upstream-radar 0.4.0

package/dist/src/tar.js

@@ -0,0 +1,327 @@
+import { createHash } from 'node:crypto';
+import { gunzipSync } from 'node:zlib';
+const TAR_BLOCK = 512;
+const DEFAULT_MAX_ENTRIES = 10_000;
+const DEFAULT_MAX_UNPACKED_BYTES = 64 * 1024 * 1024;
+const DEFAULT_MAX_FILE_BYTES = 16 * 1024 * 1024;
+const MAX_PATH_BYTES = 4 * 1024;
+const MAX_PATH_SEGMENT_BYTES = 255;
+const MAX_REPORTED_FINDINGS = 100;
+const WINDOWS_RESERVED = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/i;
+const UTF8_DECODER = new TextDecoder('utf-8', { fatal: true });
+const SEVERITY_RANK = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
+function finding(code, severity, summary, detail, evidence) {
+    const result = { code, severity, summary, detail };
+    if (evidence !== undefined)
+        result.evidence = evidence;
+    return result;
+}
+function readString(buffer, start, length) {
+    const slice = buffer.subarray(start, start + length);
+    const nul = slice.indexOf(0);
+    return UTF8_DECODER.decode(slice.subarray(0, nul === -1 ? slice.length : nul));
+}
+function readOctal(buffer, start, length, field) {
+    const slice = buffer.subarray(start, start + length);
+    if ((slice[0] ?? 0) >= 0x80)
+        throw new Error(`unsupported base-256 tar ${field}`);
+    const value = slice.toString('ascii').replace(/\0.*$/s, '').trim();
+    if (value === '')
+        return 0;
+    if (!/^[0-7]+$/.test(value))
+        throw new Error(`invalid octal tar ${field}`);
+    const parsed = Number.parseInt(value, 8);
+    if (!Number.isSafeInteger(parsed) || parsed < 0)
+        throw new Error(`unsafe tar ${field}`);
+    return parsed;
+}
+function verifyHeaderChecksum(header) {
+    const expected = readOctal(header, 148, 8, 'checksum');
+    let actual = 0;
+    for (let index = 0; index < TAR_BLOCK; index += 1) {
+        actual += index >= 148 && index < 156 ? 0x20 : (header[index] ?? 0);
+    }
+    if (actual !== expected)
+        throw new Error(`tar header checksum mismatch: expected ${expected}, got ${actual}`);
+}
+function parsePax(contents) {
+    const values = {};
+    let offset = 0;
+    while (offset < contents.length) {
+        const space = contents.indexOf(0x20, offset);
+        if (space === -1)
+            throw new Error('invalid PAX record length');
+        const lengthText = contents.subarray(offset, space).toString('ascii');
+        if (!/^[1-9][0-9]*$/.test(lengthText))
+            throw new Error('invalid PAX record length');
+        const length = Number.parseInt(lengthText, 10);
+        const end = offset + length;
+        if (!Number.isSafeInteger(length) || end > contents.length || length <= space - offset + 2) {
+            throw new Error('PAX record exceeds archive bounds');
+        }
+        const record = UTF8_DECODER.decode(contents.subarray(space + 1, end - 1));
+        const equals = record.indexOf('=');
+        if (equals <= 0)
+            throw new Error('invalid PAX key/value record');
+        values[record.slice(0, equals)] = record.slice(equals + 1);
+        offset = end;
+    }
+    return values;
+}
+function pathIssue(rawPath) {
+    if (rawPath.includes('\0'))
+        return 'contains a NUL byte';
+    if (/[\u0001-\u001f\u007f-\u009f]/.test(rawPath))
+        return 'contains a control character';
+    if (Buffer.byteLength(rawPath) > MAX_PATH_BYTES)
+        return 'exceeds the path length budget';
+    if (rawPath.includes('\\'))
+        return 'contains a backslash';
+    if (rawPath.includes('//'))
+        return 'contains an empty path segment';
+    if (/[<>:"|?*]/.test(rawPath))
+        return 'contains a platform-reserved path character';
+    if (rawPath.startsWith('/') || /^[A-Za-z]:/.test(rawPath))
+        return 'is absolute';
+    const segments = rawPath.split('/');
+    if (segments.some(segment => Buffer.byteLength(segment) > MAX_PATH_SEGMENT_BYTES))
+        return 'contains an oversized path segment';
+    if (segments.some(segment => segment === '..'))
+        return 'contains a parent traversal segment';
+    if (segments.some(segment => segment.endsWith(' ') || segment.endsWith('.')))
+        return 'has a platform-ambiguous trailing character';
+    if (segments.some(segment => WINDOWS_RESERVED.test(segment)))
+        return 'contains a Windows reserved path segment';
+    return undefined;
+}
+function normalizeNpmPath(rawPath, expectedRoot) {
+    const issue = pathIssue(rawPath);
+    if (issue !== undefined)
+        return { issue };
+    const segments = rawPath.split('/').filter(segment => segment !== '' && segment !== '.');
+    const root = segments[0];
+    if (root === undefined)
+        return { issue: 'has no top-level archive directory' };
+    if (expectedRoot !== undefined && root !== expectedRoot) {
+        return { issue: `uses top-level directory ${root} instead of ${expectedRoot}` };
+    }
+    return { path: segments.slice(1).join('/'), root };
+}
+function linkEscapesPackage(entryPath, rawTarget) {
+    if (Buffer.byteLength(rawTarget) > MAX_PATH_BYTES)
+        return true;
+    if (rawTarget.includes('\0') || rawTarget.includes('\\') || rawTarget.startsWith('/') || /^[A-Za-z]:/.test(rawTarget))
+        return true;
+    const base = entryPath.split('/').slice(0, -1);
+    const stack = [...base];
+    for (const segment of rawTarget.split('/')) {
+        if (segment === '' || segment === '.')
+            continue;
+        if (segment.endsWith(' ') || segment.endsWith('.') || WINDOWS_RESERVED.test(segment))
+            return true;
+        if (segment === '..') {
+            if (stack.length === 0)
+                return true;
+            stack.pop();
+        }
+        else {
+            stack.push(segment);
+        }
+    }
+    return false;
+}
+function treeDigest(entries) {
+    const hash = createHash('sha256');
+    for (const entry of [...entries].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0)) {
+        hash.update(entry.path);
+        hash.update('\0');
+        hash.update(entry.type);
+        hash.update('\0');
+        hash.update(entry.digest);
+        hash.update('\0');
+        hash.update(String(entry.mode & 0o777));
+        hash.update('\n');
+    }
+    return `sha256:${hash.digest('hex')}`;
+}
+function inspectPathTopology(entries, addFinding) {
+    const byPortablePath = new Map(entries.map(entry => [entry.path.normalize('NFC').toLowerCase(), entry]));
+    const reported = new Set();
+    for (const entry of entries) {
+        const segments = entry.path.normalize('NFC').toLowerCase().split('/');
+        for (let length = 1; length < segments.length; length += 1) {
+            const ancestor = byPortablePath.get(segments.slice(0, length).join('/'));
+            if (ancestor === undefined || ancestor.type === 'directory')
+                continue;
+            const key = `${ancestor.path}\0${entry.path}`;
+            if (reported.has(key))
+                continue;
+            reported.add(key);
+            addFinding(finding('archive-path-topology-conflict', 'critical', `Archive path is nested below a non-directory: ${entry.path}`, 'File/link and child-path conflicts materialize inconsistently and can redirect writes across package managers.', { path: entry.path, ancestor: ancestor.path, ancestorType: ancestor.type }));
+        }
+    }
+}
+export function parseNpmTarball(compressed, options = {}) {
+    const maxEntries = options.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    const maxUnpackedBytes = options.maxUnpackedBytes ?? DEFAULT_MAX_UNPACKED_BYTES;
+    const maxFileBytes = options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES;
+    const maxCompressionRatio = options.maxCompressionRatio ?? 200;
+    if (compressed.length < 2 || compressed[0] !== 0x1f || compressed[1] !== 0x8b) {
+        throw new Error('npm artifact is not a gzip-compressed tarball');
+    }
+    let archive;
+    try {
+        archive = gunzipSync(compressed, { maxOutputLength: maxUnpackedBytes + TAR_BLOCK * 4 });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`unable to decompress npm artifact within budget: ${message}`);
+    }
+    const findings = [];
+    let omittedFindings = 0;
+    const addFinding = (candidate) => {
+        if (findings.length < MAX_REPORTED_FINDINGS) {
+            findings.push(candidate);
+            return;
+        }
+        omittedFindings += 1;
+        let lowestIndex = 0;
+        for (let index = 1; index < findings.length; index += 1) {
+            if (SEVERITY_RANK[findings[index]?.severity ?? 'info'] < SEVERITY_RANK[findings[lowestIndex]?.severity ?? 'info']) {
+                lowestIndex = index;
+            }
+        }
+        if (SEVERITY_RANK[candidate.severity] > SEVERITY_RANK[findings[lowestIndex]?.severity ?? 'info']) {
+            findings[lowestIndex] = candidate;
+        }
+    };
+    if (archive.length > compressed.length * maxCompressionRatio + 1024 * 1024) {
+        addFinding(finding('archive-suspicious-compression-ratio', 'critical', 'Archive expansion ratio exceeds policy', 'The compressed artifact expands far beyond its download size and may be intended to exhaust scanner resources.', { compressedBytes: compressed.length, unpackedBytes: archive.length, maxCompressionRatio }));
+    }
+    const entries = [];
+    const exactPaths = new Set();
+    const portablePaths = new Map();
+    let offset = 0;
+    let pendingPax = {};
+    let globalPax = {};
+    let pendingLongName;
+    let pendingLongLink;
+    let archiveRoot;
+    let headerCount = 0;
+    let budgetBytes = 0;
+    let fileBytes = 0;
+    while (offset + TAR_BLOCK <= archive.length) {
+        const header = archive.subarray(offset, offset + TAR_BLOCK);
+        if (header.every(byte => byte === 0))
+            break;
+        headerCount += 1;
+        if (headerCount > maxEntries)
+            throw new Error(`tar entry count exceeds ${maxEntries}`);
+        verifyHeaderChecksum(header);
+        const headerSize = readOctal(header, 124, 12, 'size');
+        if (headerSize > maxFileBytes)
+            throw new Error('tar entry exceeds per-entry budget');
+        budgetBytes += headerSize;
+        if (budgetBytes > maxUnpackedBytes)
+            throw new Error(`tar contents exceed ${maxUnpackedBytes} bytes`);
+        const contentStart = offset + TAR_BLOCK;
+        const contentEnd = contentStart + headerSize;
+        if (contentEnd > archive.length)
+            throw new Error('tar entry exceeds archive bounds');
+        const paddedSize = Math.ceil(headerSize / TAR_BLOCK) * TAR_BLOCK;
+        const nextOffset = contentStart + paddedSize;
+        if (nextOffset > archive.length)
+            throw new Error('tar padding exceeds archive bounds');
+        const typeFlag = String.fromCharCode(header[156] ?? 0);
+        const contents = archive.subarray(contentStart, contentEnd);
+        const headerName = readString(header, 0, 100);
+        const prefix = readString(header, 345, 155);
+        const combinedHeaderName = prefix === '' ? headerName : `${prefix}/${headerName}`;
+        if (typeFlag === 'x' || typeFlag === 'g') {
+            const parsed = parsePax(contents);
+            if (parsed.size !== undefined)
+                throw new Error('unsupported PAX size override');
+            if (typeFlag === 'g')
+                globalPax = { ...globalPax, ...parsed };
+            else
+                pendingPax = parsed;
+            offset = nextOffset;
+            continue;
+        }
+        if (typeFlag === 'L' || typeFlag === 'K') {
+            const value = UTF8_DECODER.decode(contents).replace(/\0.*$/s, '').replace(/\n$/, '');
+            if (typeFlag === 'L')
+                pendingLongName = value;
+            else
+                pendingLongLink = value;
+            offset = nextOffset;
+            continue;
+        }
+        const pax = { ...globalPax, ...pendingPax };
+        const rawPath = pax.path ?? pendingLongName ?? combinedHeaderName;
+        const rawLink = pax.linkpath ?? pendingLongLink ?? readString(header, 157, 100);
+        pendingPax = {};
+        pendingLongName = undefined;
+        pendingLongLink = undefined;
+        const normalized = normalizeNpmPath(rawPath, archiveRoot);
+        if (normalized.path === undefined) {
+            addFinding(finding('archive-unsafe-path', 'critical', `Unsafe archive path: ${rawPath.slice(0, 1_024)}`, `The entry ${normalized.issue ?? 'cannot be normalized safely'}.`, { path: rawPath.slice(0, 1_024) }));
+            offset = nextOffset;
+            continue;
+        }
+        archiveRoot ??= normalized.root;
+        const entryPath = normalized.path;
+        if (entryPath === '') {
+            if (typeFlag !== '5') {
+                addFinding(finding('archive-invalid-root-entry', 'critical', 'Archive package root is not a directory', 'Only a directory entry may represent the top-level archive root.', { path: rawPath.slice(0, 1_024), typeFlag }));
+            }
+            offset = nextOffset;
+            continue;
+        }
+        const portableKey = entryPath.normalize('NFC').toLowerCase();
+        const existingPortable = portablePaths.get(portableKey);
+        if (exactPaths.has(entryPath) || (existingPortable !== undefined && existingPortable !== entryPath)) {
+            addFinding(finding('archive-path-collision', 'critical', `Archive path collides with another entry: ${entryPath}`, 'Duplicate or case/Unicode-colliding paths can materialize differently across filesystems.', { path: entryPath, collidesWith: existingPortable ?? entryPath }));
+            offset = nextOffset;
+            continue;
+        }
+        exactPaths.add(entryPath);
+        portablePaths.set(portableKey, entryPath);
+        const mode = readOctal(header, 100, 8, 'mode');
+        const regularFile = typeFlag === '\0' || typeFlag === '0' || typeFlag === '7';
+        if (regularFile) {
+            fileBytes += headerSize;
+            const digest = createHash('sha256').update(contents).digest('hex');
+            entries.push({ path: entryPath, type: 'file', mode, size: headerSize, digest, contents: Buffer.from(contents) });
+        }
+        else if (typeFlag === '5') {
+            const digest = createHash('sha256').update('directory').digest('hex');
+            entries.push({ path: entryPath, type: 'directory', mode, size: 0, digest });
+        }
+        else if (typeFlag === '2' || typeFlag === '1') {
+            const escapes = linkEscapesPackage(entryPath, rawLink);
+            const linkType = typeFlag === '2' ? 'symlink' : 'hardlink';
+            addFinding(finding(escapes ? 'archive-link-escapes-package' : 'archive-link-present', escapes ? 'critical' : 'medium', escapes ? `Archive ${linkType} escapes the package root` : `Archive contains a ${linkType}`, escapes
+                ? 'Materializing this link could access or overwrite content outside the reviewed package.'
+                : 'Links require review because materialization differs across package managers and platforms.', { path: entryPath, target: rawLink.slice(0, 1_024), linkType }));
+            const digest = createHash('sha256').update(`${linkType}:${rawLink}`).digest('hex');
+            entries.push({ path: entryPath, type: linkType, mode, size: 0, digest, linkTarget: rawLink.slice(0, MAX_PATH_BYTES) });
+        }
+        else {
+            addFinding(finding('archive-special-entry', 'critical', `Archive contains unsupported entry type ${JSON.stringify(typeFlag)}`, 'Device, FIFO and unknown tar entry types are not safe to materialize during plugin review.', { path: entryPath, typeFlag }));
+        }
+        offset = nextOffset;
+    }
+    inspectPathTopology(entries, addFinding);
+    if (omittedFindings > 0) {
+        findings.push(finding('archive-findings-truncated', 'high', 'Additional archive findings were omitted', 'The report retained the highest-severity archive findings within its output budget.', { omittedFindings, retainedFindings: findings.length }));
+    }
+    return {
+        entries,
+        findings,
+        compressedBytes: compressed.length,
+        unpackedBytes: fileBytes,
+        treeDigest: treeDigest(entries),
+    };
+}
+//# sourceMappingURL=tar.js.map

package/dist/src/tar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar.js","sourceRoot":"","sources":["../../src/tar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAGtC,MAAM,SAAS,GAAG,GAAG,CAAA;AACrB,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAClC,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AACnD,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAC/C,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAA;AAC/B,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAClC,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,gBAAgB,GAAG,mDAAmD,CAAA;AAC5E,MAAM,YAAY,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9D,MAAM,aAAa,GAAwC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;AA2B/G,SAAS,OAAO,CACd,IAAY,EACZ,QAA6B,EAC7B,OAAe,EACf,MAAc,EACd,QAA8B;IAE9B,MAAM,MAAM,GAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IAC3D,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAA;IACtD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,CAAA;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5B,OAAO,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc,EAAE,KAAa;IAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,CAAA;IACpD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAA;IACjF,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAClE,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,CAAC,CAAA;IAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,EAAE,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,EAAE,CAAC,CAAA;IACvF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc;IAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,CAAA;IACtD,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,SAAS,MAAM,EAAE,CAAC,CAAA;AAC/G,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,OAAO,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC5C,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAC9D,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACrE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACnF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,GAAG,GAAG,MAAM,GAAG,MAAM,CAAA;QAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG,QAAQ,CAAC,MAAM,IAAI,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QACzE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,MAAM,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QAChE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC1D,MAAM,GAAG,GAAG,CAAA;IACd,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,qBAAqB,CAAA;IACxD,IAAI,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,8BAA8B,CAAA;IACvF,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,cAAc;QAAE,OAAO,gCAAgC,CAAA;IACxF,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,sBAAsB,CAAA;IACzD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,gCAAgC,CAAA;IACnE,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,6CAA6C,CAAA;IACnF,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,aAAa,CAAA;IAC/E,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,sBAAsB,CAAC;QAAE,OAAO,oCAAoC,CAAA;IAC9H,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC;QAAE,OAAO,qCAAqC,CAAA;IAC5F,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,6CAA6C,CAAA;IAClI,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,0CAA0C,CAAA;IAC/G,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,YAAqB;IAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,CAAC,CAAA;IACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IACxB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAA;IAC9E,IAAI,YAAY,KAAK,SAAS,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,4BAA4B,IAAI,eAAe,YAAY,EAAE,EAAE,CAAA;IACjF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;AACpD,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB,EAAE,SAAiB;IAC9D,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,cAAc;QAAE,OAAO,IAAI,CAAA;IAC9D,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IAClI,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC9C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;IACvB,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;YAAE,SAAQ;QAC/C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAA;QACjG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YACnC,KAAK,CAAC,GAAG,EAAE,CAAA;QACb,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,UAAU,CAAC,OAA4B;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;IACD,OAAO,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AACvC,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA4B,EAAE,UAAsC;IAC/F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;IACxG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrE,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACxE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAQ;YACrE,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAA;YAC7C,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAQ;YAC/B,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACjB,UAAU,CAAC,OAAO,CAChB,gCAAgC,EAChC,UAAU,EACV,iDAAiD,KAAK,CAAC,IAAI,EAAE,EAC7D,gHAAgH,EAChH,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAC3E,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,OAAO,GAAe,EAAE;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAA;IAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAA;IAC/E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAA;IACnE,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,GAAG,CAAA;IAC9D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,UAAU,CAAC,UAAU,EAAE,EAAE,eAAe,EAAE,gBAAgB,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC,CAAA;IACzF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtE,MAAM,IAAI,KAAK,CAAC,oDAAoD,OAAO,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAA;IAC9B,IAAI,eAAe,GAAG,CAAC,CAAA;IACvB,MAAM,UAAU,GAAG,CAAC,SAAkB,EAAQ,EAAE;QAC9C,IAAI,QAAQ,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACxB,OAAM;QACR,CAAC;QACD,eAAe,IAAI,CAAC,CAAA;QACpB,IAAI,WAAW,GAAG,CAAC,CAAA;QACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,IAAI,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC;gBAClH,WAAW,GAAG,KAAK,CAAA;YACrB,CAAC;QACH,CAAC;QACD,IAAI,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC;YACjG,QAAQ,CAAC,WAAW,CAAC,GAAG,SAAS,CAAA;QACnC,CAAC;IACH,CAAC,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,mBAAmB,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAC3E,UAAU,CAAC,OAAO,CAChB,sCAAsC,EACtC,UAAU,EACV,wCAAwC,EACxC,gHAAgH,EAChH,EAAE,eAAe,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAC3F,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,OAAO,GAAe,EAAE,CAAA;IAC9B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC/C,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,UAAU,GAA2B,EAAE,CAAA;IAC3C,IAAI,SAAS,GAA2B,EAAE,CAAA;IAC1C,IAAI,eAAmC,CAAA;IACvC,IAAI,eAAmC,CAAA;IACvC,IAAI,WAA+B,CAAA;IACnC,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,OAAO,MAAM,GAAG,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;QAC3D,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,MAAK;QAC3C,WAAW,IAAI,CAAC,CAAA;QAChB,IAAI,WAAW,GAAG,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAA;QACtF,oBAAoB,CAAC,MAAM,CAAC,CAAA;QAE5B,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;QACrD,IAAI,UAAU,GAAG,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACpF,WAAW,IAAI,UAAU,CAAA;QACzB,IAAI,WAAW,GAAG,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,gBAAgB,QAAQ,CAAC,CAAA;QACpG,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,CAAA;QACvC,MAAM,UAAU,GAAG,YAAY,GAAG,UAAU,CAAA;QAC5C,IAAI,UAAU,GAAG,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACpF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;QAChE,MAAM,UAAU,GAAG,YAAY,GAAG,UAAU,CAAA;QAC5C,IAAI,UAAU,GAAG,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QAEtF,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;QACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;QAC3D,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA;QAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAC3C,MAAM,kBAAkB,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,UAAU,EAAE,CAAA;QAEjF,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;YACjC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;YAC/E,IAAI,QAAQ,KAAK,GAAG;gBAAE,SAAS,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,MAAM,EAAE,CAAA;;gBACxD,UAAU,GAAG,MAAM,CAAA;YACxB,MAAM,GAAG,UAAU,CAAA;YACnB,SAAQ;QACV,CAAC;QACD,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACpF,IAAI,QAAQ,KAAK,GAAG;gBAAE,eAAe,GAAG,KAAK,CAAA;;gBACxC,eAAe,GAAG,KAAK,CAAA;YAC5B,MAAM,GAAG,UAAU,CAAA;YACnB,SAAQ;QACV,CAAC;QAED,MAAM,GAAG,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,UAAU,EAAE,CAAA;QAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,eAAe,IAAI,kBAAkB,CAAA;QACjE,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,eAAe,IAAI,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAC/E,UAAU,GAAG,EAAE,CAAA;QACf,eAAe,GAAG,SAAS,CAAA;QAC3B,eAAe,GAAG,SAAS,CAAA;QAE3B,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QACzD,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,UAAU,CAAC,OAAO,CAChB,qBAAqB,EACrB,UAAU,EACV,wBAAwB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EACjD,aAAa,UAAU,CAAC,KAAK,IAAI,6BAA6B,GAAG,EACjE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAClC,CAAC,CAAA;YACF,MAAM,GAAG,UAAU,CAAA;YACnB,SAAQ;QACV,CAAC;QACD,WAAW,KAAK,UAAU,CAAC,IAAI,CAAA;QAC/B,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAA;QACjC,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACrB,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACrB,UAAU,CAAC,OAAO,CAChB,4BAA4B,EAC5B,UAAU,EACV,yCAAyC,EACzC,kEAAkE,EAClE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,CAC5C,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,GAAG,UAAU,CAAA;YACnB,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;QAC5D,MAAM,gBAAgB,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACvD,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,SAAS,CAAC,EAAE,CAAC;YACpG,UAAU,CAAC,OAAO,CAChB,wBAAwB,EACxB,UAAU,EACV,6CAA6C,SAAS,EAAE,EACxD,2FAA2F,EAC3F,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,gBAAgB,IAAI,SAAS,EAAE,CACjE,CAAC,CAAA;YACF,MAAM,GAAG,UAAU,CAAA;YACnB,SAAQ;QACV,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACzB,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;QAEzC,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,WAAW,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,CAAA;QAC7E,IAAI,WAAW,EAAE,CAAC;YAChB,SAAS,IAAI,UAAU,CAAA;YACvB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAClE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAClH,CAAC;aAAM,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QAC7E,CAAC;aAAM,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;YACtD,MAAM,QAAQ,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAA;YAC1D,UAAU,CAAC,OAAO,CAChB,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,sBAAsB,EACjE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAC/B,OAAO,CAAC,CAAC,CAAC,WAAW,QAAQ,2BAA2B,CAAC,CAAC,CAAC,sBAAsB,QAAQ,EAAE,EAC3F,OAAO;gBACL,CAAC,CAAC,yFAAyF;gBAC3F,CAAC,CAAC,6FAA6F,EACjG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,CAC/D,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAClF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC,CAAA;QACxH,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,OAAO,CAChB,uBAAuB,EACvB,UAAU,EACV,2CAA2C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EACrE,4FAA4F,EAC5F,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAC9B,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,GAAG,UAAU,CAAA;IACrB,CAAC;IAED,mBAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IACxC,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,OAAO,CACnB,4BAA4B,EAC5B,MAAM,EACN,0CAA0C,EAC1C,qFAAqF,EACrF,EAAE,eAAe,EAAE,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CACvD,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,OAAO;QACP,QAAQ;QACR,eAAe,EAAE,UAAU,CAAC,MAAM;QAClC,aAAa,EAAE,SAAS;QACxB,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC;KAChC,CAAA;AACH,CAAC"}

package/dist/src/types.d.ts

@@ -0,0 +1,111 @@
+import type { DependencyGraph } from './radar-types.js';
+export declare const REPORT_SCHEMA: 'upstream-radar.scan/v1alpha1';
+export type Severity = 'info' | 'low' | 'medium' | 'high' | 'critical';
+export type Verdict = 'allow' | 'warn' | 'review' | 'block';
+export type CoverageVerdict = 'complete' | 'incomplete';
+export type CheckStatus = 'verified' | 'missing' | 'invalid' | 'failed' | 'not-checked' | 'present-unverified';
+export interface Finding {
+    code: string;
+    severity: Severity;
+    summary: string;
+    detail: string;
+    evidence?: Record<string, boolean | number | string | string[]>;
+    remediation?: string;
+}
+export interface DependencyEvidence {
+    name: string;
+    scope: 'dependency' | 'devDependency' | 'optionalDependency' | 'peerDependency';
+    spec: string;
+}
+export interface LifecycleScriptEvidence {
+    name: string;
+    command: string;
+}
+export interface DshEvidence {
+    isBundle: boolean;
+    patch?: string;
+}
+export interface Coverage {
+    staticSource: 'complete' | 'incomplete';
+    artifactIntegrity: 'locally-hashed' | 'verified' | 'invalid' | 'not-checked';
+    registrySignature: CheckStatus;
+    dependencyResolution: 'manifest-only' | 'resolved';
+    provenance: CheckStatus;
+    sourceArtifactMatch: 'not-checked' | 'matched' | 'mismatch';
+    sandboxDetonation: 'not-run';
+}
+export interface VulnerabilitySummary {
+    info: number;
+    low: number;
+    moderate: number;
+    high: number;
+    critical: number;
+    total: number;
+}
+export interface NpmProvenanceEvidence {
+    status: CheckStatus;
+    predicateType?: string;
+    sourceRepository?: string;
+    sourceRef?: string;
+    sourceCommit?: string;
+    workflow?: string;
+    builder?: string;
+}
+export interface NpmEvidence {
+    registry: string;
+    tarball: string;
+    compressedBytes: number;
+    unpackedBytes: number;
+    integrity: {
+        status: 'verified' | 'invalid';
+        algorithm: string;
+        expected: string;
+        actual: string;
+    };
+    registrySignature: {
+        status: CheckStatus;
+        keyIds: string[];
+    };
+    provenance: NpmProvenanceEvidence;
+    dependencyAudit: {
+        status: 'not-run' | 'verified' | 'findings' | 'failed';
+        packages: number | null;
+        graphDigest?: string;
+        graph?: DependencyGraph;
+        invalidSignatures: string[];
+        missingSignatures: string[];
+        vulnerabilities: VulnerabilitySummary | null;
+        error?: string;
+    };
+}
+export interface ScanReport {
+    schema: typeof REPORT_SCHEMA;
+    tool: {
+        name: 'upstream-radar';
+        version: string;
+    };
+    target: {
+        kind: 'directory' | 'npm';
+        name: string;
+        version: string | null;
+        artifactDigest: string;
+        treeDigest?: string;
+        spec?: string;
+    };
+    dsh: DshEvidence;
+    evidence: {
+        filesScanned: number;
+        bytesHashed: number;
+        lockfiles: string[];
+        packageManager: string | null;
+        lifecycleScripts: LifecycleScriptEvidence[];
+        dependencies: DependencyEvidence[];
+        npm?: NpmEvidence;
+    };
+    coverage: Coverage;
+    findings: Finding[];
+    riskVerdict: Verdict;
+    coverageVerdict: CoverageVerdict;
+    verdict: Verdict;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEvD,eAAO,MAAM,aAAa,EAAG,8BAAuC,CAAA;AAEpE,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAEtE,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;AAE3D,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,YAAY,CAAA;AAEvD,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,oBAAoB,CAAA;AAE9G,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,QAAQ,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,YAAY,GAAG,eAAe,GAAG,oBAAoB,GAAG,gBAAgB,CAAA;IAC/E,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,UAAU,GAAG,YAAY,CAAA;IACvC,iBAAiB,EAAE,gBAAgB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAA;IAC5E,iBAAiB,EAAE,WAAW,CAAA;IAC9B,oBAAoB,EAAE,eAAe,GAAG,UAAU,CAAA;IAClD,UAAU,EAAE,WAAW,CAAA;IACvB,mBAAmB,EAAE,aAAa,GAAG,SAAS,GAAG,UAAU,CAAA;IAC3D,iBAAiB,EAAE,SAAS,CAAA;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,WAAW,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE;QACT,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;QAC9B,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;IACD,iBAAiB,EAAE;QACjB,MAAM,EAAE,WAAW,CAAA;QACnB,MAAM,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,eAAe,EAAE;QACf,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAA;QACtD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,KAAK,CAAC,EAAE,eAAe,CAAA;QACvB,iBAAiB,EAAE,MAAM,EAAE,CAAA;QAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAA;QAC3B,eAAe,EAAE,oBAAoB,GAAG,IAAI,CAAA;QAC5C,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,OAAO,aAAa,CAAA;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,gBAAgB,CAAA;QACtB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,MAAM,EAAE;QACN,IAAI,EAAE,WAAW,GAAG,KAAK,CAAA;QACzB,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;QACtB,cAAc,EAAE,MAAM,CAAA;QACtB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;IACD,GAAG,EAAE,WAAW,CAAA;IAChB,QAAQ,EAAE;QACR,YAAY,EAAE,MAAM,CAAA;QACpB,WAAW,EAAE,MAAM,CAAA;QACnB,SAAS,EAAE,MAAM,EAAE,CAAA;QACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;QAC7B,gBAAgB,EAAE,uBAAuB,EAAE,CAAA;QAC3C,YAAY,EAAE,kBAAkB,EAAE,CAAA;QAClC,GAAG,CAAC,EAAE,WAAW,CAAA;KAClB,CAAA;IACD,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAA;IACnB,WAAW,EAAE,OAAO,CAAA;IACpB,eAAe,EAAE,eAAe,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB"}

package/dist/src/types.js

@@ -0,0 +1,2 @@
+export const REPORT_SCHEMA = 'upstream-radar.scan/v1alpha1';
+//# sourceMappingURL=types.js.map

package/dist/src/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,aAAa,GAAG,8BAAuC,CAAA"}

package/dist/src/version.d.ts

@@ -0,0 +1,2 @@
+export declare const TOOL_VERSION = "0.4.0";
+//# sourceMappingURL=version.d.ts.map

package/dist/src/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,UAAU,CAAA"}

package/dist/src/version.js

@@ -0,0 +1,2 @@
+export const TOOL_VERSION = '0.4.0';
+//# sourceMappingURL=version.js.map

package/dist/src/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAA"}

package/package.json

@@ -0,0 +1,84 @@
+{
+  "name": "upstream-radar",
+  "version": "0.4.0",
+  "description": "Always-on vulnerability and breaking-change impact monitoring for DeepSeek Harness plugins.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "author": "MicroMilo",
+  "homepage": "https://github.com/MicroMilo/upstream-radar#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MicroMilo/upstream-radar.git"
+  },
+  "bugs": {
+    "url": "https://github.com/MicroMilo/upstream-radar/issues"
+  },
+  "keywords": [
+    "deepseek-harness",
+    "dsh-plugin",
+    "cordis",
+    "dependency-security",
+    "vulnerability-monitoring",
+    "breaking-changes",
+    "supply-chain"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "packageManager": "pnpm@11.3.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "upstream-radar": "dist/src/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "import": "./dist/src/index.js"
+    },
+    "./dsh": {
+      "types": "./dist/src/dsh-plugin.d.ts",
+      "import": "./dist/src/dsh-plugin.js"
+    },
+    "./cordis.patch.yml": {
+      "default": "./cordis.patch.yml"
+    }
+  },
+  "files": [
+    "dist/src",
+    "schemas",
+    "cordis.patch.yml",
+    "docs/assets/upstream-radar-hero.jpg",
+    "docs/assets/upstream-radar-hero-mobile.jpg",
+    "README.md",
+    "README.zh-CN.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "cli": "node dist/src/cli.js",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "scan:self": "pnpm run build && node dist/src/cli.js scan . --fail-on block",
+    "showcase": "pnpm run build && node scripts/radar-showcase.mjs",
+    "showcase:reports": "pnpm run build && node scripts/radar-showcase.mjs --write-reports",
+    "showcase:admission": "pnpm run build && node scripts/showcase.mjs",
+    "showcase:admission:reports": "pnpm run build && node scripts/showcase.mjs --write-reports",
+    "showcase:radar": "pnpm run build && node scripts/radar-showcase.mjs",
+    "showcase:radar:reports": "pnpm run build && node scripts/radar-showcase.mjs --write-reports",
+    "try:dsh": "pnpm run build && node scripts/dsh-headless-showcase.mjs",
+    "try:dsh:live": "pnpm run build && node scripts/dsh-headless-showcase.mjs --live-feeds",
+    "try:dsh:report": "pnpm run build && node scripts/dsh-headless-showcase.mjs --write-report",
+    "prepublishOnly": "pnpm test",
+    "test": "pnpm run build && node --test dist/test/*.test.js"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "devDependencies": {
+    "@types/node": "26.2.0",
+    "typescript": "7.0.2"
+  }
+}

package/schemas/analysis-result.schema.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/MicroMilo/upstream-radar/blob/main/schemas/analysis-result.schema.json",
+  "title": "Upstream Radar project analysis result",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "project_exposure",
+    "confidence",
+    "evidence",
+    "recommended_action",
+    "urgency",
+    "reasoning_summary"
+  ],
+  "properties": {
+    "project_exposure": {
+      "enum": ["exposed", "likely_exposed", "not_exposed", "unknown"]
+    },
+    "confidence": {
+      "enum": ["high", "medium", "low"]
+    },
+    "evidence": {
+      "type": "array",
+      "items": { "type": "string" },
+      "maxItems": 100
+    },
+    "recommended_action": {
+      "type": "string",
+      "maxLength": 8192
+    },
+    "urgency": {
+      "enum": ["immediate", "within_24_hours", "planned", "monitor"]
+    },
+    "reasoning_summary": {
+      "type": "string",
+      "maxLength": 8192
+    }
+  }
+}