAC5E,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CACnE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CACtD,CAAC,CAAA;oBACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;wBAAE,SAAQ;oBAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;oBAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;oBACjE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACzB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;wBACvC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;4BAC3B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;4BACnB,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;wBACvB,CAAC;oBACH,CAAC;oBACD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;oBAC/B,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC9B,CAAC;YACH,CAAC;YAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACnC,IAAI,KAAK,KAAK,SAAS;oBAAE,SAAQ;gBACjC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBACtF,MAAM,KAAK,GAAuB;oBAChC,MAAM,EAAE,kBAAkB;oBAC1B,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC3D,UAAU,EAAE,YAAY,IAAI,CAAC,GAAG,CAAC,EAAE;oBACnC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe;oBACxE,MAAM,EAAE,KAAK;oBACb,UAAU,EAAE,SAAS;oBACrB,OAAO,EAAE,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE;oBACjC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC;oBACvB,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE;oBAC7B,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE;oBAC9B,KAAK;oBACL,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE;iBAChC,CAAA;gBACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,aAAa,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAA;QACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACvB,SAAQ;QACV,CAAC;QACD,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC;gBACV,GAAG,IAAI,CAAC,KAAK;gBACb,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACpE,MAAM,EAAE,SAAS;aAClB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAClF,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC9B,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,QAAQ,CAAC,KAAK;YACjB,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzE,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,SAAS;SACtB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAA6B,CAAA;IAC5D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;YACpC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;gBAC/D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;oBACtC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC;wBAAE,SAAQ;oBACjG,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;oBAChD,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAoC,EAAE,CAAA;IACxD,IAAI,mBAAmB,GAAG,aAAa,CAAC,mBAAmB,CAAA;IAC3D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,QAA4C,CAAA;QAChD,IAAI,qBAAqB,GAAG,KAAK,CAAA;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YACnE,qBAAqB,GAAG,IAAI,CAAA;QAC9B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAClE,YAAY,CAAC,IAAI,CAAC;gBAChB,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;aAC3E,CAAC,CAAA;YACF,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAA;QACtB,CAAC;QACD,IAAI,qBAAqB,EAAE,CAAC;YAC1B,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAoC,CAAA;YACxE,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;gBACpC,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC5C,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,SAAS,EAAE;wBAChE,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,UAAU,EAAE,SAAS;qBACtB,CAAC,CAAA;oBACF,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;wBACxC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;oBAC9E,CAAC;gBACH,CAAC;YACH,CAAC;YACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,oBAAoB,EAAE,CAAC;gBAC/C,MAAM,QAAQ,GAAG,aAAa,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAA;gBACvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;oBACvB,SAAQ;gBACV,CAAC;gBACD,IAAI,yBAAyB,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1D,MAAM,CAAC,IAAI,CAAC;wBACV,GAAG,IAAI,CAAC,KAAK;wBACb,EAAE,EAAE,SAAS,IAAI,CAAC,GAAG,GAAG,cAAc,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE;wBACrF,MAAM,EAAE,SAAS;qBAClB,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAChF,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAQ;gBAC3C,MAAM,CAAC,IAAI,CAAC;oBACV,GAAG,QAAQ,CAAC,KAAK;oBACjB,EAAE,EAAE,SAAS,IAAI,CAAC,GAAG,GAAG,eAAe,SAAS,EAAE,CAAC,EAAE;oBACrD,MAAM,EAAE,UAAU;oBAClB,UAAU,EAAE,SAAS;iBACtB,CAAC,CAAA;YACJ,CAAC;YACD,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IAE7D,MAAM,aAAa,GAAG,MAAM;SACzB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC;SAC5C,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC1B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACtG,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,aAAa;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAE1E,OAAO;QACL,SAAS;QACT,eAAe,EAAE,cAAc,CAAC,IAAI;QACpC,sBAAsB,EAAE,eAAe,CAAC,IAAI;QAC5C,MAAM;QACN,aAAa;QACb,YAAY;QACZ,KAAK,EAAE;YACL,MAAM,EAAE,kBAAkB;YAC1B,qBAAqB,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,mBAAmB;YACnB,oBAAoB,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;SAC5C;KACF,CAAA;AACH,CAAC"}

package/dist/src/render.d.ts

@@ -0,0 +1,3 @@
+import type { ScanReport } from './types.js';
+export declare function renderTextReport(report: ScanReport): string;
+//# sourceMappingURL=render.d.ts.map

package/dist/src/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAS5C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CA2D3D"}

package/dist/src/render.js

@@ -0,0 +1,58 @@
+function display(value, maxLength = 512) {
+    const escaped = value.replace(/[\u0000-\u001f\u007f-\u009f]/g, character => (`\\u${character.codePointAt(0)?.toString(16).padStart(4, '0') ?? '0000'}`));
+    return escaped.length <= maxLength ? escaped : `${escaped.slice(0, maxLength)}…`;
+}
+export function renderTextReport(report) {
+    const lines = [
+        `Upstream Radar ${report.tool.version}`,
+        `Target: ${display(report.target.name)}${report.target.version === null ? '' : `@${display(report.target.version)}`}`,
+        `Artifact: ${report.target.artifactDigest}`,
+        `DSH bundle: ${report.dsh.isBundle ? `yes (${display(report.dsh.patch ?? 'patch unspecified')})` : 'no'}`,
+        `Admission verdict: ${report.verdict.toUpperCase()}`,
+        `Risk verdict: ${report.riskVerdict.toUpperCase()}`,
+        `Coverage verdict: ${report.coverageVerdict.toUpperCase()}`,
+        '',
+        'Coverage:',
+        `  static source: ${report.coverage.staticSource}`,
+        `  artifact integrity: ${report.coverage.artifactIntegrity}`,
+        `  registry signature: ${report.coverage.registrySignature}`,
+        `  dependency resolution: ${report.coverage.dependencyResolution}`,
+        `  provenance: ${report.coverage.provenance}`,
+        `  source/artifact match: ${report.coverage.sourceArtifactMatch}`,
+        `  sandbox detonation: ${report.coverage.sandboxDetonation}`,
+        '',
+        `Evidence: ${report.evidence.filesScanned} ${report.evidence.filesScanned === 1 ? 'file' : 'files'}, ${report.evidence.bytesHashed} bytes, ${report.evidence.dependencies.length} dependency declarations`,
+    ];
+    if (report.evidence.npm !== undefined) {
+        const npm = report.evidence.npm;
+        lines.push('', 'npm chain of custody:', `  registry: ${display(npm.registry)}`, `  tarball integrity: ${npm.integrity.status} (${npm.integrity.algorithm})`, `  registry signature: ${npm.registrySignature.status}`, `  provenance: ${npm.provenance.status}`, `  dependency audit: ${npm.dependencyAudit.status}`, `  resolved packages: ${npm.dependencyAudit.packages ?? 'not resolved'}`);
+        if (npm.provenance.sourceRepository !== undefined)
+            lines.push(`  source repository: ${display(npm.provenance.sourceRepository)}`);
+        if (npm.provenance.sourceCommit !== undefined)
+            lines.push(`  source commit: ${display(npm.provenance.sourceCommit)}`);
+        if (npm.provenance.workflow !== undefined)
+            lines.push(`  build workflow: ${display(npm.provenance.workflow)}`);
+        if (npm.dependencyAudit.graphDigest !== undefined)
+            lines.push(`  graph digest: ${npm.dependencyAudit.graphDigest}`);
+        if (npm.dependencyAudit.graph?.unresolved !== undefined) {
+            lines.push(`  unresolved dependency edges: ${npm.dependencyAudit.graph.unresolved.length}`);
+        }
+        if (npm.dependencyAudit.vulnerabilities !== null) {
+            const vulnerabilities = npm.dependencyAudit.vulnerabilities;
+            lines.push(`  known vulnerabilities: ${vulnerabilities.total} total (${vulnerabilities.critical} critical, ${vulnerabilities.high} high)`);
+        }
+    }
+    if (report.findings.length === 0) {
+        lines.push('', 'No findings in the implemented static checks.');
+    }
+    else {
+        lines.push('', `Findings (${report.findings.length}):`);
+        for (const finding of report.findings) {
+            lines.push(`  [${finding.severity.toUpperCase()}] ${display(finding.code)}: ${display(finding.summary)}`);
+            lines.push(`    ${display(finding.detail, 2_048)}`);
+        }
+    }
+    lines.push('', 'This is a bounded evidence report, not a guarantee that the plugin is safe.');
+    return `${lines.join('\n')}\n`;
+}
+//# sourceMappingURL=render.js.map

package/dist/src/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/render.ts"],"names":[],"mappings":"AAEA,SAAS,OAAO,CAAC,KAAa,EAAE,SAAS,GAAG,GAAG;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,+BAA+B,EAAE,SAAS,CAAC,EAAE,CAAC,CAC1E,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAC1E,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAA;AAClF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IACjD,MAAM,KAAK,GAAG;QACZ,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;QACvC,WAAW,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE;QACrH,aAAa,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE;QAC3C,eAAe,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;QACzG,sBAAsB,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE;QACpD,iBAAiB,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE;QACnD,qBAAqB,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE;QAC3D,EAAE;QACF,WAAW;QACX,oBAAoB,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE;QAClD,yBAAyB,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE;QAC5D,yBAAyB,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE;QAC5D,4BAA4B,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE;QAClE,iBAAiB,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;QAC7C,4BAA4B,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE;QACjE,yBAAyB,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE;QAC5D,EAAE;QACF,aAAa,MAAM,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,WAAW,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,0BAA0B;KAC3M,CAAA;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAA;QAC/B,KAAK,CAAC,IAAI,CACR,EAAE,EACF,uBAAuB,EACvB,eAAe,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EACtC,wBAAwB,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,SAAS,GAAG,EAC3E,yBAAyB,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,EACvD,iBAAiB,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,EACxC,uBAAuB,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,EACnD,wBAAwB,GAAG,CAAC,eAAe,CAAC,QAAQ,IAAI,cAAc,EAAE,CACzE,CAAA;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,gBAAgB,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjI,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QACrH,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC9G,IAAI,GAAG,CAAC,eAAe,CAAC,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAA;QACnH,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,kCAAkC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;QAC7F,CAAC;QACD,IAAI,GAAG,CAAC,eAAe,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC,eAAe,CAAA;YAC3D,KAAK,CAAC,IAAI,CAAC,4BAA4B,eAAe,CAAC,KAAK,WAAW,eAAe,CAAC,QAAQ,cAAc,eAAe,CAAC,IAAI,QAAQ,CAAC,CAAA;QAC5I,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,+CAA+C,CAAC,CAAA;IACjE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;QACvD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACzG,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,6EAA6E,CAAC,CAAA;IAC7F,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;AAChC,CAAC"}

package/dist/src/scan.d.ts

@@ -0,0 +1,8 @@
+import { type ScanReport } from './types.js';
+export interface ScanOptions {
+    maxFiles?: number;
+    maxTotalBytes?: number;
+    dependencyGraphResolved?: boolean;
+}
+export declare function scanDirectory(input: string, options?: ScanOptions): Promise<ScanReport>;
+//# sourceMappingURL=scan.d.ts.map

package/dist/src/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/scan.ts"],"names":[],"mappings":"AASA,OAAO,EAML,KAAK,UAAU,EAEhB,MAAM,YAAY,CAAA;AAuCnB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAClC;AAuYD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CA4DjG"}