@0xrama/bnpm 0.0.1

package/dist/src/security/analyzer.js

@@ -0,0 +1,241 @@
+import { createHash } from "node:crypto";
+import { open, readFile, readdir, stat } from "node:fs/promises";
+import { join, relative, resolve, sep } from "node:path";
+export const lifecycleStages = ["preinstall", "install", "postinstall"];
+export const gitBuildStages = ["preinstall", "install", "postinstall", "prepare"];
+const rules = [
+    { id: "BNPM-SEC-001", severity: "dangerous", behavior: "Possible reverse-shell behavior", expression: /(?:\/dev\/tcp\/|\bnc\s+[^\n]*\s-e\s|bash\s+-i[^\n]*(?:>&|\|))/i, remediation: "Remove or independently verify the reverse-shell behavior." },
+    { id: "BNPM-SEC-002", severity: "dangerous", behavior: "Remote payload download followed by execution", expression: /(?:(?:curl|wget)\b[^\n|;&]*(?:\||&&|;)\s*(?:sh|bash|node|python)|(?:curl|wget)\b[^\n]*(?:chmod\s+\+x|child_process))/i, remediation: "Pin and verify downloaded content instead of executing a remote payload." },
+    { id: "BNPM-SEC-003", severity: "warning", behavior: "Credential or secret material is targeted", expression: /(?:\.npmrc|\.ssh(?:\/|\\)|AWS_SECRET_ACCESS_KEY|AWS_ACCESS_KEY_ID|NPM_TOKEN|GITHUB_TOKEN|keychain|(?:credentials|secrets)\.json)/i, remediation: "Confirm why installation needs access to credentials or secret stores." },
+    { id: "BNPM-SEC-004", severity: "dangerous", behavior: "Persistence mechanism is installed", expression: /(?:crontab|LaunchAgents|LaunchDaemons|systemctl\s+enable|schtasks\s+\/create)/i, remediation: "Remove persistence changes from package installation." },
+    { id: "BNPM-SEC-005", severity: "dangerous", behavior: "Destructive filesystem command is present", expression: /(?:rm\s+-rf\s+(?:\/|~)|mkfs\b|diskutil\s+erase|format\s+[A-Z]:)/i, remediation: "Remove destructive filesystem operations." },
+    { id: "BNPM-SEC-006", severity: "dangerous", behavior: "Cryptocurrency miner behavior is present", expression: /(?:xmrig|stratum\+(?:tcp|ssl)|cryptonight|minerd\b)/i, remediation: "Remove miner download or execution behavior." },
+    { id: "BNPM-SEC-007", severity: "warning", behavior: "Obfuscated content is connected to process execution", expression: /(?:eval\s*\(\s*(?:Buffer\.from|atob)|child_process[^\n]{0,160}(?:base64|fromCharCode))/i, remediation: "Replace obfuscated execution with reviewable source." },
+];
+const capabilityRules = [
+    { kind: "ai-history-read", severity: "warning", behavior: "May read local AI assistant chat logs and session history", expression: /(?:CODEX_HOME|GEMINI_CLI_HOME|HERMES_HOME|JCODE_HOME|GROK_HOME|\.codex(?:\/|\\)|\.claude\/projects|\.config\/opencode|opencode\/storage\/message|\.cursor|\.gemini|amp\/threads|droid\.factory\/sessions|\.kimi\/sessions|\.qwen\/projects|roocode|kilocode|cline|antigravity-cache\/sessions|zed\/threads|trae-cache\/sessions|warp-cache)/ig },
+    { kind: "credential-read", severity: "warning", behavior: "May read authentication tokens, credentials, cookies, or account configuration", expression: /(?:auth\.json|credentials\.json|codex-credentials\.json|secrets\.json|hosts\.yml|oauth[_-]?token|refresh[_-]?token|session[_-]?token|api[_-]?token|keychain|credential store)/ig },
+    { kind: "network-access", severity: "notice", behavior: "May make outbound network requests", expression: /https:\/\/[A-Za-z0-9._~:/?#@!$&'()*+,;=%-]+/ig },
+    { kind: "local-write", severity: "notice", behavior: "May write local configuration, cache, database, or report files", expression: /(?:writeFile(?:Sync)?|create_dir(?:_all)?|\.config\/tokscale|stats-cache\.json|tui-data-cache\.json|\.sqlite|\.db\b)/ig },
+    { kind: "process-spawn", severity: "warning", behavior: "May launch subprocesses or platform-native helper programs", expression: /(?:child_process|spawnSync|execSync|Command::new|std::process::Command)/ig },
+];
+const hash = (value) => `sha256-${createHash("sha256").update(value).digest("base64")}`;
+function passiveEvidencePath(path) {
+    return /(?:^|\/)(?:readme|changelog|changes|license)(?:\.[^/]*)?$|\.(?:md|mdx|map|d\.ts|d\.mts|d\.cts)$/i.test(path);
+}
+function referencedCommandFiles(command) {
+    const matches = command.matchAll(/(?:^|\s)(?:node|sh|bash|zsh|python(?:3)?|\.\/)(?:\s+)?([A-Za-z0-9_./-]+\.(?:js|cjs|mjs|sh|py))(?:\s|$)/g);
+    return [...new Set([...matches].map((match) => match[1]).filter((value) => value !== undefined))].sort();
+}
+function safeReference(root, path) {
+    const target = resolve(root, path);
+    if (target !== root && !target.startsWith(`${root}${sep}`))
+        throw new Error(`Lifecycle script references a file outside the package: ${path}`);
+    return target;
+}
+function finding(rule, packageName, packageVersion, path, content, index) {
+    const before = content.slice(0, index);
+    const line = before.split("\n").length;
+    const column = index - before.lastIndexOf("\n");
+    const evidence = content.slice(Math.max(0, index - 40), Math.min(content.length, index + 120)).replace(/\s+/g, " ").slice(0, 160);
+    return { ruleId: rule.id, severity: rule.severity, packageName, packageVersion, behavior: rule.behavior, evidence, location: { path, line, column }, remediation: rule.remediation };
+}
+export async function analyzePackage(options) {
+    const maxFiles = options.maxFiles ?? 20_000;
+    const maxBytes = options.maxBytes ?? 64 * 1024 * 1024;
+    let files = 0;
+    let bytes = 0;
+    let limitedAt;
+    const findings = [];
+    const capabilityEvidence = new Map();
+    const recordCapability = (kind, severity, behavior, evidence) => {
+        let current = capabilityEvidence.get(kind);
+        if (!current) {
+            current = { severity, behavior, evidence: new Set() };
+            capabilityEvidence.set(kind, current);
+        }
+        if (current.evidence.size < 64)
+            current.evidence.add(evidence.replace(/[^\x20-\x7E]+/g, " ").slice(0, 160));
+    };
+    const scanCapabilities = (path, content, inspectMagic = false) => {
+        const magic = content.subarray(0, 4).toString("hex");
+        if (inspectMagic && (["cffaedfe", "cefaedfe", "feedfacf", "feedface", "7f454c46"].includes(magic) || content.subarray(0, 2).toString("ascii") === "MZ"))
+            recordCapability("native-code", "warning", "Contains native executable code that cannot be fully inspected as JavaScript", path);
+        const searchable = content.toString("latin1");
+        for (const rule of capabilityRules) {
+            if (passiveEvidencePath(path) || (rule.kind === "network-access" && /(?:^|\/)package\.json$/i.test(path)))
+                continue;
+            rule.expression.lastIndex = 0;
+            let matches = 0;
+            for (const match of searchable.matchAll(rule.expression)) {
+                const value = match[0];
+                if (!value)
+                    continue;
+                let displayed = value;
+                if (rule.kind === "network-access") {
+                    try {
+                        displayed = new URL(value.replace(/[\"'`]+$/g, "")).origin;
+                    }
+                    catch { /* retain bounded source evidence */ }
+                }
+                else if (rule.kind === "ai-history-read") {
+                    if (/CODEX_HOME|\.codex/i.test(value))
+                        displayed = "Codex: $CODEX_HOME or ~/.codex";
+                    else if (/claude/i.test(value))
+                        displayed = "Claude Code: ~/.claude/projects";
+                    else if (/opencode/i.test(value))
+                        displayed = "OpenCode session storage";
+                    else if (/cursor/i.test(value))
+                        displayed = "Cursor session storage";
+                    else if (/GEMINI|\.gemini/i.test(value))
+                        displayed = "Gemini CLI session storage";
+                }
+                recordCapability(rule.kind, rule.severity, rule.behavior, `${path}: ${displayed}`);
+                if (++matches >= 256)
+                    break;
+            }
+        }
+    };
+    const scan = (path, content) => {
+        if (passiveEvidencePath(path))
+            return;
+        for (const rule of rules) {
+            rule.expression.lastIndex = 0;
+            const match = rule.expression.exec(content);
+            if (match?.index === undefined)
+                continue;
+            const lineStart = content.lastIndexOf("\n", match.index - 1) + 1;
+            const prefix = content.slice(lineStart, match.index);
+            if (rule.id === "BNPM-SEC-002" && /\b(?:echo|printf|console\.(?:log|warn|error))\b/i.test(prefix))
+                continue;
+            findings.push(finding(rule, options.packageName, options.packageVersion, path, content, match.index));
+        }
+    };
+    const walk = async (directory) => {
+        for (const entry of (await readdir(directory, { withFileTypes: true })).sort((left, right) => left.name.localeCompare(right.name))) {
+            if (["node_modules", ".git", ".bnpm-store.json"].includes(entry.name))
+                continue;
+            const path = join(directory, entry.name);
+            if (entry.isDirectory()) {
+                await walk(path);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            files += 1;
+            if (files > maxFiles)
+                throw new Error(`Package analysis exceeds ${maxFiles} files`);
+            const size = (await stat(path)).size;
+            const displayPath = relative(options.root, path).split(sep).join("/");
+            if (passiveEvidencePath(displayPath))
+                continue;
+            const handle = await open(path, "r");
+            try {
+                const chunks = [];
+                let position = 0;
+                let overlap = Buffer.alloc(0);
+                const chunkSize = 1024 * 1024;
+                while (position < size && bytes < maxBytes) {
+                    const length = Math.min(chunkSize, size - position, maxBytes - bytes);
+                    if (length <= 0)
+                        break;
+                    const chunk = Buffer.allocUnsafe(length);
+                    const result = await handle.read(chunk, 0, length, position);
+                    if (result.bytesRead === 0)
+                        break;
+                    const content = chunk.subarray(0, result.bytesRead);
+                    if (size <= 2 * 1024 * 1024)
+                        chunks.push(content);
+                    bytes += result.bytesRead;
+                    scanCapabilities(displayPath, overlap.length === 0 ? content : Buffer.concat([overlap, content]), position === 0);
+                    overlap = content.subarray(Math.max(0, content.length - 256));
+                    position += result.bytesRead;
+                }
+                if (position < size)
+                    limitedAt ??= displayPath;
+                if (position === size && size <= 2 * 1024 * 1024) {
+                    const content = Buffer.concat(chunks);
+                    if (!content.includes(0))
+                        scan(displayPath, content.toString("utf8"));
+                }
+                if (position === 0) {
+                    const magic = Buffer.allocUnsafe(Math.min(4, size));
+                    const result = await handle.read(magic, 0, magic.length, 0);
+                    scanCapabilities(displayPath, magic.subarray(0, result.bytesRead), true);
+                }
+            }
+            finally {
+                await handle.close();
+            }
+        }
+    };
+    await walk(options.root);
+    if (limitedAt !== undefined)
+        findings.push({
+            ruleId: "BNPM-SEC-009",
+            severity: "warning",
+            packageName: options.packageName,
+            packageVersion: options.packageVersion,
+            behavior: "Static content inspection reached its bounded scan budget",
+            evidence: `Scanned ${bytes} bytes; remaining content starts at or after ${limitedAt}`.slice(0, 160),
+            location: { path: limitedAt },
+            remediation: "Use package-specific review or sandboxing when complete static inspection is required.",
+        });
+    const lifecycles = [];
+    for (const stage of options.stages ?? lifecycleStages) {
+        const declaredCommand = options.scripts?.[stage];
+        let command = declaredCommand;
+        let implicitNodeGyp = false;
+        if (stage === "install" && declaredCommand === undefined) {
+            try {
+                implicitNodeGyp = (await stat(join(options.root, "binding.gyp"))).isFile();
+                if (implicitNodeGyp)
+                    command = "node-gyp rebuild";
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+        }
+        if (!command)
+            continue;
+        scan(`package.json#scripts.${stage}`, command);
+        const referencedFiles = implicitNodeGyp ? ["binding.gyp"] : referencedCommandFiles(command);
+        const referencedContent = [];
+        for (const path of referencedFiles) {
+            try {
+                const content = await readFile(safeReference(options.root, path));
+                referencedContent.push(Buffer.from(`${path}\0`), content, Buffer.from("\0"));
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+                referencedContent.push(Buffer.from(`${path}\0[MISSING]\0`));
+                findings.push({
+                    ruleId: "BNPM-SEC-008",
+                    severity: "warning",
+                    packageName: options.packageName,
+                    packageVersion: options.packageVersion,
+                    behavior: "Lifecycle command references a file absent from the package",
+                    evidence: path.slice(0, 160),
+                    location: { path: `package.json#scripts.${stage}` },
+                    remediation: "Publish the referenced script or remove the lifecycle command.",
+                });
+            }
+        }
+        lifecycles.push({
+            packageName: options.packageName,
+            packageVersion: options.packageVersion,
+            integrity: options.integrity,
+            stage,
+            command,
+            commandHash: hash(command),
+            contentHash: hash(Buffer.concat(referencedContent)),
+            referencedFiles,
+        });
+    }
+    findings.sort((left, right) => left.ruleId.localeCompare(right.ruleId) || (left.location?.path ?? "").localeCompare(right.location?.path ?? ""));
+    const capabilities = [...capabilityEvidence].sort(([left], [right]) => left.localeCompare(right)).map(([kind, value]) => ({ kind, severity: value.severity, packageName: options.packageName, packageVersion: options.packageVersion, behavior: value.behavior, evidence: [...value.evidence].sort() }));
+    return { analysis: { packageName: options.packageName, packageVersion: options.packageVersion, integrity: options.integrity, ruleSetVersion: "1", findings }, lifecycles, capabilities };
+}
+//# sourceMappingURL=analyzer.js.map

package/dist/src/security/analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.js","sourceRoot":"","sources":["../../../src/security/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGzD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAU,CAAC;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,CAAU,CAAC;AAuC3F,MAAM,KAAK,GAAoB;IAC7B,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,iCAAiC,EAAE,UAAU,EAAE,gEAAgE,EAAE,WAAW,EAAE,4DAA4D,EAAE;IACnP,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,+CAA+C,EAAE,UAAU,EAAE,uHAAuH,EAAE,WAAW,EAAE,0EAA0E,EAAE;IACtU,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,2CAA2C,EAAE,UAAU,EAAE,mIAAmI,EAAE,WAAW,EAAE,wEAAwE,EAAE;IAC1U,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,oCAAoC,EAAE,UAAU,EAAE,gFAAgF,EAAE,WAAW,EAAE,uDAAuD,EAAE;IACjQ,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,2CAA2C,EAAE,UAAU,EAAE,kEAAkE,EAAE,WAAW,EAAE,2CAA2C,EAAE;IAC9O,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,0CAA0C,EAAE,UAAU,EAAE,sDAAsD,EAAE,WAAW,EAAE,8CAA8C,EAAE;IACpO,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,sDAAsD,EAAE,UAAU,EAAE,yFAAyF,EAAE,WAAW,EAAE,sDAAsD,EAAE;CACjR,CAAC;AAEX,MAAM,eAAe,GAAmL;IACtM,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,2DAA2D,EAAE,UAAU,EAAE,+UAA+U,EAAE;IACpd,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,gFAAgF,EAAE,UAAU,EAAE,iLAAiL,EAAE;IAC3U,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,oCAAoC,EAAE,UAAU,EAAE,+CAA+C,EAAE;IAC3J,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,iEAAiE,EAAE,UAAU,EAAE,wHAAwH,EAAE;IAC9P,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,4DAA4D,EAAE,UAAU,EAAE,2EAA2E,EAAE;CACvM,CAAC;AAEX,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAEjH,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,kGAAkG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvH,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,yGAAyG,CAAC,CAAC;IAC5I,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5H,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAAY;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,IAAI,EAAE,CAAC,CAAC;IAC/I,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,IAAU,EAAE,WAAmB,EAAE,cAAsB,EAAE,IAAY,EAAE,OAAe,EAAE,KAAa;IACpH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClI,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;AACvL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OASpC;IACC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACtD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,SAA6B,CAAC;IAClC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAmI,CAAC;IACtK,MAAM,gBAAgB,GAAG,CAAC,IAA6B,EAAE,QAA8B,EAAE,QAAgB,EAAE,QAAgB,EAAQ,EAAE;QACnI,IAAI,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAAC,CAAC;QAC3J,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE;YAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9G,CAAC,CAAC;IACF,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,YAAY,GAAG,KAAK,EAAQ,EAAE;QACrF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,YAAY,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;YAAE,gBAAgB,CAAC,aAAa,EAAE,SAAS,EAAE,8EAA8E,EAAE,IAAI,CAAC,CAAC;QAC1R,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACpH,IAAI,CAAC,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC;YAAC,IAAI,OAAO,GAAG,CAAC,CAAC;YAC/C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAC,IAAI,CAAC,KAAK;oBAAE,SAAS;gBAAC,IAAI,SAAS,GAAG,KAAK,CAAC;gBACpE,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBAAC,IAAI,CAAC;wBAAC,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,oCAAoC,CAAC,CAAC;gBAAC,CAAC;qBACrJ,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACzC,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,SAAS,GAAG,gCAAgC,CAAC;yBAC/E,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,SAAS,GAAG,iCAAiC,CAAC;yBACzE,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,SAAS,GAAG,0BAA0B,CAAC;yBACpE,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,SAAS,GAAG,wBAAwB,CAAC;yBAChE,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,SAAS,GAAG,4BAA4B,CAAC;gBACpF,CAAC;gBACD,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC;gBAAC,IAAI,EAAE,OAAO,IAAI,GAAG;oBAAE,MAAM;YAClH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,OAAe,EAAQ,EAAE;QACnD,IAAI,mBAAmB,CAAC,IAAI,CAAC;YAAE,OAAO;QACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS;gBAAE,SAAS;YACzC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,EAAE,KAAK,cAAc,IAAI,kDAAkD,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC5G,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACxG,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,EAAE,SAAiB,EAAiB,EAAE;QACtD,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACnI,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAChF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACxD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC9B,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,QAAQ,CAAC,CAAC;YACpF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACrC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtE,IAAI,mBAAmB,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAa,EAAE,CAAC;gBAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;gBAAC,IAAI,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAC,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;gBAC5G,OAAO,QAAQ,GAAG,IAAI,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;oBAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,GAAG,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC;oBAAC,IAAI,MAAM,IAAI,CAAC;wBAAE,MAAM;oBAC9F,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;oBAAC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;oBAAC,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC;wBAAE,MAAM;oBAC1I,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;oBAAC,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;wBAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAAC,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC;oBAClI,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC;oBAClH,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC;oBAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC;gBAC9F,CAAC;gBACD,IAAI,QAAQ,GAAG,IAAI;oBAAE,SAAS,KAAK,WAAW,CAAC;gBAC/C,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;oBACjD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;wBAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/G,CAAC;gBACD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;oBACnB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;oBAAC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBACjH,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC;YACzC,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,SAAS;YACnB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,QAAQ,EAAE,2DAA2D;YACrE,QAAQ,EAAE,WAAW,KAAK,gDAAgD,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACnG,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7B,WAAW,EAAE,wFAAwF;SACtG,CAAC,CAAC;IACH,MAAM,UAAU,GAAoB,EAAE,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;QACtD,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,OAAO,GAAG,eAAe,CAAC;QAC9B,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,eAAe,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC3E,IAAI,eAAe;oBAAE,OAAO,GAAG,kBAAkB,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YACtE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC,wBAAwB,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,eAAe,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5F,MAAM,iBAAiB,GAAa,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;gBAClE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBACpE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC,CAAC;gBAC5D,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,cAAc;oBACtB,QAAQ,EAAE,SAAS;oBACnB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,QAAQ,EAAE,6DAA6D;oBACvE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,wBAAwB,KAAK,EAAE,EAAE;oBACnD,WAAW,EAAE,gEAAgE;iBAC9E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CAAC;YACd,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK;YACL,OAAO;YACP,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC;YAC1B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACnD,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACjJ,MAAM,YAAY,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACzS,OAAO,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AAC3L,CAAC"}

package/dist/src/security/audit.d.ts

@@ -0,0 +1,19 @@
+import type { BnpmPaths } from "../config/paths.js";
+import { type RegistryAdvisory } from "../registry/audit.js";
+import { type AnalyzedPackage } from "./analyzer.js";
+import { RegistryConfiguration } from "../registry/configuration.js";
+import type { ResolutionGraph } from "../resolver/types.js";
+export interface AuditResult {
+    readonly analyzedAt: string;
+    readonly packages: ReadonlyMap<string, AnalyzedPackage>;
+    readonly advisories: readonly RegistryAdvisory[];
+    readonly graph: ResolutionGraph;
+}
+export declare function auditProject(options: {
+    readonly paths: BnpmPaths;
+    readonly registry?: URL;
+    readonly registryConfiguration?: RegistryConfiguration;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly signal?: AbortSignal;
+    readonly now?: Date;
+}): Promise<AuditResult>;

package/dist/src/security/audit.js

@@ -0,0 +1,61 @@
+import { storePath } from "../cache/store.js";
+import { readLockfileGraph } from "../lockfile/index.js";
+import { fetchBulkAdvisories } from "../registry/audit.js";
+import { analyzePackage } from "./analyzer.js";
+import { loadRegistryConfiguration, RegistryConfiguration } from "../registry/configuration.js";
+async function forEachConcurrent(values, concurrency, worker) {
+    let index = 0;
+    const next = async () => { while (true) {
+        const value = values[index++];
+        if (value === undefined)
+            return;
+        await worker(value);
+    } };
+    await Promise.all(Array.from({ length: Math.min(concurrency, values.length) }, () => next()));
+}
+export async function auditProject(options) {
+    const { graph } = await readLockfileGraph(options.paths.lockfile, options.paths.store);
+    const packages = new Map();
+    await forEachConcurrent([...graph.packages], 8, async ([id, pkg]) => {
+        try {
+            packages.set(id, await analyzePackage({
+                root: storePath(options.paths.store, pkg.integrity),
+                packageName: pkg.name,
+                packageVersion: pkg.version,
+                integrity: pkg.integrity,
+                ...(pkg.manifest.scripts === undefined ? {} : { scripts: pkg.manifest.scripts }),
+            }));
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    });
+    const configuration = options.registryConfiguration ?? await loadRegistryConfiguration({
+        userNpmrc: options.paths.userNpmrc,
+        projectNpmrc: options.paths.projectNpmrc,
+        ...(options.registry === undefined ? {} : { defaultRegistry: options.registry }),
+    });
+    const packagesByRegistry = new Map();
+    for (const [id, pkg] of graph.packages) {
+        if (pkg.source !== "registry" && (pkg.source !== undefined || pkg.localPath !== undefined || pkg.preparedPath !== undefined))
+            continue;
+        const registry = configuration.registryForPackage(pkg.name).href;
+        let packages = packagesByRegistry.get(registry);
+        if (!packages) {
+            packages = new Map();
+            packagesByRegistry.set(registry, packages);
+        }
+        packages.set(id, pkg);
+    }
+    const advisoryGroups = await Promise.all([...packagesByRegistry].sort(([left], [right]) => left.localeCompare(right)).map(([registry, packages]) => fetchBulkAdvisories({
+        graph: { roots: new Map(), packages },
+        registry: new URL(registry),
+        headers: (url) => configuration.headersFor(url),
+        ...(options.fetch === undefined ? {} : { fetch: options.fetch }),
+        ...(options.signal === undefined ? {} : { signal: options.signal }),
+    })));
+    const advisories = advisoryGroups.flat().sort((left, right) => left.packageName.localeCompare(right.packageName) || String(left.id).localeCompare(String(right.id)));
+    return { analyzedAt: (options.now ?? new Date()).toISOString(), packages, advisories, graph };
+}
+//# sourceMappingURL=audit.js.map

package/dist/src/security/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/security/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAyB,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAwB,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAUhG,KAAK,UAAU,iBAAiB,CAAI,MAAoB,EAAE,WAAmB,EAAE,MAAmC;IAChH,IAAI,KAAK,GAAG,CAAC,CAAC;IAAC,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAAC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAAC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC;IACjK,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqN;IACtP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpD,MAAM,iBAAiB,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;QAClE,IAAI,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,cAAc,CAAC;gBACpC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC;gBACnD,WAAW,EAAE,GAAG,CAAC,IAAI;gBACrB,cAAc,EAAE,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;aACjF,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,OAAO,CAAC,qBAAqB,IAAI,MAAM,yBAAyB,CAAC;QACrF,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS;QAClC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;QACxC,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;KACjF,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAuE,CAAC;IAC1G,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC;YAAE,SAAS;QACvI,MAAM,QAAQ,GAAG,aAAa,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACjE,IAAI,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;YAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;QACpF,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC;QACtK,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE;QACrC,QAAQ,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC;QAC3B,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KACpE,CAAC,CAAC,CAAC,CAAC;IACL,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrK,OAAO,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAChG,CAAC"}

package/dist/src/security/findings.d.ts

@@ -0,0 +1,23 @@
+export type FindingSeverity = "notice" | "warning" | "dangerous";
+export interface SourceLocation {
+    path: string;
+    line?: number;
+    column?: number;
+}
+export interface SecurityFinding {
+    ruleId: string;
+    severity: FindingSeverity;
+    packageName: string;
+    packageVersion: string;
+    behavior: string;
+    evidence: string;
+    location?: SourceLocation;
+    remediation?: string;
+}
+export interface PackageAnalysis {
+    packageName: string;
+    packageVersion: string;
+    integrity: string;
+    ruleSetVersion: string;
+    findings: readonly SecurityFinding[];
+}

package/dist/src/security/findings.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=findings.js.map

package/dist/src/security/findings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.js","sourceRoot":"","sources":["../../../src/security/findings.ts"],"names":[],"mappings":""}

package/dist/src/security/integrity.d.ts

@@ -0,0 +1,14 @@
+declare const supportedAlgorithms: readonly ["sha512", "sha384", "sha256"];
+type SupportedAlgorithm = (typeof supportedAlgorithms)[number];
+export interface ExpectedIntegrity {
+    algorithm: SupportedAlgorithm;
+    digest: Buffer;
+    serialized: string;
+}
+export declare class IntegrityError extends Error {
+    constructor(message: string);
+}
+export declare function selectExpectedIntegrity(integrity: string): ExpectedIntegrity;
+export declare function verifyBufferIntegrity(content: Uint8Array, integrity: string): ExpectedIntegrity;
+export declare function assertDigest(expected: ExpectedIntegrity, actual: Uint8Array): void;
+export {};

package/dist/src/security/integrity.js

@@ -0,0 +1,40 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+const supportedAlgorithms = ["sha512", "sha384", "sha256"];
+export class IntegrityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "IntegrityError";
+    }
+}
+export function selectExpectedIntegrity(integrity) {
+    const entries = integrity.trim().split(/\s+/);
+    for (const algorithm of supportedAlgorithms) {
+        const prefix = `${algorithm}-`;
+        const entry = entries.find((candidate) => candidate.startsWith(prefix));
+        if (!entry)
+            continue;
+        const encoded = entry.slice(prefix.length).split("?", 1)[0];
+        if (!encoded || !/^[A-Za-z0-9+/]+={0,2}$/.test(encoded)) {
+            throw new IntegrityError(`Malformed ${algorithm} integrity digest`);
+        }
+        const digest = Buffer.from(encoded, "base64");
+        if (digest.length !== createHash(algorithm).digest().length) {
+            throw new IntegrityError(`Malformed ${algorithm} integrity digest length`);
+        }
+        return { algorithm, digest, serialized: `${algorithm}-${encoded}` };
+    }
+    throw new IntegrityError("No supported strong integrity digest was provided");
+}
+export function verifyBufferIntegrity(content, integrity) {
+    const expected = selectExpectedIntegrity(integrity);
+    const actual = createHash(expected.algorithm).update(content).digest();
+    assertDigest(expected, actual);
+    return expected;
+}
+export function assertDigest(expected, actual) {
+    const actualBuffer = Buffer.from(actual);
+    if (actualBuffer.length !== expected.digest.length || !timingSafeEqual(actualBuffer, expected.digest)) {
+        throw new IntegrityError(`Content does not match ${expected.algorithm} integrity`);
+    }
+}
+//# sourceMappingURL=integrity.js.map

package/dist/src/security/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../../src/security/integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AASpE,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,MAAM,SAAS,IAAI,mBAAmB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,GAAG,SAAS,GAAG,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,cAAc,CAAC,aAAa,SAAS,mBAAmB,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;YAC5D,MAAM,IAAI,cAAc,CAAC,aAAa,SAAS,0BAA0B,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,SAAS,IAAI,OAAO,EAAE,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,IAAI,cAAc,CAAC,mDAAmD,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAmB,EAAE,SAAiB;IAC1E,MAAM,QAAQ,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACvE,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAA2B,EAAE,MAAkB;IAC1E,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtG,MAAM,IAAI,cAAc,CAAC,0BAA0B,QAAQ,CAAC,SAAS,YAAY,CAAC,CAAC;IACrF,CAAC;AACH,CAAC"}

package/dist/src/security/policy.d.ts

@@ -0,0 +1,16 @@
+import type { TrustedPackageApproval } from "../config/types.js";
+import type { AnalyzedPackage, LifecycleFact } from "./analyzer.js";
+export interface PackagePolicyDecision {
+    readonly packageId: string;
+    readonly identity: string;
+    readonly blocked: boolean;
+    readonly approvedLifecycles: readonly LifecycleFact[];
+    readonly skippedLifecycles: readonly LifecycleFact[];
+    readonly reasons: readonly string[];
+}
+export declare function decidePackagePolicy(options: {
+    readonly analyzed: AnalyzedPackage;
+    readonly allowedDangerous: ReadonlySet<string>;
+    readonly trustedApproval?: TrustedPackageApproval;
+    readonly packageId?: string;
+}): PackagePolicyDecision;

package/dist/src/security/policy.js

@@ -0,0 +1,24 @@
+export function decidePackagePolicy(options) {
+    const identity = `${options.analyzed.analysis.packageName}@${options.analyzed.analysis.packageVersion}`;
+    const dangerous = options.analyzed.analysis.findings.filter((finding) => finding.severity === "dangerous");
+    const blocked = dangerous.length > 0 && !options.allowedDangerous.has(identity);
+    const approvedLifecycles = [];
+    const skippedLifecycles = [];
+    for (const lifecycle of options.analyzed.lifecycles) {
+        const trusted = options.trustedApproval;
+        const stage = trusted?.scripts[lifecycle.stage];
+        if (trusted?.version === lifecycle.packageVersion &&
+            trusted.integrity === lifecycle.integrity &&
+            stage?.commandHash === lifecycle.commandHash &&
+            stage.contentHash === lifecycle.contentHash)
+            approvedLifecycles.push(lifecycle);
+        else
+            skippedLifecycles.push(lifecycle);
+    }
+    const reasons = [
+        ...(blocked ? [`${dangerous.length} dangerous finding${dangerous.length === 1 ? "" : "s"} require an exact override`] : []),
+        ...(skippedLifecycles.length > 0 ? [`${skippedLifecycles.length} lifecycle script${skippedLifecycles.length === 1 ? "" : "s"} lack an exact trusted approval`] : []),
+    ];
+    return { packageId: options.packageId ?? identity, identity, blocked, approvedLifecycles, skippedLifecycles, reasons };
+}
+//# sourceMappingURL=policy.js.map

package/dist/src/security/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/security/policy.ts"],"names":[],"mappings":"AAYA,MAAM,UAAU,mBAAmB,CAAC,OAKnC;IACC,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;IACxG,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChF,MAAM,kBAAkB,GAAoB,EAAE,CAAC;IAC/C,MAAM,iBAAiB,GAAoB,EAAE,CAAC;IAC9C,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChD,IACE,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,cAAc;YAC7C,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS;YACzC,KAAK,EAAE,WAAW,KAAK,SAAS,CAAC,WAAW;YAC5C,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;YAC3C,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;;YAChC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,qBAAqB,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,4BAA4B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3H,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,MAAM,oBAAoB,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,iCAAiC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrK,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;AACzH,CAAC"}

package/dist/src/security/recent-release.d.ts

@@ -0,0 +1,19 @@
+import type { RecentReleaseHours } from "../config/types.js";
+export interface ReleaseIdentity {
+    name: string;
+    version: string;
+    publishedAt?: string;
+}
+export interface RecentReleaseDecision {
+    identity: string;
+    status: "allowed" | "blocked" | "unknown";
+    ageMilliseconds?: number;
+    thresholdHours: RecentReleaseHours;
+    reason: string;
+}
+export interface RecentReleasePolicy {
+    thresholdHours: RecentReleaseHours;
+    now?: Date;
+    allowedExactVersions?: ReadonlySet<string>;
+}
+export declare function evaluateRecentRelease(release: ReleaseIdentity, policy: RecentReleasePolicy): RecentReleaseDecision;

package/dist/src/security/recent-release.js

@@ -0,0 +1,27 @@
+export function evaluateRecentRelease(release, policy) {
+    const identity = `${release.name}@${release.version}`;
+    const base = { identity, thresholdHours: policy.thresholdHours };
+    if (!release.publishedAt) {
+        return { ...base, status: "unknown", reason: "Registry metadata has no publication timestamp" };
+    }
+    const publishedAt = Date.parse(release.publishedAt);
+    if (!Number.isFinite(publishedAt)) {
+        return { ...base, status: "unknown", reason: "Registry publication timestamp is invalid" };
+    }
+    const ageMilliseconds = (policy.now ?? new Date()).getTime() - publishedAt;
+    const thresholdMilliseconds = policy.thresholdHours * 60 * 60 * 1_000;
+    const isRecent = ageMilliseconds < thresholdMilliseconds;
+    if (!isRecent) {
+        return { ...base, status: "allowed", ageMilliseconds, reason: "Release is older than the configured window" };
+    }
+    if (policy.allowedExactVersions?.has(identity)) {
+        return { ...base, status: "allowed", ageMilliseconds, reason: "Exact recent version was explicitly allowed" };
+    }
+    return {
+        ...base,
+        status: "blocked",
+        ageMilliseconds,
+        reason: ageMilliseconds < 0 ? "Publication timestamp is in the future" : "Release is inside the configured window",
+    };
+}
+//# sourceMappingURL=recent-release.js.map

package/dist/src/security/recent-release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recent-release.js","sourceRoot":"","sources":["../../../src/security/recent-release.ts"],"names":[],"mappings":"AAsBA,MAAM,UAAU,qBAAqB,CACnC,OAAwB,EACxB,MAA2B;IAE3B,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;IAEjE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAC7F,CAAC;IAED,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC;IAC3E,MAAM,qBAAqB,GAAG,MAAM,CAAC,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACtE,MAAM,QAAQ,GAAG,eAAe,GAAG,qBAAqB,CAAC;IAEzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IAChH,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IAChH,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,MAAM,EAAE,SAAS;QACjB,eAAe;QACf,MAAM,EAAE,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,yCAAyC;KACnH,CAAC;AACJ,CAAC"}

package/dist/src/security/script-runner.d.ts

@@ -0,0 +1,13 @@
+import type { LifecycleFact } from "./analyzer.js";
+export declare class ScriptExecutionError extends Error {
+    constructor(message: string);
+}
+export declare function runLifecycle(options: {
+    readonly fact: LifecycleFact;
+    readonly cwd: string;
+    readonly signal?: AbortSignal;
+    readonly timeoutMilliseconds?: number;
+    readonly maxOutputBytes?: number;
+    readonly onOutput?: (stream: "stdout" | "stderr", text: string) => void;
+    readonly initialCwd?: string;
+}): Promise<void>;